{ "Event": { "published": true, "date": "2021-09-05", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-09-05", "timestamp": 1630886581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "72b4f13f-d446-4d90-8c75-778823c45b2b", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c921f7cc-0e1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630826874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826874, "uuid": "3308d756-2d5f-4fc5-9ea4-56f480c2a376", "comment": "Malware payload", "value": "a0a463916457b82adc775ddde2280197", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826874, "uuid": "98c4c2f8-7577-4918-9169-4f7693fba113", "comment": "Malware payload", "value": "01372b0643c12f3d88a7249bcd2c59ac8879c580cb510052d946852c6a5a3114", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826874, "uuid": "40beb0a3-b411-459c-9b58-f4bc951a815d", "comment": "Malware payload", "value": "523a15b2cd7ed055f5fdf92adbedbf477fc598a9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826874, "uuid": "0d504380-cf32-4fe9-9d57-42ce7b865b08", "comment": "Malware payload", "value": "f4ec39b363ab806c9f0dc2fa4dcd6afc6c8649554c616cb737062aa83473a819ee955d1fe8dd0f6b162ecdf99191953d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826874, "uuid": "41cec06b-ab62-488f-9001-fd3ce14733c6", "value": "T1EA94BF50FB4421960E83539BED5352C1EA7DC10193412169D99F93AC6B839E8C3BFBBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826874, "uuid": "2acd221b-9cfb-4d11-88e2-95c5f0f70095", "value": "12288:0Xt8DkZrYFxtydGJyOiLMzOSNRnJol/jy/W:0X2sYRlJTioK6JolP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826874, "uuid": "f2dd161f-dbcd-4dc5-ad37-b86add8e14f8", "value": 442621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826874, "uuid": "49c4c5d5-f26c-40bb-9f0d-cacaa20b4d57", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826874, "uuid": "ff493046-4671-4c97-9775-963040bd3d7f", "value": "8887.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "955d19c4-0e31-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630836666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836666, "uuid": "fc652aa1-590e-466b-ab0d-ccd49233030c", "comment": "Malware payload (RaccoonStealer)", "value": "14644cc2d4377e98e15da8e998ee6b54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836666, "uuid": "51548e0b-14ba-453b-8842-1817b14507eb", "comment": "Malware payload (RaccoonStealer)", "value": "022fc71a6661ab3d6efc0f7d3e560a05cceb22b31081e7cb5d882b01921d5e38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836666, "uuid": "ef32a4fb-ce76-41c1-94e9-467234411395", "comment": "Malware payload (RaccoonStealer)", "value": "c5c38e0c6df24bb414081d9221bf0e300a823c9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836666, "uuid": "1d16433f-34c0-44ca-bfbc-2dbc1d819950", "comment": "Malware payload (RaccoonStealer)", "value": "329349d0ed55402f74cdb2ea0388e89801e95fb9c6380e12083b431f32872d044574778e88df0c6ad8f119b51eee3edf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836666, "uuid": "46b872d1-11ed-4293-ae11-fdfc62b6db3c", "value": "T1C82633003FC5D4BBE9551137CA481F2124B8C3D90A619AC3B766451DFB3C6E8FA9EE1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836666, "uuid": "c382c06d-f329-4751-a963-5219628fca3e", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836666, "uuid": "716126b7-605f-4b5f-a791-d67121cc61b2", "value": "98304:xjCvLUBsgZSqnETDOgzDyHRycWmLHkuB9MUsXoTQgv7dX/Zd3DO:xYLUCgZGOIk7jHsYTQmxd36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630836666, "uuid": "07af7cf5-09ad-4976-abdd-31959d06848b", "value": 4839012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630836666, "uuid": "afe7d688-6018-4074-8609-b1f3e482fd81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836666, "uuid": "1648a364-eef8-40ba-b5f8-e7ea5cec5f3d", "value": "14644CC2D4377E98E15DA8E998EE6B54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24137e71-0e1c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630827456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827456, "uuid": "675efad5-9e5c-4143-b3de-db1784d59685", "comment": "Malware payload", "value": "ca0e542a6fe32b03ea1a5792516b183c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827456, "uuid": "f46a9e4b-98d4-4d64-a223-facfca535d94", "comment": "Malware payload", "value": "0276d4290922c9c6c9e1ab62d35c555d13199a337e923017fee15d79b7f420e8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827456, "uuid": "86a3985e-34a3-44f4-b754-009cf921c840", "comment": "Malware payload", "value": "104a702fbc051ac9595fdfa13676d8fc06c30faf", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827456, "uuid": "bc4f0382-7187-4665-9795-514f6361fd23", "comment": "Malware payload", "value": "77f66982e21e48c83bff8302c12ff4f7f0e58ff41ac3901efe87d24b02a4b69e33ec82500bd26fb202d5fedc38c87650", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630827456, "uuid": "b5fb1d0c-65fb-4d19-b660-ef54cc9eec05", "value": "T16EB4231622AA914499BAD3FB7E778DCB12D480A02BF855F84F46B7B2593167F0110E3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630827456, "uuid": "973f9e77-c9c0-4eed-9713-de512b6ad849", "value": "12288:1MMYBlJqaKo8sy05Iwo5Y2WxmnE9jDJ2cOz:aMyJqHnsUwo5YL1jDJri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630827456, "uuid": "ac27eedc-3fb8-4570-ade8-801dc88ad802", "value": 534455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630827456, "uuid": "748bfa4a-abc9-47da-98fc-db61748ff527", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630827456, "uuid": "e7a63ea3-b57e-4768-a693-b30dff9eda66", "value": "MRKU8781602.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0241f2c2-0e5b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630854458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630854458, "uuid": "569861f9-e2f1-415e-a576-5d6a97982f42", "comment": "Malware payload", "value": "a72d63b9e041d9cc49f238cf339769db", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630854458, "uuid": "35609ffa-e1ef-4802-b420-6233dd4ef777", "comment": "Malware payload", "value": "04b6a15b62077c0a6a69d7efe325de2f8a587eebe7c42e37047add911e5d83db", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630854458, "uuid": "53c00458-727d-44f9-8380-5762543c8b6b", "comment": "Malware payload", "value": "4086061d2b6d45b9a1a22ae87fcf1ef9e5e61351", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630854458, "uuid": "4c3a0cb6-038d-4106-91e8-e3dcc5dfd4ba", "comment": "Malware payload", "value": "9ab8ddfdade6164048aec408904be44068ee93b0c3d02b1e6545a523afbb4edf1fd4901086688934fde4567f613475ff", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630854458, "uuid": "0138583c-64d3-4f0b-92d8-ef8de8bf0560", "value": "T10C51971AF847D15C9BB9236BEC97C966FF1B811B9DA2104C71DCC2495F30809A66CF8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630854458, "uuid": "8360b97f-8a57-420d-b75c-1169acfa07ed", "value": "48:AxT48iLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBozlC:iGhrffvIypvK0elkEYZ85zk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630854458, "uuid": "c12ea5e5-3dbf-494b-a952-c8c8c6ece725", "value": 3115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630854458, "uuid": "fad6c069-1667-47e2-b4f1-a15159e62afc", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630854458, "uuid": "30e821ba-5648-4053-95d0-e2d0c828eff8", "value": "KquAqq9J.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98307d04-0e19-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630826363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826363, "uuid": "c5b9be87-7fda-4b62-a32c-37efb65d6c7d", "comment": "Malware payload", "value": "7ca47a3af3ae3ad81d9d80379026a535", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826363, "uuid": "ebcd1bf6-b89e-4741-9d67-18cc00432b3a", "comment": "Malware payload", "value": "04fa0df15f0a3a213d02e0dcd81b518ac095e4a19cf9df636b283db42f1d84e2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826363, "uuid": "2ce5ac94-f7d9-424a-a488-d88ebbeb6fe9", "comment": "Malware payload", "value": "2f82eb703ba6286ad52d4326255c7e241978e7ff", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826363, "uuid": "d9e6507c-5377-4365-9a0c-119d896e3a0b", "comment": "Malware payload", "value": "cd330fd3368d5140a9caa8055aab1c968a58df5dcb2b12c5bc7c0b261041957254038551596f6bae95318bb10decbcbd", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826363, "uuid": "22ab96fc-f80a-42bd-bfca-c28242ec65cc", "value": "T17BB42319B5D1954EC3E640A3B0B737C6322B8DB0912998C5763D272B69CC9246BF3F36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826363, "uuid": "f63899ad-1b9c-4386-9377-d38e279bcbf2", "value": "12288:1o1bS3oz9pgQlDfcQ9T2ksZIWclFFo90g:1iS3oJpLDfcQ2ksZIWqFFK0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826363, "uuid": "b83cd3fd-f180-49ee-b501-8d78cfc24de5", "value": 496249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826363, "uuid": "daa78fd3-5533-46f6-a397-61c2f6506cd4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826363, "uuid": "eed88b8d-55d1-47ce-b035-a38ed90a3a47", "value": "6522.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82321981-0e0d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630821172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821172, "uuid": "85d46c76-06bd-4368-807b-573444fa019e", "comment": "Malware payload", "value": "7a02c07c98e977e033ea73429dd2014c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821172, "uuid": "2fc7889a-89ef-4990-b453-f014062f7441", "comment": "Malware payload", "value": "065ad641b43d2a108c3d605160ff575ff96ffcedcbd348e5465133a9535e0499", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821172, "uuid": "e5dec763-2f6b-4d80-bbb1-d7b7f4f2b013", "comment": "Malware payload", "value": "5335a5dc35672dbb03e89c32a05fe640fc96a89d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821172, "uuid": "4e57a517-f9d1-4781-8c97-3d93282dbc6e", "comment": "Malware payload", "value": "a9c0461b3dd57f0a2e2644318f913d140760079a97006ebf63e19a69ad37bca963adbe8669211bad8ab5ec5f788a336f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821172, "uuid": "4f8e6fc2-f311-43a3-b74a-2d5857eee5d0", "value": "T1E4F48E32E2E048FFE1275A796C0F6BB02D157E916A242D436FF4D8488F68653723B19D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821172, "uuid": "33ac3e04-b325-4fca-b8bb-63bf8158e465", "value": "c2d34edc2aca1b8c272c5cd63dd80347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821172, "uuid": "0ed72c32-e780-4801-b4cf-5bd33f3fb10b", "value": "12288:EcMJCaTkjTh4b6XG3n7ybodv9cPdgRKue03SOXjVwrsqaE6MzF5:EBi94zYSFcFgR6nza2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630821172, "uuid": "9d9045b1-0788-4444-a50f-e755c084ba4a", "value": 792576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630821172, "uuid": "9b137b81-7696-4592-b24d-ef8aa56c1490", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821172, "uuid": "db4b8db1-c84f-47c1-b2a0-00cc8d2bbfda", "value": "BROWNRIG ORDER CONFIRMATION-5543,PDF.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f1f841-0e1d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630828018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630828018, "uuid": "f3364a03-61d5-40fb-a799-d2447380b5c4", "comment": "Malware payload (AgentTesla)", "value": "00136ac66ec116bacc06f9c2c36deab7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630828018, "uuid": "454a3fc0-e62f-447e-8b58-758e79037457", "comment": "Malware payload (AgentTesla)", "value": "06c9a678fcb054f5e0c09b4db8fc21bd676a5a41183341f552c7043ad6b3ed45", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630828018, "uuid": "b9d8e8e5-7c7e-4611-86d4-03f02a8ae925", "comment": "Malware payload (AgentTesla)", "value": "d7e0b1f70f906dab5aa14045069a8a5ea85ae57a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630828018, "uuid": "b6b5515a-3651-4427-aae2-d91177756295", "comment": "Malware payload (AgentTesla)", "value": "59f10f7c44dbbe5050aa8b91a00bbcd6c8eabbf86b832f12b6b7c7e53d06a7360eaf59160e76d112b4058ddcf2547169", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630828018, "uuid": "5eb938b1-3b0c-449e-9c44-12ea007ff971", "value": "T12B9423AB122E8339457FC9DDE045E09A1AC9E3C5B7494E9E3BE84C3F509AB31707D906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630828018, "uuid": "4f250416-ddab-44c8-a44f-ab8f96af8566", "value": "6144:APP5XQY5U1/5Pkd20uYXKUSyYsY5F7KPXk9pBe1fp+DbUGI9AtNgd78AxsQn3NtJ:AJXQY2jPkd2yiRW89GjYPApn3vbJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630828018, "uuid": "b28eb289-8a49-4f3f-8e1a-67c7b0eca860", "value": 424051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630828018, "uuid": "37e2e917-aab1-459f-8f5e-368e8e25628a", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630828018, "uuid": "edfc90bc-83d4-4c0d-8bfb-8e1076dbb271", "value": "Urgent Quote.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "674cdcff-0e2f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630835730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835730, "uuid": "1f711e44-7bd2-40f8-882d-d62d852cb82b", "comment": "Malware payload (Formbook)", "value": "8bf61fcddf180c45869751eca4bb0938", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835730, "uuid": "06f064f0-50ed-4635-b21f-6895d0036fdb", "comment": "Malware payload (Formbook)", "value": "07033cb09a7c7cecf465003cf625997743f5263f8285d3204c6c3eb0825a8b2c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835730, "uuid": "9e7fc445-1a47-4672-93b3-e4373f3b4b35", "comment": "Malware payload (Formbook)", "value": "e179bc30bee2f8a80ee1827df5c29961189703c2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835730, "uuid": "38ee101e-0575-4c64-b4fc-3b4e6bbcb756", "comment": "Malware payload (Formbook)", "value": "6c771564ce62342388161fac9cadf736d63ddbbf225d1a62ab442e7b0e4d06728a390960c44c442e89381ffe077623cc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835730, "uuid": "59308b79-1f2c-4b23-bab7-9abd9e42bfbc", "value": "T1CDA4236391AFD94609EFDE2272081DA439CD1255A94EF83A37CD1A0EF60FD37A16121F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835730, "uuid": "cdfa8f7f-074f-4a62-98c2-87f8ba6d586f", "value": "12288:u+xDIBH7LgJreRvTHy/5bPtCgpMkE3Lww:nMBoJiZy/5VC4Y3Lww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630835730, "uuid": "1d3f7488-a9c3-43cf-a643-1f4948e46a92", "value": 477833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630835730, "uuid": "0502bba7-0ef7-4760-a63b-c0dd3ed8e62c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835730, "uuid": "2bdb50dd-6b32-4251-a920-edb96042185b", "value": "PO.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa80c082-0e5a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630854445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630854445, "uuid": "78067de1-5d32-4b38-b656-73ae2321c83d", "comment": "Malware payload", "value": "8ccb322229308e8388936576c0563a92", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630854445, "uuid": "4aed1bdf-02d0-49ba-ad0b-729b83b80751", "comment": "Malware payload", "value": "07d91c722595ca661919fef8f8c036084c91e4128bc55a53373ab3fc5cd2f799", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630854445, "uuid": "26fedd24-0113-4d32-9623-3b961070ca89", "comment": "Malware payload", "value": "18711fd7368af32e05c28a131d32f3e5c947a45b", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630854445, "uuid": "2fa70608-9eea-4f53-a18c-088d75854e1a", "comment": "Malware payload", "value": "e8548bf2f6b5a88ea3e9ad05257b283a171dd0ef0490516948735bf17420567fb9f62ddfbd90856a5c5724b44b53ad6b", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630854445, "uuid": "c257a3a8-0b60-40ee-84ae-a7ba22edc270", "value": "T1FB51940AFC47D15C6BB5235BED978A32FF1F401B5DA3100872DCC2595F20809A7ACB9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630854445, "uuid": "80fb255d-79fc-4ce7-8633-e425b7275e59", "value": "48:kx9JckjOjOLuDQjvUKmc4TQ7QZE96pAUYRAGqqsUoyWKLrj6l1CelkEJmZVoQdrr:mHWChrffoypvK0elkEYZaM8ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630854445, "uuid": "17822dde-264a-4141-afa7-eb5be8c03930", "value": 3156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630854445, "uuid": "5ba24814-40a9-4963-a665-0eef5f9df272", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630854445, "uuid": "aa04bfb7-aa35-477f-92aa-a14346b67312", "value": "JEDWvmcK.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85891886-0e12-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1630823325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823325, "uuid": "11122550-0699-432e-a4f6-8e1005cc2c81", "comment": "Malware payload (RemcosRAT)", "value": "8b96f4ac0f62ba1fd657daa41cf64aa8", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823325, "uuid": "fbff59b0-8aab-46e0-97aa-4ad0c56b0cc6", "comment": "Malware payload (RemcosRAT)", "value": "0853d21c5a3c24bdf349a66f3e01d274f665771f78df546a0951b130495e556d", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823325, "uuid": "7e28d64c-3dce-42e4-9513-acd9eedc35a4", "comment": "Malware payload (RemcosRAT)", "value": "b9cd306eca51888864420d03796ac9c9960b22c3", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823325, "uuid": "f04cb3d0-dc04-4d12-a953-3cd21cee04b6", "comment": "Malware payload (RemcosRAT)", "value": "10f0ec660b7e28e2154490a89d9849afe62b2144ebf1af6a140bc9379246d21de6dc01841e71bda2260b43841d65bb75", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823325, "uuid": "c2956953-6b0d-48dd-adfa-5adb92ad1809", "value": "T1B0456C6062D54833D2BA817E1C1FF238D8153E122D28AE606EE4FC4A5F7DEE476152E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823325, "uuid": "3df0a70e-1971-4b25-a299-d8ad4f0e218e", "value": "12288:e32D6sAniEeWwhvT0Xq7FZlU2i5DZ/iFXCj:emYhwhvTf725Z//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823325, "uuid": "84d7a5b0-bc0d-49b5-9abc-47d4dcea4401", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823325, "uuid": "53de8e89-5fd0-4704-a8fd-70009ef90df7", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823325, "uuid": "94105f85-e038-4370-b390-84714142fce4", "value": "Attachment.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c56578-0e10-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1630822362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822362, "uuid": "2c7c8396-5d4e-4bff-91d7-914576ef715b", "comment": "Malware payload (Glupteba)", "value": "6c0c5757834168ac9537cd2a85a9ffad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822362, "uuid": "e963eb9f-221d-4be5-9a62-79409d9a6a72", "comment": "Malware payload (Glupteba)", "value": "0898070f71015de41ab42ba5edc1d67214d3fe8ce10dfaf2f3d6c2ea4f108642", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822362, "uuid": "99657681-e233-4364-80b1-27514672e5d1", "comment": "Malware payload (Glupteba)", "value": "b5c23fa6a7da901fa6da1d728f331cbd7b511ca0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822362, "uuid": "af998046-5bfa-459b-9ef5-cd6bcab7e55d", "comment": "Malware payload (Glupteba)", "value": "02e02315de039de299656c705c633833499a50acb3aaaf2e0632aba134c02765828f8adfd96f5bbea90a933eec3b23f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822362, "uuid": "e65d4efc-2b8b-4229-9c34-f05db73a0484", "value": "T1432633477EA2F897D251D07145AAE790DAFEBCE2B93883267394FA2F5C311C0C91E194", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822362, "uuid": "6738650d-56c0-48ad-9ba8-c284cdfffdf6", "value": "f530acf7acd4a5c8880ba2a4704d4cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822362, "uuid": "7652b5cc-84d3-46eb-a85d-f1a9ca5f0bc3", "value": "98304:Kv5ymCkjWLCQ27ksJHJJybs5eVvRYqa72use3wFCNu3:Kvb8LF6Hiieb/a7n/XNu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630822362, "uuid": "c990dca3-cbf8-4054-a17c-19263671b4c2", "value": 4650536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630822362, "uuid": "bb61fa16-8772-41a4-ba27-178e409b7e3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822362, "uuid": "67fcf97f-7af4-499d-9450-cfcbf482bdce", "value": "6c0c5757834168ac9537cd2a85a9ffad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b22486-0e26-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1630831912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831912, "uuid": "40c69238-2db2-4c8c-af89-eb63cd06f47f", "comment": "Malware payload (NanoCore)", "value": "3412dc347c75f4a9ad4f9583b9f88682", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831912, "uuid": "01f0b59e-acf7-46c6-b1e2-98a2c0782f36", "comment": "Malware payload (NanoCore)", "value": "0a5091598cbe96752fc12a49d6afe27b1f2df7f41986c4216d5c9d0300cdaec3", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831912, "uuid": "bc8bc9ba-b562-4b89-a565-fc9d07758211", "comment": "Malware payload (NanoCore)", "value": "5cf9588f4cea1a482a015dce422dddcf4dc38808", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831912, "uuid": "484e62eb-376c-4a9e-bf41-f3a9a21f6094", "comment": "Malware payload (NanoCore)", "value": "6a8b4deb579e44a346ac08a0fb242cc4086c15cade6570f8f4fa36f0a1e962682929834ff31f090d0d8efd4b7d511cb8", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630831912, "uuid": "97bbf3f7-0028-4300-b852-edec5659374e", "value": "T195B42344F7A7FCCC0A3907628869095808C99F5D7DCB6AF6C4771B2B26B6D168B19C3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630831912, "uuid": "89b82a48-7320-4aef-9513-18a75a06224f", "value": "12288:kOzPxMDQEKZx/czzn54oGgEPCyRiHfFUr+eV9f7:kqxM9X5xfGRQtUr+45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630831912, "uuid": "28f94a81-8bbb-4781-8330-b2e438d4684b", "value": 524624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630831912, "uuid": "154251e6-69d0-41ef-a27b-f17d674b3eaa", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630831912, "uuid": "11a922aa-28eb-4efc-a150-2fad11d0e7fd", "value": "new enquiry list.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37cb7bb6-0df4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1630810310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810310, "uuid": "6a5d81e9-0716-452d-bcb2-b22c6a8ea15b", "comment": "Malware payload (Gafgyt)", "value": "9d841dd13388bd36b2e86566f8e944f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810310, "uuid": "233fc3ae-d2e2-4a8e-9354-f999c69b6296", "comment": "Malware payload (Gafgyt)", "value": "0a56d23a8784aef8501a2764d05b2c46c805140ac67fa27f55174f797f18f30b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810310, "uuid": "7776cc88-7438-4131-a624-0c2f641921de", "comment": "Malware payload (Gafgyt)", "value": "e3fc804765b1556004355bf18da899c61796d2ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810310, "uuid": "81dbaaf6-7461-4f9c-ab43-25b1310bb116", "comment": "Malware payload (Gafgyt)", "value": "0b5f7305146e5d5c4e8683fa600e2de91f392ee50b3483182104c2e7075a28158d1c23ec28f2d68e0784c4f5bf54f22d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810310, "uuid": "e251ffb3-1935-4765-aed1-4767b4abedf9", "value": "T1A4F37439B7619EB7D80ECE7301AA45021C8CD98752D92FAFB2B4E518E76B94F04D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810310, "uuid": "b0d53f45-a16d-4735-9db9-2e7d5a197fc0", "value": "1536:PGeTwPtvVT/U+BQvaDIyf9CZ+zCRsQABQWFaNvq0r3pRp1mrTi0NaLr2qvPvNb:PcTI8o6Q0QDSMZv1mrTdNaLrnvPvNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630810310, "uuid": "6ccdc0e9-b7b9-4d7e-ac08-1b58314c2d8f", "value": 168058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630810310, "uuid": "158a7d54-d6b4-424e-a436-85d03cb715f1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810310, "uuid": "17733c22-d65c-4a16-9acd-ad0052ccaf52", "value": "9d841dd13388bd36b2e86566f8e944f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b87b567-0e39-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630839978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630839978, "uuid": "3e5e8521-4ca4-4c4b-936d-3cbb91d9bea8", "comment": "Malware payload (RaccoonStealer)", "value": "52a66d7cf126d1274107350e43f4337b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630839978, "uuid": "86e8501d-ec18-4b77-ac19-b65145224b4a", "comment": "Malware payload (RaccoonStealer)", "value": "0a814a1f3ef52e8379da69712873c881699ead13f7ab737f875638313123d181", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630839978, "uuid": "6f13dd06-59cd-4e73-b2e1-461509a92a77", "comment": "Malware payload (RaccoonStealer)", "value": "07cc5b1fdc0f607183ccc506e835800ee4985228", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630839978, "uuid": "51facb82-0592-4758-affd-94ae0565e441", "comment": "Malware payload (RaccoonStealer)", "value": "d31d3de87064e56cd0e33e2a8ffa3b0715f38aa9f7692bd0d8855774cdc29f46b50b7d4571831f82536c0c71f06c8222", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630839978, "uuid": "7b1cf3e5-5773-443e-bdb1-04fb473013e0", "value": "T1CBD62317F398553EC4AA27354673A25068FBFAA9F417AE1A67F0C54CCF351C00E3A6A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630839978, "uuid": "3f1964cb-d49f-4735-a8e4-a101ea16c1bb", "value": "eb5bc6ff6263b364dfbfb78bdb48ed59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630839978, "uuid": "9781f606-c7a5-44cf-8557-c7ea34452f49", "value": "196608:5utpW72KEhMq2zUS+Wdr+qPYoatl0+t/7I9K6Td+70oeQNEZhp7LdCQMGjwQM7lt:Y62HhM9JXdKqPQzcY6k7uQEF7Ejlrcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630839978, "uuid": "eaa155ba-223e-43a6-a65a-0a04ca64a117", "value": 12639119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630839978, "uuid": "7c24f27e-4f01-489a-91f6-e27a300d1963", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630839978, "uuid": "d2e8e476-03bb-43af-82a5-9a95df39701e", "value": "0A814A1F3EF52E8379DA69712873C881699EAD13F7AB7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f17e697-0e19-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630826321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826321, "uuid": "1019fac1-aeda-49a6-a1ca-ee2e950044bc", "comment": "Malware payload (Buran)", "value": "9eedf8bee6c9718d34dad535dbe98e47", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826321, "uuid": "521f4bb1-e08b-4449-b71a-c3449405c76b", "comment": "Malware payload (Buran)", "value": "0b3a00e7a18eedecc0591254ddb958b52f3442cc8f77b5b477ea0253315f5598", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826321, "uuid": "9d07dd04-b17c-4156-9731-6c804b005ecc", "comment": "Malware payload (Buran)", "value": "98d1324e22d786f0a862d8c5fdca24d804d2dd04", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826321, "uuid": "c9fb2caa-070c-407c-b37f-2af0a4331271", "comment": "Malware payload (Buran)", "value": "97ecd913e53fb1a2905e92ae2ca0d816bb609527800c12c06e79305d8279f65eb342af39e90cf557327eac254e02b4b9", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826321, "uuid": "a92d0c70-7851-43a1-9f11-90c652bbdeef", "value": "T134642350C71985BBA7D141560AAADBCBF55996C3D6B1802286200ADE43AFFE84FCE44F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826321, "uuid": "b70d2b0e-58da-4c17-a1e3-8dc045449cac", "value": "6144:yrcV0UyiVvpyRiYkJ7meSG2SMTTUenNlBtlLlyWsSH1oaRCc8bvMCyv:0cV0zilIsF7bSG2FTgenNbXAWZxgc8b4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826321, "uuid": "379bc764-a681-477e-8a2d-6cc32b2c611b", "value": 307458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826321, "uuid": "aaaeaf20-4823-4fb0-a449-41399c31baf7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826321, "uuid": "eac12047-791c-4b9e-bf7e-7a9598a854e1", "value": "3247.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2551415d-0df1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630808990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630808990, "uuid": "99634a78-e23e-49f8-9725-f89edde5a7ba", "comment": "Malware payload (Mirai)", "value": "40fa33be2f9f31f3f094dce41d8ee7e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630808990, "uuid": "c7263e70-71d7-471b-bbef-870d6fd59236", "comment": "Malware payload (Mirai)", "value": "0c07c756e3495427cb644b56736b0104a2a903362fd045271700d0575af09161", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630808990, "uuid": "79ef3f6c-2428-478a-a81e-2e03bfe1bb36", "comment": "Malware payload (Mirai)", "value": "fdb59e5ea53c74df5e6cac8949cfab83aac844b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630808990, "uuid": "806762d3-415b-4031-a40f-caaa591e3460", "comment": "Malware payload (Mirai)", "value": "1ec2bf694133280d326e0480429a09e8d7b1b31e07ef26cebbc9ea298b713fec134e59c1aa6728660fa14e3ea87073bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630808990, "uuid": "537fc7d8-80fe-464f-ba90-c6af8cb7fd90", "value": "T1EE64029BDB62BC5FED1B4FB021570B4627F8D2CAD3864540B368884439FE242A3647CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630808990, "uuid": "7fe1660d-2292-44cf-a093-9c2a8d4308d9", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6coNoy3Q:7O/QJHZweEL/NOjCHm7FZZnciC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630808990, "uuid": "18b1b676-78f5-4d41-98ad-ba9e14d51319", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630808990, "uuid": "c60f2b59-6f4d-4ffa-b99b-a4add7f42d8e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630808990, "uuid": "8212524f-afe9-4bf9-919c-1a452e30710c", "value": "40fa33be2f9f31f3f094dce41d8ee7e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed92528f-0e2e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630835525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835525, "uuid": "bf2f273b-da89-4c10-af15-b94be80ff55d", "comment": "Malware payload (AgentTesla)", "value": "0d22c247b314e7828e4c6143de793d7d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835525, "uuid": "f4984aa8-a50b-4f1f-8c69-fc7fb64bedef", "comment": "Malware payload (AgentTesla)", "value": "0d840e0f3b93e6ecae2b64ede7f8df4ba3769d348c1c8ac3eb34470398f0b2f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835525, "uuid": "ca765e62-8e28-4309-abe0-1c498bf58fa8", "comment": "Malware payload (AgentTesla)", "value": "ddaffebebd837d359455082fcc57d27fb65ac188", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835525, "uuid": "4e2aeb20-b95c-4e91-b69e-aedbe013f16c", "comment": "Malware payload (AgentTesla)", "value": "22a1f56ab433372397f18981a29cf589ee82a3c8466de39f061070c626154ae4dc9567f6a7d071757ba7c1573ebccfe6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835525, "uuid": "4bacd35d-af57-4e4e-b3cf-c8d92b7bc1d2", "value": "T11FB4234D33316B348E1627C4E342A1B5AC80133699C79D3D634B6B79F6DEA3603AF5A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835525, "uuid": "3f8ffc0c-2762-46c1-827f-ac8128161aa6", "value": "12288:+TcR4LQ+ogxyta+ZGZICKgIvyTNUU8rKkkxvYzx85+rfvA:SX8rVB2bEvyBTdK9A63A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630835525, "uuid": "cecec52d-ea79-4d36-a5e9-7c4a91b30862", "value": 508721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630835525, "uuid": "285da22a-b43b-4b30-87c3-faef7f80b7d9", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835525, "uuid": "6773f0e2-773d-4c5a-b63d-894b40288d4b", "value": "PO(A21.0708, HA21.0612\u2466).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7569a681-0e33-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1630837471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837471, "uuid": "2d3955a3-8b7d-4085-8ef1-cda44a5e5bfb", "comment": "Malware payload (Gozi)", "value": "c3ac66549ed38bd047c0e8fdad8899b9", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837471, "uuid": "9181a578-7496-4ad9-9dab-4c32550aa8a5", "comment": "Malware payload (Gozi)", "value": "0e23b1230049d27c6c8ca6773adc4b4a8203681d4e82e1a3058ed6e30c38363b", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837471, "uuid": "ae4b6e86-30a8-4ab3-aa3e-4a6ef5f69551", "comment": "Malware payload (Gozi)", "value": "276654ab8d1af832bacc21a1436b7101834d481a", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837471, "uuid": "59194eee-d6c3-4d63-acd8-6247a2a40887", "comment": "Malware payload (Gozi)", "value": "62fe28868927c605ecf3fd1b7d6692998342ec079c99aa72b98ae40bdcd73cff42a6d8d80ccbd244ab35b46285c566a1", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837471, "uuid": "73ffe71b-6070-48cc-ba1b-7258fb702a29", "value": "T11D64234E87A2288FD4DA706091EA873D14B75F51E5222719F8E8C3B4349A7B443BF4DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837471, "uuid": "9724ca69-5540-4d23-87de-35f50bdb914f", "value": "6144:q8d9Ct/jrF5CBV32PI9bL+fRQXLmregz/rgxFDRQD56Cgc7bmxZ8GxJE5V1Y8A+z:Z9Ct7rvCBIPI9vwQEriDQdMcaZrJE5HD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837471, "uuid": "5d029f22-cc32-4b34-bbe4-9db74c2deaf2", "value": 334604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837471, "uuid": "433f0fbb-7871-4eb1-9af9-4413bc662848", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837471, "uuid": "e82ca3b5-b557-4c13-b2ae-5dcf34963027", "value": "9993.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65ccd4d-0e9f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1630884046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630884046, "uuid": "3eaf4a03-7f5b-44aa-888a-3e5885c4a68a", "comment": "Malware payload (ArkeiStealer)", "value": "330271240f345c82d93d7eae64263c73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630884046, "uuid": "d1196563-4fd3-4a0f-8018-d97a6371d978", "comment": "Malware payload (ArkeiStealer)", "value": "0e5895d15b6e3ca830858d87198da7750bc001d4bce5294936a4b8cbfd907109", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630884046, "uuid": "346859c7-7228-4857-a9cf-f88fca94d915", "comment": "Malware payload (ArkeiStealer)", "value": "2e70a960fa6fff7c97343c30523d7b8d6d5a31e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630884046, "uuid": "8c8bd63b-1c69-46f5-91e8-052477537fe0", "comment": "Malware payload (ArkeiStealer)", "value": "4bc45651aae4169813e5c230048391b0b4cb8c60bf1c797ff4f230e3c9eef5ac2ebb240fc34625aa23539978887bf84b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630884046, "uuid": "8ad7954c-3127-4b65-aa7f-1e9d0944a89e", "value": "T1A0E41222FAC1E03BD6E205301520C2F49EFDFCB26A69914B3754FB7A2DB12915E62747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630884046, "uuid": "dcefb312-3daa-450c-8d56-9cc5d6bdc103", "value": "9c3501e221e7e06d3e51bfb52c2b6518", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630884046, "uuid": "3ec967e4-a936-4a84-a9cc-dea9833062c5", "value": "12288:1Qeiz1XnYJsfbFdF/9j52RV1Gr73CksPUwHB9hkAIASmD+:PIlnYEdVjq0rLVRwHB9+1mC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630884046, "uuid": "423dc2ae-2140-4012-b377-182fe035fe31", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630884046, "uuid": "eddd280e-149a-4df1-a0f3-11d222e6c00e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630884046, "uuid": "9297f3a9-63f6-49bb-a4a3-8eb55ee45038", "value": "330271240f345c82d93d7eae64263c73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c408099-0e9b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630882204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630882204, "uuid": "a4b4dabe-8aed-4b85-8dcd-583e286d5a8b", "comment": "Malware payload (Mirai)", "value": "941de1bd15943683dba19281165fb2e5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630882204, "uuid": "932d4f36-fb47-4d6b-98b5-ff11ecdd126d", "comment": "Malware payload (Mirai)", "value": "0f8a5c91a85cb30eea6f14fd47078cf2fd4e45ad11f7ef0ef5bf71375ff61a27", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630882204, "uuid": "9f5f2d19-55d3-4e95-b4d1-18ce0bb91877", "comment": "Malware payload (Mirai)", "value": "105d502a583015b895039f22bdbfd5bfc97d8e95", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630882204, "uuid": "300867bf-a45c-4eea-99aa-d8e2e5e765d7", "comment": "Malware payload (Mirai)", "value": "b7df700f8c63e697621997124fd522af5cb9acd1b51e4818ff74542acd9a921ab48c2c7ca0f7617a8ac9383acf5adaca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630882204, "uuid": "486c82bc-63af-4eb8-b695-9b392e76e023", "value": "T17333F233BE184D0388227C73E9B546A765BBD37AE00E59F5E5074CBDB840902E9F2947", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630882204, "uuid": "ab9169ac-80fe-474b-950d-43df07279f13", "value": "1536:FBd49Pl29hwd14wElc8y/T7tCL4LAN/fBZ/q2lT:YPlRdFd8yr7IL4+JJq29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630882204, "uuid": "c1b11723-87c3-4df4-811f-f7c67a49db19", "value": 51692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630882204, "uuid": "4b25a972-ce08-46ec-a59a-e40e2263f7fd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630882204, "uuid": "55b53a61-dbce-4b08-a7a0-a62294a0c3fc", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a359f877-0e13-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630823804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823804, "uuid": "5777bc4b-6dbb-470e-b2e1-254dbbf2521f", "comment": "Malware payload (Buran)", "value": "c88ad1c4936b3d755539d1bdb3ee4ebd", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823804, "uuid": "90c83e8c-d2f8-4dbb-80b9-283a5635d243", "comment": "Malware payload (Buran)", "value": "0fc25e51687192c92433eb01d2f4cbf684eff0c71c25260471da2ab636d94d62", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823804, "uuid": "d9ea3a43-23d8-4c6b-9922-b42d19fd73b0", "comment": "Malware payload (Buran)", "value": "2ca5f93c0b404164b848c26cdd1931e02f1b8cc7", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823804, "uuid": "171963f7-514a-40d3-9dc9-e1857fbcbe83", "comment": "Malware payload (Buran)", "value": "2ba4a2b85dfbd83adeb2e90af107b4aa1a1ca3f4ceeaaee1a0b0203d891162953ece96844cfa4611016d98319c8f8b11", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823804, "uuid": "f2c419c8-651e-4c98-9c37-5e7188d3d098", "value": "T1B864BF40F78421990E8223ABFE5752D2FA7DD00052441164DD9FA3AD6B53AACC37AF7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823804, "uuid": "959aa424-57b4-45e5-b96d-8f48ad6596ee", "value": "6144:0Xt/0DkpV5rUL3oPoV9EIeCQnhNFWgSmIXZIu+nh/ZLwOglAIH:0Xt8DkpzYT8vCQnnSbSgrlAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823804, "uuid": "fc287eec-8e3e-4c71-bf54-33b6756bf1b4", "value": 315639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823804, "uuid": "13c4c517-43df-46e9-972b-7e0e738cc0f3", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823804, "uuid": "1f719aa9-8e5f-4323-a316-4c4ffd00cd1a", "value": "3187.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e83d304-0e13-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630823796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823796, "uuid": "3cf9da3d-f9bf-477f-b802-02287cfb0531", "comment": "Malware payload (Buran)", "value": "893706623a6416fab0216ee09b9899e6", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823796, "uuid": "511d5193-4119-4dcb-86ed-d972f7078d8a", "comment": "Malware payload (Buran)", "value": "1072e7e7a911ead3f2a31c6a88505eea06ac362bb4d5fe5b97033c672ddb0d44", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823796, "uuid": "7a1ce799-fd2c-4064-932f-0e4c710c41b8", "comment": "Malware payload (Buran)", "value": "1ec8a0f623b56a6ddb57eb60ddb9cbba1aa2b237", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823796, "uuid": "4b5298cd-3975-4d1b-8171-b60feafe88b2", "comment": "Malware payload (Buran)", "value": "95903b990e1358878ab6c6f1a359e22ed732d0f96cd9394b706665aa80e7a6f644894c7ccce020f968d1517db5f6ae21", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823796, "uuid": "895f90f9-64f1-44be-9039-9d32217ac807", "value": "T19F042343D6A7A7B6931F59AEC12F8F5C50E323673109C3AA10731668336B5F5392898F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823796, "uuid": "87e80e6a-8656-4861-9cbf-2c2e67ad4197", "value": "3072:2OAQFLngPorn1EU9y1RHuONXvt9KzrQRHrTJL43Fsy3cgrkN/E6CjHBQNWnpPZ:oQFKSSiy1RHB9KurFI3kN/IWN8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823796, "uuid": "b70ccfa1-65b6-416e-9bae-41c8370b1b3d", "value": 186609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823796, "uuid": "4f2a887d-75cb-4c1e-81d5-31e49a570a00", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823796, "uuid": "d8b9c4a1-8ef3-4944-9179-9b471168a4cd", "value": "3187.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "460e60c8-0e32-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630836962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836962, "uuid": "72633b21-97c9-4bd7-b732-273955b0a4a2", "comment": "Malware payload (RaccoonStealer)", "value": "d8fb7fcde657831dbf319cbed8ffc9fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836962, "uuid": "8b7280b6-db1b-40bc-ab52-d7d91de6f67c", "comment": "Malware payload (RaccoonStealer)", "value": "10a35f4c478b82b80f7c202c605a1a2a6a49a1d38500e464e9935bd9a88424fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836962, "uuid": "0e04b7ed-7a4c-4d4c-85ce-eab5419fa7ae", "comment": "Malware payload (RaccoonStealer)", "value": "30e9ce5b64e0150be465a95e2b49eaedc6a0ca28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836962, "uuid": "5026eb81-e943-4cc0-9cb2-96c109a73389", "comment": "Malware payload (RaccoonStealer)", "value": "b45b49db38bf656bf2c92a56bc7f55b782270b1e40c539c248ba5fd057640780dfa3c4447e679eebd269e47b9d0ceab7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836962, "uuid": "a43576d8-be9e-44d4-8107-023a85cfc42a", "value": "T11EB4002A7F91E43BC195C2344926E7B0DE2DBC71EA54850B7B64FB5F3E242C0962D326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836962, "uuid": "844d553c-dec3-43ff-ad58-23c2db6a6692", "value": "b2c249fef864036a8cc857592c5ce556", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836962, "uuid": "2848c910-b720-48aa-8dac-b6a9754c8567", "value": "12288:THYRg8+OWrjt+/zxrIBdiwXMn0rH04hDkjPsbrn0f:LYW8ErZ+/z2BfAK0MmKj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630836962, "uuid": "fea947cd-9765-4785-aa97-c7dd401cc332", "value": 534528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630836962, "uuid": "e2949654-2baf-4c11-b1b7-8b087f9c4287", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836962, "uuid": "6d14395b-c8ee-412d-bc30-9e0f9c1f9c60", "value": "d8fb7fcde657831dbf319cbed8ffc9fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60707a15-0e2c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630834430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834430, "uuid": "83754f05-2a00-431d-a61f-65ad2b3023b3", "comment": "Malware payload (RedLineStealer)", "value": "5fbeeba82c6d48c4efe7cb8188ba6ce6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834430, "uuid": "bd318b3e-d5a6-4702-989d-58621439a9d7", "comment": "Malware payload (RedLineStealer)", "value": "117e9a27c43803b85cf760a115c9be1ef332937e72bf69de9f05563c0e2fb70a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834430, "uuid": "9f0cd009-9cd9-4a96-881e-e30ceee2703d", "comment": "Malware payload (RedLineStealer)", "value": "f7d304abe03aa535fca287145b34652067b4b003", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834430, "uuid": "9121219a-fdb0-4da3-940d-65120afe5308", "comment": "Malware payload (RedLineStealer)", "value": "947aad6684a8b570b367b75a2d9afa8823e9c3955028d3298f2e49e1e51fad8c36b5df33f4b03d57d59c31ff21fb705e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834430, "uuid": "e4e2deb7-9896-4318-81db-87c65dabe633", "value": "T103E5AFD29529C85EE0DF2B75E81A6EFEC083DE24D310491F15537D09BCFA22A522F52B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834430, "uuid": "7a023ff1-7729-4279-8262-d397ca9d7d77", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834430, "uuid": "d68149e9-dd55-4562-9fb3-93df598fbc1f", "value": "24576:Vj/OURCNBCovpDM40Kx7K9J4CNvHhnuc4UxRZ5HhwFMjvHmuBQolx89ZMfpMBgns:2vnBK0CFgOvHvrHmgbu3inZG+pMWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630834430, "uuid": "ec50b398-909c-4769-993c-17930157df45", "value": 3153624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630834430, "uuid": "5f37e5fd-7953-4d7a-a4a9-153872ad28ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834430, "uuid": "2c58b881-e096-4520-977a-6e41b54fd639", "value": "5fbeeba82c6d48c4efe7cb8188ba6ce6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c965ec0-0e33-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630837349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837349, "uuid": "516e741a-1fc4-41d6-91b1-4b99cf9da6e3", "comment": "Malware payload", "value": "a3633c1e1f1ce6114d5dcbfb69134aab", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837349, "uuid": "72b27d64-0333-431e-9098-f61accdc9b01", "comment": "Malware payload", "value": "143431e856bdd1a43b5715b1bab6027b7da9133a513b23671fcef66c2aab257a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837349, "uuid": "af04bef7-ee27-4118-8c04-81cfeda4339a", "comment": "Malware payload", "value": "5f7ace227bf43665540e189cecf5cd1fc973d3c7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837349, "uuid": "750e08c6-a7db-43f9-8e23-011fe34d5391", "comment": "Malware payload", "value": "3bd288bd8bc5c7699576c0534519a4d59f722db46243b9b5916c061c9b311a29e3c4cb981cd908dccf00a5f654a209ab", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837349, "uuid": "2fe2505e-fb32-46bb-8eee-ed8c0748fc78", "value": "T1AB64234CC16186AB15821D1DE89C9EFC93A83F1F0951FFE6341CD2353665AA940AFFCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837349, "uuid": "2d6d99d5-22ae-4938-8aea-d1599f2bfc34", "value": "6144:D8dRIUzqLK32qGUwILkKU4woLkNQyEE37pTAMZWEcEJ6ZeXcZGKMD/w:EOWnwIcyNyx7hAbwSAD/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837349, "uuid": "af685bb9-4f1d-436a-97d1-f699913884e1", "value": 311099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837349, "uuid": "5c8db832-b227-49cf-8892-e4a0d15050d9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837349, "uuid": "15a72d28-f6cf-46e2-b0de-0006498d9aaa", "value": "4558.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee7b5c9-0e33-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630837380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837380, "uuid": "4557e0d5-d1f1-423e-b36d-aa15b2cf1d64", "comment": "Malware payload", "value": "41ab53fd8197483f2d5663b3e824d468", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837380, "uuid": "a670a812-8c68-4d9b-8d44-14749dfd3f03", "comment": "Malware payload", "value": "15d58eff2845dc2cb9e988f4ad18d0303aaec46da6120cd8738af6d1480f7cb1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837380, "uuid": "d244bbec-3528-4903-9ff3-0cf64ca396c8", "comment": "Malware payload", "value": "bd9b97491785a2773d461e9f7746d4d533e81da1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837380, "uuid": "ed4a1841-cf0c-4566-bf92-fabbfcac9ae0", "comment": "Malware payload", "value": "18a8e1791f9be2b885a2759b1777a95a2ddfc7c6502fe40362496c96887084b173023f7a81d7f1cdd56a3514e44e6f48", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837380, "uuid": "a50f7433-42a4-4f3d-b317-e9920dd78c8f", "value": "T1B8F3AE91FBC024950ED313DB9D06B2E2FA7C9851476000A5F49DA25CB7616F9C3F9B3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837380, "uuid": "c3e49eeb-6ee0-4d1e-94cb-fb6efaca8577", "value": "3072:0kOBFat5SfZL1y0s09SBzb83XIIUwXSVhnBSfL822iwWJPAmYsp2R9ewJNqFnQ7n:0kOBFat5zEomYsp8enQCVVcR9DX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837380, "uuid": "4218dff0-dc9c-44be-a288-e17d7e279384", "value": 171894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837380, "uuid": "9732c22a-8fe8-4733-8bfe-85ffdc541658", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837380, "uuid": "a9681e12-1984-494c-94d5-24922be8db51", "value": "2961.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ff4e65-0e8d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1630876214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876214, "uuid": "72b0f65d-fbe6-4a84-b121-f8ff244e2071", "comment": "Malware payload (NetWire)", "value": "182338a8dec61aabd85906ff4ffcac9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876214, "uuid": "0e1bd4a6-beb9-4fa1-a5a2-e3f73ebb53b3", "comment": "Malware payload (NetWire)", "value": "174d091dcf5a5b2c4af35b5df2e4094ddf31bc589208f7b79ff5fc0db2dde514", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876214, "uuid": "ea67e082-9059-45f9-995a-b9e6c982fdb9", "comment": "Malware payload (NetWire)", "value": "898839d66a5c40b4b5236e28bf4a01de91b0f106", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876214, "uuid": "1b6e61b3-902b-40ae-8a6a-042dbfa05b96", "comment": "Malware payload (NetWire)", "value": "73c7b1a5390ba160c1066a67066ede76016daf6006b31630d11435ddb51823596f7a02af1b876041d782aa01566e2b34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876214, "uuid": "a29fe3e4-159b-44dc-8188-66af4ea8cf48", "value": "T1D4D46C3BF9A504FFF4673A784C1732666D8EBF69242478937ED01E8C1A796E13532242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876214, "uuid": "51c5157a-2ed3-4cba-af4b-5a3b55f9cde8", "value": "b22795c7c5933bf88ce6268fbff58dd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876214, "uuid": "bd2c25ec-1de8-4841-b276-29599df4c361", "value": "12288:ddKKG7bKBAsmMmkTPO+ixbeinq25zff/m/nPsilqj5:dLyshiWkxEgzff/6nJm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630876214, "uuid": "e4067aac-13ea-4a77-a696-355d056720d5", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630876214, "uuid": "953284a5-b1a3-48bc-8f2a-5cb4ef57d718", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876214, "uuid": "b1ada293-3a18-4a9c-9015-d93ece6730d2", "value": "182338a8dec61aabd85906ff4ffcac9d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ebedc7-0e8f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630876800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876800, "uuid": "fe082bd4-6df7-42df-bb53-e93ee2d67c52", "comment": "Malware payload (RaccoonStealer)", "value": "e578061ecb38de803a1337885cf66532", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876800, "uuid": "c5bb3f64-122e-4dc8-b9d0-79ea3dfb7213", "comment": "Malware payload (RaccoonStealer)", "value": "175d63f407dfa3807346842438b8c52fe681e93b0209a05b7919b39ae0ba3f38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876800, "uuid": "98118caf-21d6-4d6e-96e1-dd7ea7e0fe61", "comment": "Malware payload (RaccoonStealer)", "value": "bf05c1f109b9d029da24e37b5e0b34a28da93e99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876800, "uuid": "7d13b1b5-078b-4fb3-a063-9f8a17858add", "comment": "Malware payload (RaccoonStealer)", "value": "ac7b10d457a015b7859d16fd22cec3605e45f5e286edc69209d58ce3dbc7daf5e03a39827e5f4fc0ee39c86de34486e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876800, "uuid": "f280703c-8421-48ae-9a1b-d99ff3d2a7d7", "value": "T1FBB4F012A6D1E027E28246349D25C7F56FFDBC625A70854B77A4E7BF2E702C08E62353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876800, "uuid": "5d950c20-0c15-483f-9022-e7c2b80dc5e4", "value": "a5091bd61667ae52b24f539467c52b28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876800, "uuid": "e5457d1e-103b-4b06-94ad-8587e8d57990", "value": "12288:kMv04zjR0ROLE4h07L1UIRCb2PZ4TQCzDNF:XJzpjhmRC2mT7hF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630876800, "uuid": "ce9755f1-732f-49ff-899f-c759a942cdc9", "value": 517120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630876800, "uuid": "a0eb07dc-e059-4c01-92d4-d1d21e96b3a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876800, "uuid": "4e3d388b-ffef-41b4-9fb3-0a7b9fa06d90", "value": "e578061ecb38de803a1337885cf66532.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "819204ee-0e57-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630852954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630852954, "uuid": "7eec4a89-4137-4c18-8334-5bfc8265252d", "comment": "Malware payload (Mirai)", "value": "49beb232966d61e0824400c0c021aa66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630852954, "uuid": "590d3735-e883-4f45-a8fb-ed505666f2b4", "comment": "Malware payload (Mirai)", "value": "17a02486209ed161a4241d6f50fc037d74137d7797ea46ed0143a411c4bbdacc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630852954, "uuid": "e7f58441-758b-4347-a62b-55926b30a4e1", "comment": "Malware payload (Mirai)", "value": "a18541c57fa73463a2a560036188c76e857854c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630852954, "uuid": "3ed05bd3-5160-4947-82ef-ef2953d218bf", "comment": "Malware payload (Mirai)", "value": "9852f7cd6d1c63684246cdc7a8cce476aebdc24def0148ce3e6c817485966b22ee6bf1cc80df379c7112edeb2be4ae87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630852954, "uuid": "acd834eb-05ca-4ae8-a08f-ef15a2303f4b", "value": "T1B0E35C86FA418A23C5C5177BFA9F014A33229795D3DB330289285FF43F86A5F1D67A09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630852954, "uuid": "f47f693c-bbd1-4650-bc27-f29e438750ff", "value": "3072:MVF+Th+UldFTY6n9JsiGXV9mE1nSD0iABzlgngfLQTM/9GkP:Y+Th+UldFTYk9JgL1nSD0XBOgfLsM/9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630852954, "uuid": "2118576f-d073-4567-bef2-c2226748e209", "value": 146759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630852954, "uuid": "371df614-a512-4d84-9afc-216ad0ee34b4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630852954, "uuid": "7c62849a-c2d3-4d6a-9810-faab3655c2ac", "value": "49beb232966d61e0824400c0c021aa66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d02f5da-0dec-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630806856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630806856, "uuid": "b885ca50-196e-42e0-a6c1-283def43792e", "comment": "Malware payload (Mirai)", "value": "4ed7c8dedd4735ae2f4a7d7255b5531c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630806856, "uuid": "dfda28c5-f2c6-42e4-bb02-7b2ee7c38770", "comment": "Malware payload (Mirai)", "value": "1808175258be6244488afb87ee4a390985f24e325af8d43e75a773d833bbd005", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630806856, "uuid": "d0492eda-a7fd-431a-9aff-4ec7119f5477", "comment": "Malware payload (Mirai)", "value": "1f232b82415249956af3d3c176445271b0f55c81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630806856, "uuid": "80c1fcec-05b3-4f85-9fd1-8d985ad56a8d", "comment": "Malware payload (Mirai)", "value": "1dbaab1fe573a9f16d51ab83d2818b942847344684c229b00fdbc7932b823346725bdf7c9cbb4a7590b36a459d8e57dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630806856, "uuid": "6bbdbbcd-d8f4-45e5-9c8e-327766bbafb9", "value": "T100A2C596B8C15A2BC6E0A37AF59F444C3360A7D8D2CF3B17C8155F407B85A1E0DAFA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630806856, "uuid": "82f83a84-cea0-449d-bab8-4a65df05f3fa", "value": "384:SnSvsk80MEcUsVtl91NFdVtl91NFdVtl91NFdVtl91elbsfYyf321T1zGRPrw8ke:k8sk80MEcUsVtl91NFdVtl91NFdVtl9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630806856, "uuid": "7fc19ec9-1d63-4d16-a280-923d92536fe2", "value": 21688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630806856, "uuid": "948d4e19-de32-47d7-8b40-1b7b12afbe73", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630806856, "uuid": "f4c911a2-0c59-41f6-afc9-5995abe56cb1", "value": "4ed7c8dedd4735ae2f4a7d7255b5531c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ac65f6-0e1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630826540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826540, "uuid": "0b74c471-33b9-48b2-819b-afb8b2bc87d1", "comment": "Malware payload (Formbook)", "value": "232f7b1a33de22b6246c797496653cfd", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826540, "uuid": "62971954-c467-4446-8085-fc513959cf0d", "comment": "Malware payload (Formbook)", "value": "18b3ab7b4f3820538073edddb7fc9532855b00ea6f391d825c75e9ee864b1bdc", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826540, "uuid": "643eb31f-b307-46f0-a8fc-aa911eacbe23", "comment": "Malware payload (Formbook)", "value": "ca906a0429352153ad835e22179c11ad460018a9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826540, "uuid": "c1f301fa-3dc9-4306-8f9c-c864963c364c", "comment": "Malware payload (Formbook)", "value": "e2bf500a537d40b28d23a6a2f22bd3232ca9a7a05f3e7a9fb730d08c9ab9ba41c40ba1466435344f5a1df2f0b6a14e49", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826540, "uuid": "29d29856-5d42-4006-b2a2-8a3b39cd687d", "value": "T14CA423FBBE311FB8F4EEA6D893832CD0E8E59B245ED16265180DA553A0CB644C341ED3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826540, "uuid": "139ea133-d3c9-44a3-a2d7-5079edeed85c", "value": "12288:PXDdk77HTTMgqu/tceVeu3+qP53N+rK34VfPMGp/gqVZX3:PDqnc3qx3orKyKqVZX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826540, "uuid": "4f975099-a71a-47f9-8827-10405df97c9f", "value": 459134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826540, "uuid": "8620a073-93ac-4f22-b31c-87490458726e", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826540, "uuid": "079a08a5-8c17-4f34-99d5-96d7faef603e", "value": "Released Order.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b15c2bdf-0e19-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630826405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826405, "uuid": "4c3e418f-ea54-4c9d-8869-119ba3ce7450", "comment": "Malware payload", "value": "6ffb630b185d3120d8a67d648429169c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826405, "uuid": "3f41e5f2-86fa-4939-81ac-e949f1ba061c", "comment": "Malware payload", "value": "19b321c6aea702154960243535d04e1d8800a9526d8f0086cb20fda43383ca28", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826405, "uuid": "e8d78b5a-5d6d-4419-bd5e-678daf7782ef", "comment": "Malware payload", "value": "02ca9caac1ed925b97a250d4d71f94c45df6a26b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826405, "uuid": "f39c0662-8af9-4ca3-8b4f-309b48f09de3", "comment": "Malware payload", "value": "05b6250346a74ac9e70200a9ff3daf7cba04a0fae67404d5c63402c8668d329ae888657f881c4c2fc35e383f4c5c0909", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826405, "uuid": "37b3621e-014b-44d8-b468-6a5c3e9722f7", "value": "T1064423AF3BC265B51D377E73C0E28108E94DFAA9B63B4C7D035056BB865C640D2B0B85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826405, "uuid": "a5434211-a8e1-4947-9ece-25a3d4d5e8d9", "value": "6144:BqUwgSG5veTECgMlf61TRraHfokyoIRMaBmOKcei:sD28aWy11raHQkGR5oOKcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826405, "uuid": "5db8483e-291f-4279-8fd7-84c7a43b411f", "value": 259294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826405, "uuid": "8210a804-e609-4ab9-8c6e-86c36327070f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826405, "uuid": "47369d9f-dec8-449c-83cd-ec6fc00cb561", "value": "5210.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48b8d8ec-0e0f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630821934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821934, "uuid": "c3cdff2d-a093-45c7-9b8f-d5013153adb8", "comment": "Malware payload (RaccoonStealer)", "value": "ec63899f079a1e20b228325630779633", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821934, "uuid": "5beefee9-67d9-4aaf-afed-8d297af6bc47", "comment": "Malware payload (RaccoonStealer)", "value": "19b5ec3c795d9b5a03a50c659ea015969aa4fc7e03179e4477d577043e1318f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821934, "uuid": "5b8ead79-da0b-4db5-a052-869d99f21c8e", "comment": "Malware payload (RaccoonStealer)", "value": "e55556742e315402e8b80b26d43e57450aec37b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821934, "uuid": "2f99fa32-b44c-406c-b8e1-23a64a2fd5c8", "comment": "Malware payload (RaccoonStealer)", "value": "221d56c5cb40392dcb131587b87c63041dc2eed4d00ddfdb1fe8d8f372d1125cf45fa05f9575dfbe9890df4fd3dc57d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821934, "uuid": "99128eba-375d-484f-b86c-f25b8678075b", "value": "T1E6B4F01AAE91E423D6C2C6B08965C7F4DE7EFCB21D24454B7748EBBF2E30194112E3A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821934, "uuid": "4a68aa7d-d4a4-4879-a44f-ae1199ebf2c6", "value": "f530acf7acd4a5c8880ba2a4704d4cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821934, "uuid": "9459819a-f729-466d-b885-f3e90ce6b4fb", "value": "12288:Z6xb8ji6GBDt+AUhUvWPjRSxHfF0tpDkjunf:gAJQt9UhJgAtpmun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630821934, "uuid": "8b3e761d-d341-4f65-82e6-459cde6ec2ed", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630821934, "uuid": "dd460cd7-ba36-4580-942a-b7fd94c8c422", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821934, "uuid": "bfbf9e3c-d1ae-4971-bf57-e091e9246f1d", "value": "ec63899f079a1e20b228325630779633.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a603b2a5-0e46-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630845713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845713, "uuid": "26a3c4ea-7f51-4a47-801c-c3a9ed9e3de3", "comment": "Malware payload (AgentTesla)", "value": "4b8ed00a653950ad2684daf0c35e2cbc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845713, "uuid": "f84ee93a-59cb-43b8-a1f7-0a3dab81302a", "comment": "Malware payload (AgentTesla)", "value": "1a23595da39500e6e46d61d95ec7167a46408a1824bc9c2ff90f682654f629ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845713, "uuid": "558c2b69-1d32-4c4c-a0da-4adfc453aef2", "comment": "Malware payload (AgentTesla)", "value": "5eec4d02210b699c10d184172f4c410aa613c300", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845713, "uuid": "1792e703-f185-4099-862a-1ff65c88fb3c", "comment": "Malware payload (AgentTesla)", "value": "f3e1f3c99bbb413efb7e197ff24c2d43e251da4879bea76b02ea83131e6a4693bd2b340f7001f2ac26cc03720a2c34b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845713, "uuid": "d2dff069-fe3f-4b6b-a7b8-0bb231dc87c3", "value": "T1CF24F636B781F42EE482447DB909EFA55464393029A8C453F7C2AF1B38715EBDA25F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845713, "uuid": "e0d2090a-219b-4f4f-a195-74766c56275b", "value": "aa2b72693aae6a6c6f24564ac3d32728", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845713, "uuid": "026aa5f7-dd1d-4f4b-8526-8a8111a4138c", "value": "6144:DQEfD/i1lkemVTtuASZNaEz2pjoLlhGiH:ZmetufNhLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630845713, "uuid": "847787da-c665-48db-8988-3dfdcccefff8", "value": 209408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630845713, "uuid": "c403b65d-15cc-41c5-b466-8f3260d79a98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845713, "uuid": "495c5bea-1695-4762-a68c-75f5487aaedf", "value": "Offer List Lebanon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8e3ef5-0e1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630826830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826830, "uuid": "ba6aee01-3551-4a36-8bd9-598295b68cc7", "comment": "Malware payload (Buran)", "value": "a4b21fde3ab861b25053399c981e2ffe", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826830, "uuid": "1731c831-5bea-46c0-b3fd-8b68086dc095", "comment": "Malware payload (Buran)", "value": "1a5b631aa459ad3d0292940a2399aab0a8d3d5260f420a852d52c4ea84e21d2b", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826830, "uuid": "94dd4c7a-b288-4136-a212-777ae2031b54", "comment": "Malware payload (Buran)", "value": "4debaf0dede147ee01d7aa23630632583a5679ff", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826830, "uuid": "aeecaee8-c272-4e64-8179-9281ef6cda87", "comment": "Malware payload (Buran)", "value": "6590b625436fcb7f04b5f4dbd1b932d174a9f60561305c14c0f2c041b1d6d1a626af703ac52a1eddedc1ca85f0222dc4", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826830, "uuid": "1f586f5c-8cb2-4d86-97c5-1bf481925146", "value": "T1B9A4236334746201F096BE14DCEA8B0D1796B6EC736540C8AF35AE88D72F1A577F508A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826830, "uuid": "9b8d5296-f1ea-4ae6-bdf6-a391ddb36bc1", "value": "12288:2Q2unRiax6gIfsTlhZmx5SzhTRI/dffTRipoJ:NzxCfKZ85sTRI/1TPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826830, "uuid": "8c7a916c-6bb1-40e9-901d-29f5814cd3af", "value": 474696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826830, "uuid": "e3d7d7c6-d172-4d4e-a5f3-304e6e81cb88", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826830, "uuid": "ef2fd69f-1397-42b3-b12e-bd567f7752f2", "value": "8363.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccaf1986-0e12-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630823444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823444, "uuid": "38e794aa-1614-459e-b83e-bc649c42bca4", "comment": "Malware payload", "value": "eab5946cb2a79c280b6c2d66570a27f2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823444, "uuid": "4869e410-35c6-4a63-8f47-75b05072becb", "comment": "Malware payload", "value": "1ae10e2f3b051b9c7c7099380668fc38c67fed0b6f8eb2f1545de73d3767dabe", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823444, "uuid": "a550a3a1-790e-425e-b187-2ddece41eb65", "comment": "Malware payload", "value": "d6a25d177dd1996809024e99c738dc5def45ac5a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823444, "uuid": "e670959c-6c02-4943-8421-f4bfec80d3e6", "comment": "Malware payload", "value": "97acf679ba6423dbf0b41d2eb8e1d0580d7078d26a11d87c8d4269d659807c53cf1dab54e10c31aab0237c57fb73cacd", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823444, "uuid": "b3e62982-7faa-45db-a55b-70d42ffda336", "value": "T1CED3128EF2CED4B5D6C9028FDFC8810A0994767921FC8D4B65C21D785DAB12A47F462F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823444, "uuid": "5f034869-fece-4a80-b658-a734e69ad9b0", "value": "3072:jOAaXJahcN1nwFDEG3EDas5rQhgRNGD4kcMLfIpTN1Z:LiJahcTnw1Eqhga+R1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823444, "uuid": "51fe94be-831f-415f-850c-3c820bf71b92", "value": 142336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823444, "uuid": "4c231da0-d568-4981-8200-be35f14c869f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823444, "uuid": "6eab39b0-aae3-4e00-b33d-22fa17282456", "value": "2580.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d84f671-0e45-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630845216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845216, "uuid": "4b4d9e65-d66c-4d33-a22c-f9e532e57818", "comment": "Malware payload (AgentTesla)", "value": "77390b4b1409e0a45bb07bd7b57d7c0b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845216, "uuid": "9cb9ce4c-19ed-45b6-bb2d-b679b23baa12", "comment": "Malware payload (AgentTesla)", "value": "1d7722a131301caf877e8ab5e6854805e5e13aad29900ee9c2a7fe1b0bee524e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845216, "uuid": "29e3113d-8d94-4538-8c5c-3637bfb0620b", "comment": "Malware payload (AgentTesla)", "value": "7d38996d2562c409ae31e33fecc988e027185c0f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845216, "uuid": "a213ae5b-6f26-4579-a9a0-4ec619c1c3f0", "comment": "Malware payload (AgentTesla)", "value": "a7505ebc765c65ea1260ec3f960cccc2ba7cd5cd0b9d29a4b06c629d4235433aa3c60223f8c1075b3cc6eb4f53353e73", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845216, "uuid": "556f3b2a-6864-47e1-8d02-064cad7f45f5", "value": "T19D8423D74A22964EE560EF35391B5DB6BFA17664D7A2DCBF09A1B08AD00DD4E0940333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845216, "uuid": "0b80a0a6-5374-4fa9-8a6d-0d393d212b6d", "value": "6144:1DZe2eODt0TslbXwC7O2ONBxO1d+/hi5ogrp2vKF8sLTUIM1rEYeSBlH4dSPOskT:1D42Hh5i3YIi5SvKBL4xPVPnkujTgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630845216, "uuid": "0396c9d1-acd9-40aa-bb5a-f35e7389e6f4", "value": 402135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630845216, "uuid": "bdeadc34-c47f-415d-bb5b-f1f9f383413d", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845216, "uuid": "5db43bd0-b8ac-4bbd-8073-d4fa4f28fb49", "value": "Purchase order. PDF..........................gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f281635c-0e47-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630846271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630846271, "uuid": "88e95479-2c37-4fb8-afc0-9e7dac6dc22c", "comment": "Malware payload (RaccoonStealer)", "value": "56c89fe0f35865101bc33c8ace490195", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630846271, "uuid": "ca5e560d-884f-4b96-9b76-307be098b16e", "comment": "Malware payload (RaccoonStealer)", "value": "1e2ff254e9ce7fcaba6d728b569ed2adefc8b6080a8cbacb2e62f41203055d94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630846271, "uuid": "fb944cff-49fc-48b9-bfee-385a0d28ceae", "comment": "Malware payload (RaccoonStealer)", "value": "07d3933dec7651b81e202983be56bb761c2181c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630846271, "uuid": "a11b1933-f95f-4c27-894c-d351da8e5e48", "comment": "Malware payload (RaccoonStealer)", "value": "b73d34d7145a5d89b89f8ebaed80815fbfaf1ebf8c82bde8466d6ead2d0fc5c0c9e9c2f618c9bcfd49067ae65f72214d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630846271, "uuid": "71c976e0-90dd-4361-aa12-edb0775d83ff", "value": "T18EB4F01A7F72F433D596C6345535C7B4DE7FBC726920844B3268EB2F2E60680866E352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630846271, "uuid": "22efde64-870d-4e98-a3b9-e2fdfd4f8344", "value": "5107fa4193c2849c77704d8870503de7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630846271, "uuid": "55343e26-737d-47a8-aeca-ae4328273191", "value": "6144:vgHlVQDHYYIyCePp3Lsgh1wF3kn/bb+vUQrdhQEmNsZdf4BdnWSeBDauBsj9Kvdv:IHlVQ1Pp3LsBA/H+INcEngDkjM10f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630846271, "uuid": "d1db20e8-3bb8-4e82-98d0-218a1c50875b", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630846271, "uuid": "bb359992-d069-409d-8f21-296f762fc5ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630846271, "uuid": "38b849b0-6f00-4a8a-8246-b90fb9988c9a", "value": "1e2ff254e9ce7fcaba6d728b569ed2adefc8b6080a8cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d21cbd2-0e23-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1630830424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630830424, "uuid": "80c3ab77-855a-423e-b398-9efe72185389", "comment": "Malware payload (SnakeKeylogger)", "value": "50174b63761a8dc168b9b36b29e69f97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630830424, "uuid": "0f66192b-b17d-449c-adfb-6099f57465fe", "comment": "Malware payload (SnakeKeylogger)", "value": "1e88fff0548cdc6606b777f085677418ef35aed7bef85aa4306b462f8fa7f246", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630830424, "uuid": "0bd7e43f-d657-4985-a792-330ac2f2b7e6", "comment": "Malware payload (SnakeKeylogger)", "value": "13966ebcb7ec12ae8a18e93233fcf8dd9a6a1701", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630830424, "uuid": "00828b57-93e4-4381-96cc-8a2b00e1adc0", "comment": "Malware payload (SnakeKeylogger)", "value": "c0b0e93846e2cc12879942ae318dfb68f73e1d252f0a2532a6eb0c03fd81c361eb3289434d610d95c07f9f0f35621f69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630830424, "uuid": "d3ace62e-40ce-4549-8114-5c211d55af87", "value": "T15BD4E83E18FE23279176C7D5CBE08823F6D098AF3233A96467D747664316A4675C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630830424, "uuid": "2514ec6f-7e1b-4524-9dbb-b8c9f7ede291", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630830424, "uuid": "3069e90f-4e4c-414b-9214-1e490d18e555", "value": "6144:kgBD8xQONlRS1FJLgGIAz+gh2bsgchlmeQrINVB5HFpDbpiii/9f25Mv:kgBD8zyore8INVznfwvf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630830424, "uuid": "829aef58-bd35-454d-b738-fee844c9b452", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630830424, "uuid": "e815ea51-60d7-4469-ba45-cacb189a2900", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630830424, "uuid": "0d0b55e8-f7a5-4819-b016-c9fd9f1f7a9a", "value": "Revised unpaid Invoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a43c6f9-0e14-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630824192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630824192, "uuid": "549a0d6f-8eac-4397-a416-c1f0cfb376ff", "comment": "Malware payload (Mirai)", "value": "684402b8e610f81549ddad4887fb6b96", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630824192, "uuid": "9264fb56-c51d-4132-bc9c-5d53804383c5", "comment": "Malware payload (Mirai)", "value": "1ec828350e23bd892099345899e752778fd1ef40df8a0ac9d507751ea2b52df5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630824192, "uuid": "346bca1b-088b-41c3-8f44-cf2e4db07d8f", "comment": "Malware payload (Mirai)", "value": "a8a68250ba089869faf2388168474fbc77265d71", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630824192, "uuid": "b66c37f2-b721-456f-814c-82480691792f", "comment": "Malware payload (Mirai)", "value": "385a314155bfea8e3ff2859c2afda099513ea771a6e952d8057e93930e1d908334ada97e93d61a98d94969bfef704f01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630824192, "uuid": "9aecd447-9144-4a16-ac5f-8a634a21decd", "value": "T13973A61E7E258FFDF799823447B78E216A5823C637E1D2C5D29CD6012E6024E241FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630824192, "uuid": "c432f17b-edb5-4994-abc4-73fc928abf52", "value": "1536:qztcPRFA6olzsswoBO4ko9lOU8uzNZWMbobAgwbFa10z:qC8nwoBO4QmzNZW8gU8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630824192, "uuid": "e3a64815-e411-4a4c-91d8-311182058485", "value": 73596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630824192, "uuid": "fd1ab020-a7b9-452c-b194-e24e92452c16", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630824192, "uuid": "70099756-c115-412b-96f0-018fb870a30b", "value": "684402b8e610f81549ddad4887fb6b96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a24aead-0df4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1630810287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810287, "uuid": "07c6cf5e-5d2f-45bd-86bb-571c8ac1520c", "comment": "Malware payload (Gafgyt)", "value": "0f59ba3382b3de44494df8757743a86c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810287, "uuid": "d7253f5c-085d-4a61-a04c-977fcf262628", "comment": "Malware payload (Gafgyt)", "value": "1ff6de0c5d02370607962d03d4d5cf87f67b3e0490a6ce8d9293fac708ec9c9b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810287, "uuid": "c46aaee7-a8d1-454a-bf67-3bdeef1c5139", "comment": "Malware payload (Gafgyt)", "value": "1826413501c02d61cda15ff4fe0cdcbabfdb905e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810287, "uuid": "34c5409b-1fc9-49d9-bb62-fa4c0326f289", "comment": "Malware payload (Gafgyt)", "value": "4ae11c56f8b1dad5221f7ca5fee7b881d1b44e18e2a439ff9b22b1de44f9a933961cffa8bcf0be911b163f74011bbcf2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810287, "uuid": "8e2a9107-b7ed-49ef-b8e5-d53a96ba095c", "value": "T142C30837A61C0B43C49745F02CB77BF24F69AEB312E611C55219FE808B739B22552F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810287, "uuid": "baa89553-9010-41a4-931e-574427059166", "value": "3072:CTZoDx5RC0AolsZuws3GJmmbocuwmHnirNb:CTSx5R9AWsZuN3MmmbocuwmHnirNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630810287, "uuid": "d6acd306-74f7-4864-b56f-3125df78b64d", "value": 125100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630810287, "uuid": "c140244b-9c12-4832-80ac-1ef3e1ab8f62", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810287, "uuid": "e64d815f-a106-43ab-99e8-b81740a072c6", "value": "0f59ba3382b3de44494df8757743a86c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31775ddf-0e8e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (QuasarRAT)", "timestamp": 1630876441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876441, "uuid": "915520bb-ba95-4479-9f18-d93d34e0ead9", "comment": "Malware payload (QuasarRAT)", "value": "b5532f3c41be25db7c75f4cab0312ed4", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876441, "uuid": "fd848913-cac4-4e05-98b9-0abea5069ba2", "comment": "Malware payload (QuasarRAT)", "value": "209bc147912ee7526795ad19a9ee2bcd2a173528fb7106a224e899d2ff703c56", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876441, "uuid": "6f682967-4330-41e7-b4bc-6c52e6d34767", "comment": "Malware payload (QuasarRAT)", "value": "d0dd55df3e72d499aa70742943e22801d2ed2606", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876441, "uuid": "b33fb861-9159-4005-a4e6-b6e4041e5d38", "comment": "Malware payload (QuasarRAT)", "value": "1cd0774f82229ca261f118c0d339b0090d84bed986d475124201d271d3eaa776198d4046ed2baec0cce74420e7855cc8", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876441, "uuid": "1b83e931-fa70-4047-98d2-67fb6d208b14", "value": "T10D01D37D910BC8791F5B89DAC0F2D9EDC26172850470E6547BC4DA8C421466C565547F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876441, "uuid": "5c01f698-2428-4ce8-9983-43431771979e", "value": "12:hME9hTx4ZFM599DwICMd419Cngd3pjNp9evAUgCP5PtpIXyP4OdwXdhQt:n9EI5LwIPq22xNpcvAUgS5FpqiDdwXdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630876441, "uuid": "030aa9ba-00fb-48c6-bc88-0ba5c8b37569", "value": 658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630876441, "uuid": "2d525d5e-7ab1-4332-be0e-e2d6ec4fbe00", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876441, "uuid": "4159ba7a-257c-4d2d-b07c-57dd7c647b06", "value": "DASDFASDSDSAD65468463153.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d4adac-0e1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630826701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826701, "uuid": "c4f693d0-733f-4696-a165-defdc7cadfea", "comment": "Malware payload (Buran)", "value": "1748cfd40838541be5ab9ff6b90f35ad", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826701, "uuid": "28d6ad03-360a-4456-b775-3a2bb636897e", "comment": "Malware payload (Buran)", "value": "21bc32471a45f6148a1de2a280da09f28cf781b6294815165eebf0738df72342", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826701, "uuid": "984758dd-fc22-4d43-a433-74c007d27ae9", "comment": "Malware payload (Buran)", "value": "43810559339c00b7ba10bc6004a853c7c0ad4f94", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826701, "uuid": "b440e5c7-bc01-4bf7-a291-cd9c9cabf1e6", "comment": "Malware payload (Buran)", "value": "f7b735450b92b1a1cf2ac00aa8d4cef67b6e6505cd562405998f362307693f14adb105c890e5a3dd464742468cac72b3", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826701, "uuid": "6ec8127d-308c-4a0f-8096-e9f2412c7eb6", "value": "T14344232EC29AD3D8FD879E6AA085F3AE42A436FF17BC570C350650C95916F00FE98529", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826701, "uuid": "9e370d21-f863-4547-85fc-69806a045161", "value": "6144:eeloGwAoHNfHNMlSLNCfPJnZWz6TNBp6iKupYtxt458gBSyV1NoOJ8eInCrnx:eeloe4vNrCpno6xBp6pXxGagBd1NoOyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826701, "uuid": "f7b3f4cf-237f-47dc-a06f-42533281d534", "value": 255630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826701, "uuid": "5c8ecb01-3e03-46a4-9c2a-9e3f7190ea21", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826701, "uuid": "d6c46843-1c5f-4059-b813-e7c908b4053e", "value": "9471.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20a70189-0e2f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1630835611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835611, "uuid": "397f4032-328c-4b71-afef-07972e93dd09", "comment": "Malware payload (SnakeKeylogger)", "value": "1328813ec2ac4589fd9eb0c8b65895ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835611, "uuid": "4fa1e73e-0b3d-44b6-bf72-b34845e278ce", "comment": "Malware payload (SnakeKeylogger)", "value": "21e9d489f56c5ab39808a7bd1f3927357d35f861049e99936fe9c58a12ff5883", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835611, "uuid": "6646036b-477f-4bec-96d3-315293c892a0", "comment": "Malware payload (SnakeKeylogger)", "value": "ada889eba2df23bddcdbd4204043fc18a6dbe246", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835611, "uuid": "e60235a3-2bb1-4ea4-9858-0c0b0708994e", "comment": "Malware payload (SnakeKeylogger)", "value": "eb8573d523d5768736cc752b0b42730c6577fabe8eae78ed39340e73d69181d3c52be8532d3aebc8d2a59d5b8afe9884", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835611, "uuid": "4a184d76-840b-4182-9e8c-591c4e0b9be2", "value": "T108842866A783F06EF480047DB608EBF2A5A439301095E057BBD5BF2B2D311E6CA59F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835611, "uuid": "153b57af-0d13-4381-9bea-f47428dafdb1", "value": "d746df0c6d243e11e2680c79fdf70b3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835611, "uuid": "1d935ff1-23d5-4431-95cd-0b7d1a348228", "value": "6144:mwEfD/i1lkemVTtOASZNaEz2RL1enFSCX8CEOBmlKVrlH3gTuyFvPmHL/my:smetOfNq1oX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630835611, "uuid": "a26688bc-4862-437d-a415-baddf90b3e78", "value": 388608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630835611, "uuid": "47bbc4c7-3b14-489c-bfb4-1c49a46d2188", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835611, "uuid": "0eb13a79-7ab5-4799-9a20-35b14d887d49", "value": "987654222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a334280d-0e8e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630876632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876632, "uuid": "181c3f3e-9743-41fb-8673-06fbdb302016", "comment": "Malware payload (RedLineStealer)", "value": "520038ec0dad178989f17557ba400216", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876632, "uuid": "b0ef408a-3c37-4cbd-8445-11bd26c27211", "comment": "Malware payload (RedLineStealer)", "value": "229fcb6c30f937c97ee433a5402400f7b83cf1bb79388567c23ef561c19b8652", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876632, "uuid": "992d2c29-7f7b-496e-972a-6e922593843d", "comment": "Malware payload (RedLineStealer)", "value": "346d0904e86d554f4d635a0cf5d09405b1a9ab50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876632, "uuid": "2df4456e-54d9-4aab-9622-11f12a7ed7e5", "comment": "Malware payload (RedLineStealer)", "value": "94c6fcc5350fa4418602bf2580f21e6d0c118dfd5329eabe30c386945109405c22c810b018e666ddfbe1910237a86b40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876632, "uuid": "581e0525-cedd-45e2-b36c-6d848a22a788", "value": "T1D974CE5A7E50E873C5B2C2347025C7B5DE3DBC662E60824B7328EB5AAD603D05E6F352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876632, "uuid": "1fab8898-cbff-471e-b075-0afccf4f5874", "value": "b2c249fef864036a8cc857592c5ce556", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876632, "uuid": "cecb8efd-398c-4fe8-a709-11612d80e5d4", "value": "6144:PaG/A14jfyRe8O0jRFnm6QNpDauBsj9qkReWBfO:SG/AejfyrO0vKDkj8P0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630876632, "uuid": "9b7532ff-129b-4234-a5c7-3cc63010e904", "value": 352768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630876632, "uuid": "87230029-9cbf-42f5-8dc5-47955d2f0a73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876632, "uuid": "dae08fc2-9d18-4416-b745-557bfa4d8f45", "value": "520038ec0dad178989f17557ba400216.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e068022-0e57-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630852948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630852948, "uuid": "76030b89-f261-4855-8264-e857b53e48e1", "comment": "Malware payload (Mirai)", "value": "9451895b2a6b689dbe53c9c83514d86f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630852948, "uuid": "b8d6a893-4f3b-4605-8732-724dee5576c8", "comment": "Malware payload (Mirai)", "value": "245d6a858bca1f297c1def2fc90754ca9b21055a6b948a802c774110a1108d86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630852948, "uuid": "590527d8-3221-40a7-9db2-8ef703f2ac7a", "comment": "Malware payload (Mirai)", "value": "7cc58b0d2774f4a5c8adbb0b8cd8b2a2fef244d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630852948, "uuid": "59e6fbc0-ad24-42e6-8a59-11542cc578ee", "comment": "Malware payload (Mirai)", "value": "a6658531260f94963a085b42e5ea501827d2107487e10abb806696f3c0a2eb1f10d0f2918bbbe29ba40fa2ede0eddce9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630852948, "uuid": "08ece1ef-8aef-468b-8e7c-e6e60513e169", "value": "T1A1536DB5D835AE75C0414B3874158D325B13A0829EE72DB7DEA282F55843DA8F88EFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630852948, "uuid": "62a5f057-4664-49bf-9fe9-0a188b675dd3", "value": "1536:+aaivF+XFVowtWDnkMkiEfs3H+/C/q7EvcLCS:+SN+XLobof+HaBEvcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630852948, "uuid": "70f37bf8-93cd-4129-8150-c6ab7b5103f5", "value": 66552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630852948, "uuid": "a4c53692-f684-414d-8a95-d4cc907729de", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630852948, "uuid": "9a7049a5-c498-49cf-b198-bd9523eb01ae", "value": "9451895b2a6b689dbe53c9c83514d86f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b98257e-0e47-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630845964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845964, "uuid": "0fbea8d6-1c9a-47db-9dd6-e3e270510bf1", "comment": "Malware payload (RaccoonStealer)", "value": "6a3b0a472c893b0b4c3e751fa9d48f66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845964, "uuid": "1d02ad89-3e79-4ff1-b65f-4e2f58603260", "comment": "Malware payload (RaccoonStealer)", "value": "24898127d1fda2a11a0f9531df9b0bea1cb977023c40dfc8f4be0c9b8b5e7ee3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845964, "uuid": "e43fa3f0-dd99-4065-9cf9-763af718683e", "comment": "Malware payload (RaccoonStealer)", "value": "aeeac8053a55b95851ef052b7a8fb60dad0eb4b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845964, "uuid": "6406323e-1bb3-400e-8a15-b0a0d4e57767", "comment": "Malware payload (RaccoonStealer)", "value": "d57fb69970b76fd3fa314ed7e25e6bf879a6f55776be91d2342314eb03a4e6eab3289ba4889f7cdbda65e3e204a3da8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845964, "uuid": "7a43e581-5a1b-4c82-8ed3-70f21523f1ea", "value": "T13234AD1E7E80E433D591C7304525CBF0EE3DBCB5196445677398FB6B6E302909A2E36A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845964, "uuid": "f03f0233-4d41-44e8-85b9-aff5716f5f9b", "value": "b2c249fef864036a8cc857592c5ce556", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845964, "uuid": "745ea115-ce48-41d3-a4d9-5bd5e561cc0a", "value": "3072:6IeuqcTZam1O/FMnwYZMyGhe1/lf53r683Tm7uySP3/sj9JPSPcO+GNHHx4bBvHY:/nqc7gKrZ/Ghq9DauBsj9JPFO5ZWBfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630845964, "uuid": "143849c7-c2ed-4e77-bdcf-34000dc7af2e", "value": 247296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630845964, "uuid": "746697cc-86c0-4f66-a687-a84c46298952", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845964, "uuid": "c406bd08-b55e-4e18-af22-3cd08d8e1d0e", "value": "24898127d1fda2a11a0f9531df9b0bea1cb977023c40d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4299e3a8-0e13-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630823642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823642, "uuid": "4ebf7bae-63a0-4af3-b686-2c2ffe8a4438", "comment": "Malware payload (Buran)", "value": "9113a6bc25df6d2e3c59aa723b00b084", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823642, "uuid": "55db2d56-b09b-4062-b986-6f4977abda1f", "comment": "Malware payload (Buran)", "value": "24a1ab0b503969e2dd62aeb0c475cef9b878e20dfaa9c52f1b87d428600fa83b", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823642, "uuid": "cc02688b-bf43-407c-ab16-cf59df315b91", "comment": "Malware payload (Buran)", "value": "a1c45dcbba501ff233e825c114cbc221c07aac29", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823642, "uuid": "258447b1-c957-49d0-a113-ec819abba109", "comment": "Malware payload (Buran)", "value": "1b83b4d8914e99752eff3dabb267af3573992c94fd2184d02f37833494b87e4b1eabb6182dae2815fd8d243b1c44d69b", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823642, "uuid": "e7027ef9-a4a1-45bb-9009-e9ab01aa4807", "value": "T1CFB3126726CA29C5BE81A5AD3B0741DF90BF0FAB73F235753E82A71845EDBE50135108", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823642, "uuid": "8496182c-ce3d-4a09-9859-713fe9200c8f", "value": "3072:iO1jBVnxUxdgKD1HJIn994V9kTEPII9rZUbFLsji3:hBVnxMgk1Kn9OVIEQ7ec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823642, "uuid": "304e8838-9946-4c42-96d2-35296c5d27fe", "value": 117892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823642, "uuid": "bd938a93-8051-43d6-8965-625429da2207", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823642, "uuid": "1ac0a319-9b0e-43ad-a277-92b8e5a30375", "value": "7681.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90ee082-0e2c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630834551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834551, "uuid": "8538fa53-de76-4df0-8e52-9bd2193cbf3b", "comment": "Malware payload (RaccoonStealer)", "value": "5b6e7eaac3ed0d1b8b2c18aae892d8ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834551, "uuid": "26e6c9c3-c266-474d-9a0d-c3cc23071e13", "comment": "Malware payload (RaccoonStealer)", "value": "2719fd90e145c3520563231bf1e70417e5dc84cf275046f01ce1fe81f52c5381", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834551, "uuid": "843babf5-2a74-4c81-adf8-d2d5728e1a3d", "comment": "Malware payload (RaccoonStealer)", "value": "a656e039fc82c64e16ff58770225c24070c28dd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834551, "uuid": "88d6ac29-a1b7-46aa-8f8a-795a9dae58d9", "comment": "Malware payload (RaccoonStealer)", "value": "f52a5af4c8c9c625e490354f24816d3112ade379c7bb65a9efdc9527ce5df15000af7b0028f6fb282a8d9abcdbf2aadb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834551, "uuid": "0eb39647-040a-4c4d-9e34-563d8719cd59", "value": "T12434AE1A7E90E933D195C2744425FBB8DE3DBCB21A20C54B7744EBAF2E30292452E3D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834551, "uuid": "d510d7e0-f1f8-4fe4-b75c-2c5d5c097f71", "value": "f530acf7acd4a5c8880ba2a4704d4cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834551, "uuid": "f323499c-0234-4b10-83ca-b22f5e1e0f25", "value": "3072:UMoL3vb7EaDUvUrbm05oZ683Tm7uySP3/sj9nHNnrY55B2HHx4bCvHOS:UTLDoY8DauBsj9np4BaWCfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630834551, "uuid": "34a719ea-196f-4fbd-9c18-44e56113748b", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630834551, "uuid": "1d0bbd5f-3dbd-493f-9847-b696d1b4a88c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834551, "uuid": "601ea9f6-6963-493b-be33-b0e3c1dda7e1", "value": "2719fd90e145c3520563231bf1e70417e5dc84cf27504.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8066794-0e0f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630822229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822229, "uuid": "d4f09746-a5b6-4e67-ac23-93938cfe4872", "comment": "Malware payload (RaccoonStealer)", "value": "514d856ce0838b7a16dfee2515353486", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822229, "uuid": "b0e57868-fab2-423b-bc9d-08c82c26157f", "comment": "Malware payload (RaccoonStealer)", "value": "2769006a1773d423a88de48a8394e9613b0e81fe1f0085fe6f81efe3b1f86b91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822229, "uuid": "60bd338b-bdca-4849-808b-0fcca5d6a3d6", "comment": "Malware payload (RaccoonStealer)", "value": "39b77583ea869f0ad5cfbca1414c17f026062564", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822229, "uuid": "2b53ec99-1ddf-499d-bdae-6e91069ca26b", "comment": "Malware payload (RaccoonStealer)", "value": "40322dc96ab8ee02a3af399ef85c3361b450c0b87f1d89f66939705e1ccbb4fbbdc26a3902ad733ae5bfae0a887a2cda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822229, "uuid": "b755022e-77e4-46ca-9664-a96e5657f3f0", "value": "T1ACB4011EBE51F563D1D2C2304469FBB4EF3DBC226A644957B358FBAB2E70280492D352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822229, "uuid": "464492b0-d550-4c5d-9fc1-6f10b429fdd8", "value": "f530acf7acd4a5c8880ba2a4704d4cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822229, "uuid": "cc4f4563-d931-4504-bd78-e65e16ed86c0", "value": "12288:S6xb+bECxckUyZ9woWjYwqlUpSDkjISZnf:F+EC+kIoa9qGMmISZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630822229, "uuid": "e622732b-5f4e-496d-9412-570f53b817c6", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630822229, "uuid": "986f94ff-dd3e-4f4d-bd4f-9a3a5407e465", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822229, "uuid": "8c4c8806-e326-4d5f-9c0b-94c408bed009", "value": "514d856ce0838b7a16dfee2515353486.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a486cdf-0e13-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630823574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823574, "uuid": "4f11f26e-e5b4-4b7a-af25-97c4fb257d4e", "comment": "Malware payload", "value": "ff91cf94cb26834df23984778e44c16f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823574, "uuid": "5898a9b2-6777-4901-a52a-337520c62caa", "comment": "Malware payload", "value": "27bf990a6dc8a30ca1de18bcb48294c90bc4d24faa6341854f10988e9609abb1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823574, "uuid": "92a84c2e-7856-4ecc-b8cd-ec3d80480c91", "comment": "Malware payload", "value": "0897ea5b3728b135c591658bba742798a9ce2f78", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823574, "uuid": "9ff6b914-908d-43ed-8f94-6d0b9454bd3b", "comment": "Malware payload", "value": "687b6c8c6c9444b797f6269f3daaeef6af1361a4c8bbfde0c162bcb528f70c8ae7a62f978d19adde1055b871e0a14e8f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823574, "uuid": "5117959a-37e8-4c20-9129-a63696c243ba", "value": "T1E5C312D41EC3B0743AD4289084497ACECA4A659773B3CF3792663537A9B127D9B23C52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823574, "uuid": "fd8a28f1-d9f3-40de-b27b-ce6617c56553", "value": "3072:MVtVywEiGXatPC01KEOmCTlUCep4biDTCnv0k:dw3O2cxTlUI+PSvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823574, "uuid": "38710b5e-faaa-47a1-9db5-453d4f02b1fe", "value": 128330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823574, "uuid": "73fd62a6-80b4-4ce3-8744-9952f00ffb5d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823574, "uuid": "61bdcada-3f43-48ec-8cdd-51762dd95633", "value": "1855.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc303be-0e0a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1630819953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630819953, "uuid": "bcfc92bd-8122-46d5-b1b0-9ab31b78beb7", "comment": "Malware payload (Glupteba)", "value": "da334b88e6bbe6b77cb9470f8f9de2e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630819953, "uuid": "1b427fef-11a0-4586-ad6e-4ef848d0e24f", "comment": "Malware payload (Glupteba)", "value": "27cc1c937c1756bd58ce0ec416d58c4db6dfcbde9e472f3e12f897b6e2a2e881", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630819953, "uuid": "02ed856d-9e65-4564-b39c-b74615de28be", "comment": "Malware payload (Glupteba)", "value": "8ed6c99d2d2e7b7f72e582d3fd057b0661940577", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630819953, "uuid": "ac9e3f8f-a8f2-4092-85ff-533b0b48fc8f", "comment": "Malware payload (Glupteba)", "value": "9653aef3b3677ac938280104160dbef1fa7ea52f1fa81f3c9a2bd54168f095f6a1714b0c72cbccaf18b283ccbf51239b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630819953, "uuid": "07106bf6-0521-42b2-bc1b-f6d2c34c93e6", "value": "T10D26330A6E90E4BFC021DAB045A9EBA0DD3E7C992C14641F3715FF6F9A13285932D3E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630819953, "uuid": "a065b2aa-90ad-470d-a146-534f76ac66d5", "value": "f530acf7acd4a5c8880ba2a4704d4cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630819953, "uuid": "b983a907-f344-4652-95dc-a1688b3704c2", "value": "98304:o4+8FLHnk2DwvU7/rcnub10nXmLzcYWoKZiwzR0b:o4DLE2DWUPcuh0nXmvlszR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630819953, "uuid": "8e506678-c231-4502-8b3f-cb41b81e447d", "value": 4650024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630819953, "uuid": "d9c4d18e-61fd-4208-a69f-c81d3d1f15bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630819953, "uuid": "34af2d89-36d1-4661-9437-da82640d1eac", "value": "da334b88e6bbe6b77cb9470f8f9de2e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33038ede-0dec-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630806866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630806866, "uuid": "4542612a-6a62-4eaa-8141-688139b499a8", "comment": "Malware payload (Mirai)", "value": "a4bd3a9aec67a1fa254c42c510c1e748", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630806866, "uuid": "3ee5a46d-7e6b-4b8c-ac88-56be1ec7b773", "comment": "Malware payload (Mirai)", "value": "27cf09f223cfcafa754e946142187451ec2bc60b0576cea5444d473138b218f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630806866, "uuid": "491da220-c0b2-42bd-a3e0-e96de8488a73", "comment": "Malware payload (Mirai)", "value": "e46b6196e8ac3e98ecbff8713c59a2eb30a79b9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630806866, "uuid": "cb6f1b36-d8e0-46ae-ad1b-d47c6e81856a", "comment": "Malware payload (Mirai)", "value": "1949afe5a5cfade76df8c400c6b66542a69c93e578aaaf0d1fe707af1314f0611215a9928d548fcb8471323508038bee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630806866, "uuid": "863a7006-1184-4d4f-b90f-7cbde1fab129", "value": "T118F2B305BF618FBBDC6FCD734AA9170134CD640B21A53B3A7A34D518B24B24F59E38A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630806866, "uuid": "7902cd4e-b1fd-4dd7-bfc3-d02b5279a68e", "value": "768:uwH8ex2OGokjZeKNeUe6ueFHwpXivogVN:uwH8dV1buYQ+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630806866, "uuid": "8925a8a7-99db-49c9-88a7-88f6cfc3c4f2", "value": 34692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630806866, "uuid": "37d34c07-375f-460a-837a-5acb893cb2c4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630806866, "uuid": "e1626ced-c033-4ed5-83f7-689d81979f98", "value": "a4bd3a9aec67a1fa254c42c510c1e748", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3abd446-0e0f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630822114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822114, "uuid": "4ece1f09-e9ec-4644-88c4-312dbbe7dcb7", "comment": "Malware payload (Formbook)", "value": "4e3cd4f51a4582dd775e3974dde197c9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822114, "uuid": "eccd5583-de9d-410d-a1e7-d4c654c6a846", "comment": "Malware payload (Formbook)", "value": "27ec204fc931a77bb20d520c3549e4ec09f38e01e8bffd6c7a22827b8774444b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822114, "uuid": "7aecf0c4-1fb8-4f66-8054-3b18488727e0", "comment": "Malware payload (Formbook)", "value": "d3030752291b70f3b375179165838b03a0fbf22e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822114, "uuid": "b01c80dc-67c8-418f-81c2-0ef8425895c6", "comment": "Malware payload (Formbook)", "value": "62e11777687f21ab7661aae5f21ac82666ebaa31cb432f8806c3a40572a7ee6847a6e32604a3ee185cd19fbde1c3c53a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822114, "uuid": "e617dceb-1769-4976-a84a-877018d7f18f", "value": "T18BB42399EA545C117C8C34FA7C8444F973A90D6DCCC0A2EA50DA606E14EF9F9F61EC8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822114, "uuid": "735c905e-830e-4a64-9224-72068f552e29", "value": "12288:B/a1M0uV9Mm58f63RwQ2bxIyoW6V4l3Mk0aU3CYxN17LlFc5E:B/a2xzMPf6h1wxIy1lcFB3Zt7JKm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630822114, "uuid": "10ed1f48-ca91-4ae5-9f93-c5556d973882", "value": 539464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630822114, "uuid": "7492aa6c-06af-4dcd-a152-6c9cee50d498", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822114, "uuid": "e41bd01f-a54a-44e6-a7cb-23fd5db51984", "value": "POSH service quotation.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "863f42be-0e1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630826762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826762, "uuid": "0e130d87-c4e5-493a-81c0-9fc9e5120193", "comment": "Malware payload (Buran)", "value": "5f9be59f0e5c09ab48eefcaabb7bce28", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826762, "uuid": "2deaa0c4-5301-4f1a-9a93-781b10bced39", "comment": "Malware payload (Buran)", "value": "2986925a68e9a3cce958a9e4c58b93eb0d6b3fbef8ee213ab7a0a2ed5737cfed", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826762, "uuid": "fa725f01-5586-49cf-b5cf-23ea782d89ce", "comment": "Malware payload (Buran)", "value": "8b5d3da095823ce80d1b431acfb06a92fda002f9", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826762, "uuid": "2d337310-c3a4-4053-9623-a5c6f79e32fe", "comment": "Malware payload (Buran)", "value": "79b187b1b1ab7a9ce43c8e88b5924bd5a4a5516b6346eb205eb6bb5ce6e2712d260faef1918d4c0b9439c3e9abcf7638", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826762, "uuid": "a3886222-21e0-4fee-81b3-cf5c98931daa", "value": "T16A2422DA84CD5383A4189419BAB3B67A83FD338CD3424D6036E7B57AEFC0A79245391D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826762, "uuid": "fffb9aa7-b739-4fc9-a024-3d2dd4a3bab4", "value": "6144:vBp8ow2nl6/NSA96+/izXT9d0s6JlczCB8wJD3J:P8owk6QA92T9djzGDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826762, "uuid": "d999e36a-c44b-4c88-9bc1-23e233d2e7fe", "value": 210884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826762, "uuid": "769d8240-08a5-4de7-beae-59361b0dc980", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826762, "uuid": "578c353c-9bf9-4e2c-a8ae-68cb1a3d3892", "value": "5540.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c43620a3-0e59-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630853924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630853924, "uuid": "8b8fb389-f7eb-468d-8f09-a15d124b7ca8", "comment": "Malware payload (Mirai)", "value": "0cba1aab5b4a31e78ab17ec6547fb6a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630853924, "uuid": "15620f81-736a-445d-ba73-6fe0111df8d5", "comment": "Malware payload (Mirai)", "value": "299d4dd15a6ba96300f0b0f2c9b262fa39a0943c8963c9deb26a4732e2b3f47e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630853924, "uuid": "9cd28e11-ff93-4843-aadf-62ad76d684d3", "comment": "Malware payload (Mirai)", "value": "fedde08c80736c3ebbca2b418b393d92267a3195", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630853924, "uuid": "0a2bf687-5f8e-4e61-a07c-f2e8f1bd9dc0", "comment": "Malware payload (Mirai)", "value": "ea0ef6d8d81eee772d779d6251d5cb37d50f8ba027c4dcf11200f355c6872935488737ad31e4bb542b4d2cfc49ac0800", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630853924, "uuid": "eada8fc1-a79e-4380-8631-eef28029ad63", "value": "T1BB534D42B5240A1BE8D20BB4342E1FE247BEE9C269E0B5455D5FD7A14935E3338CBE9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630853924, "uuid": "6e64b3ea-e947-4a3f-a8e9-3547359b07e5", "value": "768:O3yQqS4gRXwPRLY89d1h03ixrY/JjfhN/8ERzBagRzjrEpNy/piIvLOagIGryA:OyQqaMEQd1h03+EN0EmgV8pO7v3gIY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630853924, "uuid": "92117875-eb54-40c0-8769-92848bbfe4a8", "value": 66704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630853924, "uuid": "cd29643f-6b5c-4ffb-96e6-4aa2b0b1931a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630853924, "uuid": "a6ef5677-c677-4ad7-9274-2103d04ab854", "value": "0cba1aab5b4a31e78ab17ec6547fb6a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9117e015-0e14-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630824203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630824203, "uuid": "4e5170b1-ec9a-45d0-82fb-4617848885b2", "comment": "Malware payload (Mirai)", "value": "d76bef0a771babcfdb53dae76d28aca2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630824203, "uuid": "f636e99b-fec6-4fc2-a575-9cc021c0bf87", "comment": "Malware payload (Mirai)", "value": "2afe9ef0780b843c3278a879bbb8cb97537d936b4b49e020b338921484a12758", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630824203, "uuid": "07c316f3-2df3-4a22-8e67-d69d92625249", "comment": "Malware payload (Mirai)", "value": "1c6fa594a806b5d01c07f84d1ed4ae04523879a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630824203, "uuid": "5a293af3-8b12-4e76-a074-11887f19dda0", "comment": "Malware payload (Mirai)", "value": "d419aa5a5e4734f17255f34544f33a8532603f8a7aa8256ea3aaea6e5d45ea56eb6fd8df52fe5bd76b62d537eb0bcf3c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630824203, "uuid": "c8b0ddd5-5065-4929-8bbe-78608e60e129", "value": "T19A43289BB8019D3DF40BA6BA94264D0DFD3163C102830B2B67B7FDE3AD720695D12D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630824203, "uuid": "f7e40189-6f05-4976-9d8f-d946c1a4e47a", "value": "768:ujepLLJ3QjJu11JfeCIg3S5s5ylgaZz2XA8SloW3U8N6AW4AZ2oHlKkbJoQLDg7:et8a4ksUlgWz+A8SqWJN6AEZ2Id3LU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630824203, "uuid": "2180db33-a478-467e-b854-5390dfc5d3dc", "value": 56500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630824203, "uuid": "1e99607f-1770-4291-88c3-7212ef939b4e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630824203, "uuid": "f5e3d5ea-c6e0-4113-8dc2-7b30b3e44abe", "value": "d76bef0a771babcfdb53dae76d28aca2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4083068-0e44-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630844931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630844931, "uuid": "d44577c0-c46e-4140-862b-4e37c1192b3d", "comment": "Malware payload (Mirai)", "value": "80288196d4df2e2b233d748a5074d865", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630844931, "uuid": "1b631372-0021-4ad3-b908-8d5ba5a0edd9", "comment": "Malware payload (Mirai)", "value": "2b5ad54e397b18b836b6cdca39787c180cbdd711e03eab3fdc0de7d5358ea1ca", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630844931, "uuid": "bc5fc387-ab1f-4844-abf5-4c9e6ea3a02c", "comment": "Malware payload (Mirai)", "value": "8f1e4dedaf000f81a7132c0bad77057a30ffad5e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630844931, "uuid": "3df3f04e-691d-416c-ae9a-c7eea82535d0", "comment": "Malware payload (Mirai)", "value": "b446642bc14b1a3ed903839b004f2b1ffcb70c78a8584564e986aec9004e96eb05dc3ead26f20f2bd842364a011fc045", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630844931, "uuid": "02a8916d-b507-41e6-8ac8-9c81ec234d13", "value": "T15633191719D189FDC59882304BFF911AF962B07E4138F68E27E47E27FD9AD210E4D09A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630844931, "uuid": "823c59da-f70a-4b4a-a4a3-18b31cc4ce81", "value": "1536:19QLcOOIIK+ReFC67RDDk8TkC0zoCQTI0maLKNHTjtgFj/pNsZPeTBn:19W9OBK+cVtOhzjtwpNsFeTBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630844931, "uuid": "d9c73d38-0de9-48a2-ac0d-7c8ad3e8ecde", "value": 50688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630844931, "uuid": "65cc93cd-e6b6-40a2-8b12-15ce06009836", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630844931, "uuid": "7980df90-4e6c-4db4-b843-7f4c5c0a4384", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1244090e-0e5b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630854485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630854485, "uuid": "d921e2b3-6773-4cbc-a2fc-60041d3bafc8", "comment": "Malware payload", "value": "fddb32a63b49e850efbe0173605fb461", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630854485, "uuid": "a041590c-7717-432a-9220-4ede0dfabe9a", "comment": "Malware payload", "value": "2bd822835f1dcf24123f1aaa7136b536a65e535ed4f61ab086918dadd5d862f6", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630854485, "uuid": "adac3846-1983-46d8-969e-8619d23aa3aa", "comment": "Malware payload", "value": "5401563975d11b288bbea561047608fcb3758ef3", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630854485, "uuid": "9be0256f-c006-47e2-9a17-870b7df6dbe5", "comment": "Malware payload", "value": "972a61ebeb82041dfd171bfcfcb7bfcc56ff82c01d34f926f2e0ea4161e6eba93a22d68a1f7495d97f680908ca84361d", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630854485, "uuid": "c9565c63-9a24-4a04-ab14-332dc7c493d8", "value": "T151F02878439DB2A0085526D2F273FE66A10401154DF2BBA497DFCABFD0CFE44A154DA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630854485, "uuid": "b33e2085-b5d9-4143-93e2-26262b770075", "value": "12:NyDvqpxuP2rEBf790IctsZnWI/dgyIg8a6mZE0pY0sM:oDvoxu+re790cZWmgyma7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630854485, "uuid": "ca095c6c-e200-4336-adc3-3f8cb0affc62", "value": 585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630854485, "uuid": "590c0672-b7a2-48f1-9575-2a596e502622", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630854485, "uuid": "da42f297-49b0-4bf2-8c8c-d372fd401fb7", "value": "ws7gGjLT.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ce5ef2e-0e4f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1630849537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630849537, "uuid": "6aea4f35-0cd6-41a0-afe2-0b7f6697acd3", "comment": "Malware payload (BitRAT)", "value": "ccc5781044051e1eb884342a6d35b08d", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630849537, "uuid": "643439a9-b124-4367-b70a-a39599446566", "comment": "Malware payload (BitRAT)", "value": "2c03ca6d839ffc3d6b3b674b3e324f7cb6fa1689ab433f00068325056b6f09e7", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630849537, "uuid": "d62a4c67-2fde-4fd9-bfd3-0dec52d1c223", "comment": "Malware payload (BitRAT)", "value": "126ce0f70153817cad6394afb2c23c815beafea9", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630849537, "uuid": "7fa47a0c-4e1d-4d70-938f-15f4071d8593", "comment": "Malware payload (BitRAT)", "value": "39050fe704491cb58650682c9d5482a0ceee515bed00ddda091028d19dee04f1bcb775df2707109343d74c2ab649edc8", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630849537, "uuid": "2a07bbfc-5d59-4bf8-b70e-5a1f2b5e79fb", "value": "T1EE750182996AB25ED43405771A133DCB385EF0F367620436F79E4F08EFF98450AE6662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630849537, "uuid": "1919e401-ef30-4c59-bb93-2db718bc822a", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630849537, "uuid": "0d48c516-568a-43d0-8359-b9f43cf49a7e", "value": "24576:NndRKZCy2BrhCeU2i2cJijFbCBTPmiY05tJMSQp5ysA7Yg1nLkz2dUdLCkrYy/:VXDFBU2iIBb0xY/6sUYYbdUKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630849537, "uuid": "210dc95b-e005-4d25-b741-4723ec096917", "value": 1669294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630849537, "uuid": "9ed2ccee-51ea-40b2-880f-44257271159a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630849537, "uuid": "fdf1e57b-fe9b-4e2f-8206-ef94eb958401", "value": "MABA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a2ca91-0e64-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630858708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630858708, "uuid": "39eb4f08-473c-47fd-8758-eb35660c9be5", "comment": "Malware payload", "value": "ba1aab9461ac6a9eac50f1f4412ceecf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630858708, "uuid": "0e34e2f2-d016-4966-af58-c0dcf07b0ff3", "comment": "Malware payload", "value": "2c53f5d5862861cc72639e0d50ec568fa337c4e24ea6d17f72c09cdb9b53498b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630858708, "uuid": "81b6406d-be35-4231-bd01-cfb64ac98e35", "comment": "Malware payload", "value": "937fc05ffdc0fa76bb1a6207aeed779ce5bf94b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630858708, "uuid": "e4b01ee4-c3de-489f-8f07-f36e4ce1e14d", "comment": "Malware payload", "value": "8aab3a0f1ca0ca9e8f3c4d3e301240bcfa36b13a6555f7074ad04cfcd6eb846b1c1a67ac7ce641cac2b2863cd44efe6d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630858708, "uuid": "4e932c4e-9e61-4436-8ad5-65196c2c7921", "value": "T168E4A93E18FE2327D166D7F5CBE0C823B6C09CAF3122A96557D65B665316B4234C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630858708, "uuid": "67a545ba-e56f-408a-89b0-7e51f1e4c843", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630858708, "uuid": "433a4491-af9a-42f7-b810-d7c6325ae9f6", "value": "6144:mBv9cwtYFJLgGJeYiUnyJtWWSMYI/fYgfimgLlLQjU:mBVG3EMVI3iQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630858708, "uuid": "4715fd47-9277-4726-a9f3-87a8f5cb788c", "value": 719872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630858708, "uuid": "332daf63-657d-49fe-b1f0-c34e5cc704ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630858708, "uuid": "0a536c20-9684-4eeb-bc23-e93116e7ba20", "value": "ba1aab9461ac6a9eac50f1f4412ceecf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a415f181-0e14-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630824235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630824235, "uuid": "48bb9d3b-e15d-48ac-9607-12f2215d7f02", "comment": "Malware payload (Mirai)", "value": "587c37f82e0d1825b7e5f88eb7af4a25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630824235, "uuid": "154edb4c-7a18-4488-8dc2-23d2be541072", "comment": "Malware payload (Mirai)", "value": "2c544223c20351399d8b4111216754d39a1669be3845129e9fb14287b023cacb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630824235, "uuid": "7f3b0542-e687-4496-927c-317fba8b3dc3", "comment": "Malware payload (Mirai)", "value": "9e93a6be0e7e99ebade7546e643c5b2299aeb231", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630824235, "uuid": "85c8ba8e-98e2-43d1-887c-674cda914c09", "comment": "Malware payload (Mirai)", "value": "7d4b7981f963e3583cdb4eb3381fd79cd475b1d7f08517eabeb923bf57c23ee8db74ec42ac4607f09e664cc68f9ccc91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630824235, "uuid": "810736be-7815-4cd5-9b99-2319a5f64fd1", "value": "T153338D75F8291E54D15642B4A4248F352F23E2C893933DF356A1C3B28017AADF91EFB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630824235, "uuid": "e6ae5c8a-a071-4dcd-8cff-27119e68e934", "value": "1536:mamyClrLp7wnwib4dK7a1oZLXrXCr/3a10:mVyH03oNXrXmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630824235, "uuid": "6a869253-0aa3-4382-a8fa-c5d36fcbfef6", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630824235, "uuid": "a87fdd9e-62de-4fbd-85f9-8883c883de91", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630824235, "uuid": "7fb7dd0f-7695-495d-8051-fe6adec17d77", "value": "587c37f82e0d1825b7e5f88eb7af4a25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "079ce3d6-0e13-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630823543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823543, "uuid": "bb583c59-02c0-43b9-b8a0-de0e51318cc7", "comment": "Malware payload", "value": "89c0362c1f85f8da903582e4c6c724e7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823543, "uuid": "ffe33048-827f-4a58-94c4-97b370a1e86b", "comment": "Malware payload", "value": "2ca88007826ba4004ca3bf00893b89fe652251f56d82d1d0d06cd27b5e53976a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823543, "uuid": "87c75ea8-5534-4bc0-88e6-1a8087e7c55f", "comment": "Malware payload", "value": "6b5b3ccb14a0de93b29d8ef086a787e6cf79e83c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823543, "uuid": "ee2b0a21-b42f-4dd2-bd47-1c467754a8f0", "comment": "Malware payload", "value": "14b309894fa056e88360819a65eaa5db33ac121abe5dd2543cdec5de67f37d39be0a8448dff2b0f9dade09eae85350dc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823543, "uuid": "140d4303-d7a4-4c7b-88c9-3452ff54bab8", "value": "T18174AF50F78820960A83239BED5351D1EA7DD04192402264E95F93AD7F439ECD3BBBBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823543, "uuid": "dc6a0d3e-aab1-4b70-972c-8d4fdb944756", "value": "6144:ZOVhf3hulqgMhwUnVre0kMEjDXFhQ9h8YIxidUXt/0D9:sVMqlw/0kHQTzUXt8D9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823543, "uuid": "e65d5d52-8b79-4b90-af6c-912c493509a0", "value": 338443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823543, "uuid": "ca4cd5eb-2da2-4b8a-853b-d61595abff39", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823543, "uuid": "5cb97c68-94ff-45a4-9de4-c36a79123a10", "value": "6252.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d951cb-0e14-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630824218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630824218, "uuid": "a7dacb7e-da7d-4c6d-827a-348a7ed24c2e", "comment": "Malware payload (Mirai)", "value": "005710a1f46a974e937039eb16619075", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630824218, "uuid": "42c3cb95-0588-4fa9-b8d5-27afec505ab5", "comment": "Malware payload (Mirai)", "value": "2d07839d001c22884e6f830bc4d7d79bfb616e4b3fbfda4bab26d0b0958181e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630824218, "uuid": "e7202821-a046-49ae-b1d4-9a842bfefff3", "comment": "Malware payload (Mirai)", "value": "074f3c732043e5fdcdfb3957152bdffe86bd43b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630824218, "uuid": "65f8710d-4452-4ef1-8795-0b4b19b23ceb", "comment": "Malware payload (Mirai)", "value": "d510b2e0237ef73a9c392cc95366613d54573cd27d57c62ee3aa7e4f9056db002f0f9088998449ac7412686269444a00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630824218, "uuid": "27182c75-2cd9-4a94-9006-007b2a646407", "value": "T1D0435B5172280B1BD0932A70353F4FE09BBEEAC021D0F686B99F9B968535D334546F8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630824218, "uuid": "85a9ba70-7178-49e0-819c-c6c7a4e87379", "value": "768:zaVVRLWYgnvRYDCi1jAZZkXWorKquPduNZiT+eN4T9qKnZY10Uzv:EVUv8CiNPG5TH4hVna10Cv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630824218, "uuid": "d84302da-0443-4597-854f-16c154884c3d", "value": 55908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630824218, "uuid": "d6e0fdf8-8baf-49be-85c1-9dfeb402cb09", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630824218, "uuid": "71236f46-6d13-42e6-83c8-97f33dc754c3", "value": "005710a1f46a974e937039eb16619075", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b79cf43-0e9b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630882203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630882203, "uuid": "6af32dd5-c53d-4427-9997-24e6c6aa0439", "comment": "Malware payload (Mirai)", "value": "563d2bce0b68c80aea8990e200b6c4db", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630882203, "uuid": "eb8b1cb5-6d49-4ca6-83e2-8e6390b98da4", "comment": "Malware payload (Mirai)", "value": "2d152a3b49adcc403878c7d64750307640c3b2c56df87529760334fd4e51c5b0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630882203, "uuid": "00dca31e-e7f3-4f88-a907-1af3773c91f7", "comment": "Malware payload (Mirai)", "value": "1e493f46043ae9dc2a1740c6a59e5ff80f05e6ff", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630882203, "uuid": "acc40262-fe9e-4ce6-acd9-f95b68e086a5", "comment": "Malware payload (Mirai)", "value": "2c85c870c2b480ff1f17808b1ec7077dbc23e253a67e9a38b59527ece97f353c441c219a11b2f08242b76ac4082116a0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630882203, "uuid": "76415541-57be-4c56-9e16-a581e5d9a7af", "value": "T149C2D15181B844F1E9BE8336A43F770F7DA8B294B34058B5E5D41D3DA4C2E396B38297", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630882203, "uuid": "7570b205-3915-436c-a37e-ad789540e185", "value": "384:McpxiFZsuTsH+Mn3IA4Y/ndsB3qdP+hoqVUgs/pSTa++u3Ox1VlAANaNJawcudoh:DC/su/DAxPa9eHVlSnbcuyD7UHQRjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630882203, "uuid": "f0ab2058-d010-4e4c-bde8-23b167605f85", "value": 27948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630882203, "uuid": "1085a7f0-2e5b-49e6-bb88-8a8a92bf2050", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630882203, "uuid": "84ef3541-15a9-4208-9dbc-c21a00a21722", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a203600-0e33-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630837372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837372, "uuid": "1c05b0a2-74d9-46e3-8183-2e8048264c19", "comment": "Malware payload", "value": "ecda08ce996b3d196342b55f96d3a686", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837372, "uuid": "b80e2726-9593-4480-9d87-7fcca2c423cb", "comment": "Malware payload", "value": "2d880c1e4293a10931e2de6e98d0afddb34706a77105236d8fddacb2f6b9175a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837372, "uuid": "21a9d1ef-a6b8-4c7b-b458-fa36d6030fe9", "comment": "Malware payload", "value": "7917ba3df9b38ee3353b64eb34500d35d043a398", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837372, "uuid": "4b118626-d374-4c8a-8f29-bc7c50dd89ea", "comment": "Malware payload", "value": "2c919b9d08b1499a02879d7553988a95de5a452163f703f537fc26ba6e3c53eb860abce6fd5938a81998d5a301ecdbba", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837372, "uuid": "3d9a633d-523c-4000-85d2-bc165bb9e860", "value": "T13AA312770DAB68CF9D1895E56C896FB1011D45EEDF928FD8B0E21BC43A6D40CEE61C88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837372, "uuid": "2c0aec30-2a3c-4fe7-b13d-0fd174d10925", "value": "1536:eEgXI/d+n56uPzc56LSV1agniNyaRAHsEMI8WIOTo++fq1mpO13zYVcgewW+4UfY:O8d+nwuH+VNniNRAMEBa++S1m81j3LqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837372, "uuid": "486251df-d3bf-4b28-bd8f-f99a94942e3f", "value": 98000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837372, "uuid": "39f9d47d-3dd6-41fb-8f41-51d18a3e07e4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837372, "uuid": "13b7dd56-1f02-4967-89cb-c5d59e418fc3", "value": "2961.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff3c7ead-0e30-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630836414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836414, "uuid": "8f85dd00-b53f-4c39-9a3e-24e617860826", "comment": "Malware payload (AgentTesla)", "value": "05423f9ea2c5a89303d34229065c28bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836414, "uuid": "f779c891-ff7d-4184-80be-0a6ae610c21f", "comment": "Malware payload (AgentTesla)", "value": "2f179386e178b280fc409daef01275915bf5e1f42826c1fa0cb24dc7ee393a1d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836414, "uuid": "8473f3ea-7932-47c7-bc8c-abf0f6313529", "comment": "Malware payload (AgentTesla)", "value": "657ccfb3620c832fde806d8cec8575d0f01f8a14", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836414, "uuid": "375d30f4-9fa1-4d83-97a4-55c9bfab537e", "comment": "Malware payload (AgentTesla)", "value": "e73650d432b6de0a407ebdbc0296954f316de7eb806104fedb3369eea509f0cece74bce147ba275990e6c3b29fdbb4d0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836414, "uuid": "af365aa6-41ee-4372-8196-889b4f9920da", "value": "T1589423299A2CB5F5C330650680FF909A4DE9114B5C63D2F93B5439C80AEBBCF8F19997", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836414, "uuid": "44cca25a-ae7b-4e5b-836e-f1be738904e7", "value": "12288:Hkk8Am1yoNStNSeBjK2gMoazi4GLe3do2nxDz:EpAm1yoNQSujK31e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630836414, "uuid": "567dd9da-2768-42cc-9355-fce5a85edeb3", "value": 416147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630836414, "uuid": "4abdf60d-738e-46a7-924f-923ff5703e10", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836414, "uuid": "307ea1b9-98d8-4a1e-8331-ed35687c985e", "value": "RFQ No,E027-2021.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed8b944-0e34-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630837863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837863, "uuid": "bd8e2478-b0d3-4072-a498-f47f1b9b4814", "comment": "Malware payload (RaccoonStealer)", "value": "4ea1e631dc94b8aaa7110359f7f2bf0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837863, "uuid": "b20cdc9e-bb10-4329-83d4-b217e3333b17", "comment": "Malware payload (RaccoonStealer)", "value": "2f274e4e795a20d8a6d0ef023785abbb5e9dbf46dc4bd0dbe39b7a173299e94b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837863, "uuid": "37df7d99-9500-49a7-9e38-9775a39fad17", "comment": "Malware payload (RaccoonStealer)", "value": "f25a99354056a31e1a60eee93dcb50c975d68800", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837863, "uuid": "43b999a7-b1b8-4e81-8724-ee2906526c79", "comment": "Malware payload (RaccoonStealer)", "value": "e6fc61f29bd7467e4c42abc0567c33b7570437f0e82d66dbfaa79be8bec544136b4f0ec9eee855541a1400b0abdd1a38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837863, "uuid": "b32e7bb7-9530-42d0-b4e8-0d1b892a324c", "value": "T17AB4F11A7E50F833D182C275552AE7F5CD3DBC711A6446473258FBBE2E34280AA2E35E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837863, "uuid": "46d76963-7761-4d5b-b717-f956e35c725d", "value": "b2c249fef864036a8cc857592c5ce556", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837863, "uuid": "08f210f4-36f0-4a3e-9d9d-a8f10cd57ee2", "value": "12288:rHYRg3owUBnowTOff86ROd99U7UHPBB2SG/yEyuJnIa/DkjR0f:DYW41/6E6MBU7Uv2fWuJnD/mR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837863, "uuid": "e40d4745-adda-4f91-9e9f-e74e787053ec", "value": 535040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837863, "uuid": "bb21fd09-7ed5-40dd-8fa0-cfbf212df411", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837863, "uuid": "d96b59f6-df63-4dbf-b77c-89684bebbe6b", "value": "2f274e4e795a20d8a6d0ef023785abbb5e9dbf46dc4bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96b78bd1-0e0d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1630821206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821206, "uuid": "47d37966-4775-4eab-8081-3b3d1c279bfa", "comment": "Malware payload (Dridex)", "value": "a926ce002ec36ee94869a97ffe6c5ca9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821206, "uuid": "e72585df-4b48-46e6-baf1-1da75272b418", "comment": "Malware payload (Dridex)", "value": "2fef01ec46bc56992c5719d335add15e15b3329790b943f52df9c340a1b6b369", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821206, "uuid": "5ca92ce6-bcf7-4dd6-ab31-c6dc7dece6e9", "comment": "Malware payload (Dridex)", "value": "aee181b411d3115d3d848b6b958f4749a5720b50", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821206, "uuid": "a97d2293-214d-41da-abb1-34a05db57714", "comment": "Malware payload (Dridex)", "value": "d041cbffb49d4999d62b83a0c56d41c706d64352bbaacfdc21a26cefededdd9206f8f04795243ca2c1ab4cd09608c310", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821206, "uuid": "4d91c840-668f-468f-a4aa-bfa2937b2be8", "value": "T1A895D0513F548AA5D43A0133DC1BEBB283522D790A34A5C7B1D0BF5B39732E35A0B66B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821206, "uuid": "f0971403-ec46-42bd-b524-d428cec7cbdf", "value": "520ec28ebee6dd2b27dfba80f5fdd4e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821206, "uuid": "849ea7b9-7543-4c2b-bb59-4630a81da1dd", "value": "24576:MMcpTo60gNHvbyVfbWWbyHjaSabybbybvkbleb:MMuTxEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630821206, "uuid": "bd71b760-7e4d-4f73-b639-e178981d307a", "value": 1957376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630821206, "uuid": "b26be1fc-22c9-4013-87ff-e6e9e3c8d763", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821206, "uuid": "94e0aeb1-3650-4a13-b587-c6247bef0490", "value": "a926ce002ec36ee94869a97ffe6c5ca9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9bd7532-0e99-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1630881368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630881368, "uuid": "349159a4-f127-45eb-ac98-5fa99f91c780", "comment": "Malware payload (CobaltStrike)", "value": "51624116da2b3bcc05a349304620f1ce", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630881368, "uuid": "f8043a5a-4925-48aa-b131-e5841ea24c38", "comment": "Malware payload (CobaltStrike)", "value": "309c96585aeef62c8b562dea5602310df4bbc1a88837a923dccb5e86b248b283", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630881368, "uuid": "f66e4525-b1c7-4d53-800a-0b6aa754fbdc", "comment": "Malware payload (CobaltStrike)", "value": "f915fc0da733f32f264ee188ed4ae5b04d3d50db", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630881368, "uuid": "832b1573-6ea4-4fd2-b469-5aa7f6d0974b", "comment": "Malware payload (CobaltStrike)", "value": "c935d2f118104f8e366023b44565792363187d63bdc18d470dbaf69b34fbc9096ca559b4c4569d258a8cbddfc0a9fd13", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630881368, "uuid": "5130679c-54ed-4af7-82fc-778603b72095", "value": "T11224BEB49B1F599FD08AECB610F47A6D2DFBDA63C850C510A944AED6DE12BEC4E03C44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630881368, "uuid": "b603023f-4f93-4886-bbd6-ca8a522bdaee", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630881368, "uuid": "bf935ce2-bdf5-4218-85b3-f6c7508636f2", "value": "3072:NzQ/2ezu3roosF/NZo1j/T+ODT/8HpP5b0d1Kyfup6Ss128oWoXKNG/9BCVD:N0e9szNO9qi/qH8SsMWnk/2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630881368, "uuid": "c5d499e8-5e98-43f0-9835-4368152d4e4f", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630881368, "uuid": "478f3c75-de40-448f-8708-71bf83bd2f58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630881368, "uuid": "383903b4-8167-4c5c-ac6e-4bdb2cbf873b", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78cf93c8-0e57-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630852939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630852939, "uuid": "246306ae-52ca-48bf-8baa-6ab6429a7010", "comment": "Malware payload (Mirai)", "value": "66cf7ad76549ac5f8c993c1ca292c3d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630852939, "uuid": "f64e981a-8eab-4591-bb36-5b09a9e82aec", "comment": "Malware payload (Mirai)", "value": "32b7c9b9e8f9061dd5ea020b34e8877e4aab19b72abd00ad83e56b615f879096", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630852939, "uuid": "c88dac19-6b64-44e8-824a-89e6012a58f4", "comment": "Malware payload (Mirai)", "value": "08b722a084592f9c3056586e88a0b61faa2b1e9d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630852939, "uuid": "560acce4-6874-47c8-8c3e-ab8deeebb47b", "comment": "Malware payload (Mirai)", "value": "b43880efccdd26b7812e70320af19ab98ae46885d4b9e437213a1f8931905c989be9e3c3d3cfd380019d5873bc903607", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630852939, "uuid": "2eb38c42-0579-4fc1-8d9c-bbc30f55dc5c", "value": "T1BB93B6197E218F7EFB9C823947B78E22565833D626E1C181D16CDA111E7038E785FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630852939, "uuid": "768915a0-c2a2-48ff-ba3a-de9521d82253", "value": "1536:vrveMe0u6B/Baz7Fv6YByFDy0vxtjpIQLhEhNXXkk/y3IJ:Tv3dB58yFDy0ZFpIxhNHkkq3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630852939, "uuid": "b8f1b18f-a698-488c-a0f8-99600dc89c7f", "value": 89280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630852939, "uuid": "1749c31c-a9fa-45c4-a8c4-ba3340d62779", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630852939, "uuid": "03dcc21c-7131-4676-bd69-795fcb59e4c7", "value": "66cf7ad76549ac5f8c993c1ca292c3d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b6a314-0e1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630826783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826783, "uuid": "720b3d2e-a40d-4c1d-a6e7-16abe045fc6d", "comment": "Malware payload", "value": "496cf3f73c2e22309400e2424c556ae6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826783, "uuid": "bb775b75-fddc-4e48-8a09-d966ad1693ba", "comment": "Malware payload", "value": "3312b500225d2717eb74245d635ca1a0ad8d4077c0a6c34fe69f83e2ff6d8961", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826783, "uuid": "26bce484-7dff-4ceb-9249-a468a1804a94", "comment": "Malware payload", "value": "ce2239dd1c0f493603b4e042ae815a4b7fd65571", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826783, "uuid": "fb49f101-1f78-44ce-b1b4-2a2b9c85ec71", "comment": "Malware payload", "value": "cf9a6129feddc934e89cbb033da1f65043c3d413f3ed33d92193371504cc51a083b10855fe83a79bb92ff5438ee25300", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826783, "uuid": "ae6b9f37-966f-4c1a-8a31-45e295d52c7f", "value": "T16F442358BAF00EAEEB6BB000925DA51D1E5334D77253728F2DA00D9D3A5D67E8243BD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826783, "uuid": "b285dbbe-b1ca-482a-bd4b-731724926ddb", "value": "6144:FyttrAQYowwCoymVZJ+1GK9dSSFrEpJBY8fvNvZi0C4bCRpe5:FyttE5QM1GK/CDXhZi0C4bCRs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826783, "uuid": "c7e59804-149a-46e6-81ab-8fdce430718a", "value": 259238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826783, "uuid": "dbcc7a04-2270-4fc5-9c75-732a5f907840", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826783, "uuid": "96f73305-6e61-487b-bc08-ae00dc0e6be2", "value": "7399.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "889c99e3-0e46-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630845664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845664, "uuid": "86aee630-d41c-4ff5-a98a-1478b329596e", "comment": "Malware payload (RaccoonStealer)", "value": "52b69ccf22ec2b5084fee8f4ec9188ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845664, "uuid": "ec4961d4-77fe-416e-acef-648cd2bdd9a6", "comment": "Malware payload (RaccoonStealer)", "value": "3542020f73e24ff693b50a375bbd366e6b6ca4cd4fd93bd15403e4cc70d91756", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845664, "uuid": "b99e96fe-228a-49de-9b06-97695d8fdf92", "comment": "Malware payload (RaccoonStealer)", "value": "a5dc3c46688bac249e0da29b1b2da8640039d108", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845664, "uuid": "3bef9b9d-acf9-4fd8-9f8b-95d1236d2f40", "comment": "Malware payload (RaccoonStealer)", "value": "bbe3082e9c9ffad9b9a551c9cc1f0df3b77fc44453905c00eb31dc2ecb60712f52c69fcb73964b92c34d4395a625c7be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845664, "uuid": "cd63f474-974d-4cb6-abed-3daefbdf0c3a", "value": "T1D03633143FC5C6B6CA512632D3141FF564AD83981E7B0DC763B5434582B88FAE2BEA2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845664, "uuid": "c8e2bdce-52dc-4625-bfb7-52a6e1c05ec0", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845664, "uuid": "405c8848-2be5-4ed4-aeb0-c3b2c14910bc", "value": "98304:x4CvLUBsg2+CVzkHKOefDoizAg9JLgLu+9bY9lQgG/4Vl4kR:xlLUCg2+CVvO/uDHQt4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630845664, "uuid": "cb9f21de-71e5-4f37-9a50-5f56fb63b65b", "value": 4889954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630845664, "uuid": "3c9a29a5-ed7f-42b2-aebb-b6ff08902b5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845664, "uuid": "6821a2db-0648-4bf6-9266-4d9310c7bcfa", "value": "52B69CCF22EC2B5084FEE8F4EC9188ED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b1151b1-0e27-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1630832300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630832300, "uuid": "9fa571cc-cc75-41ed-b80b-a6132655fd4f", "comment": "Malware payload (RemcosRAT)", "value": "abfba442e79f018d9fcb7e0043fc30d5", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630832300, "uuid": "4c336fde-c30e-4762-90a4-853505c1673c", "comment": "Malware payload (RemcosRAT)", "value": "357691c2022acb6098640b927659878200109482ffcd7e38c62d578266b666d0", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630832300, "uuid": "b8a30b5b-b20a-4556-9fdb-c2ef499d6e6b", "comment": "Malware payload (RemcosRAT)", "value": "8702a260b1e4ac7c4d6f10f8b4dbddb9b568593a", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630832300, "uuid": "9da703ab-669f-4169-be25-4fa06140acea", "comment": "Malware payload (RemcosRAT)", "value": "77a37eaeb9ef6fbffa3d1b4a8a892e9887ad6210b0cb9fc77d85a02b81ec1dd199e6a83a064576b5491695cd968bab11", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630832300, "uuid": "233a93b5-dbac-4f5c-9d72-d727d24d8ad2", "value": "T13D557C15E7D1CCBEE0A528B45C6F63688C3CBD923A28545B1EE83D6C9F3E6E11714227", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630832300, "uuid": "4b9b17da-3dfa-437e-a431-90b96243e47d", "value": "12288:fEkuPF5S618CS6qkVdQOHvDc9aGKqa/ykXKQcj2SKI:fE/HS61uyswGKqXkzcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630832300, "uuid": "8bc252bc-e5cf-410e-aafd-1c070ee4c0d2", "value": 1376256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630832300, "uuid": "3cea2340-0184-4457-b222-ccbd44afdd8e", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630832300, "uuid": "343a73f3-a7da-4aa0-b54e-14c0cef1d10e", "value": "Attachment.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4205f05-0e2d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1630835053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835053, "uuid": "4616299f-680b-462c-9740-4ed836174aee", "comment": "Malware payload (RemcosRAT)", "value": "a9021ba136516cb2d4d0812994225ba3", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835053, "uuid": "78d85d4d-602a-4ef0-837f-128582127dc8", "comment": "Malware payload (RemcosRAT)", "value": "35f4374a535717f8aa78765591507d6361db9344cfc31ec0f8f7671ccd108b3e", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835053, "uuid": "2c8ac1cd-6ca4-48a7-a409-5f00083fd918", "comment": "Malware payload (RemcosRAT)", "value": "a31d47d3229277a34a23a26f0dd62c5ac9203875", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835053, "uuid": "a1d1ab63-4661-489e-9111-a9f5d956e8bf", "comment": "Malware payload (RemcosRAT)", "value": "1ea253501eb5748e8cb6f20cbc31a0d07946def09b47fc62db1c071a6a37eee414d2b2c23a882ca2aea471872f5aef4b", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835053, "uuid": "32e096cc-c457-4e30-9c95-75dafad882a1", "value": "T1B1F46C7BD6928CF2D0705ABEC81ED3C5681DFC853938CC0A65B02E671B725E978265E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835053, "uuid": "2f59fc52-704c-4349-88e2-1ed4c68310f8", "value": "4469230dadf10434edb28a90c2a5b8fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835053, "uuid": "cb7e5984-6b2f-4e65-8e13-c0ef2f40c855", "value": "12288:wyL+XIUEkt8A+CSspygap6vXD85pzM4ecXgi18IXY:jS4Tkt7gsHamDqpzMlcQiqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630835053, "uuid": "673c527f-ae7a-41f4-af4c-188bd5514b2c", "value": 750080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630835053, "uuid": "6e79ee9c-a0f5-4f60-8af8-0e49db497318", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835053, "uuid": "7938a8e9-ffd6-46a3-bea6-5ecbf988d375", "value": "DOCUMENT.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e5eb64-0e8b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630875347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630875347, "uuid": "80550c82-5e23-45dd-9125-4c17fd0d9c45", "comment": "Malware payload (RedLineStealer)", "value": "d352d3067454d63f0dded078ce5f50a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630875347, "uuid": "863cee2d-798c-4162-b069-a9c7411272a9", "comment": "Malware payload (RedLineStealer)", "value": "36747f754f3101e512feca73fd50a20b63f11619cf423431df13040b4d9bec23", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630875347, "uuid": "7d103c60-9283-4464-ab4f-791d47984ef8", "comment": "Malware payload (RedLineStealer)", "value": "1c469c00228dbab9dcb2b13450efe881a9d155fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630875347, "uuid": "52ad24fb-aa2b-45ef-a40c-470d56964670", "comment": "Malware payload (RedLineStealer)", "value": "146c22a0352eacf53a327ce0ec443b2ba95ea97fa20b62f6cd0b904f905fb1feab383c5313f8228e54d020978355a7b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630875347, "uuid": "c45730af-1a65-4d84-8735-c2f5e2ba1a5b", "value": "T1BBD4CA2865BFC019C4E7EAB12DDCA4BADD9A94E3600D763311B4633B8B15B84DE0F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630875347, "uuid": "81e0c5b0-a5ae-4117-9cb5-4ecafb2827c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630875347, "uuid": "4dfca80b-6f69-401e-aff3-3f6a82bcbce2", "value": "12288:O7oXGUC7b94xV/sRWQOD6orBjJGnVqdDaZhxTiUZWHAN/C8vifHuhAr:O7NtsIODBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630875347, "uuid": "9f258eb7-2038-4c3f-b42b-4f58efa0773d", "value": 636928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630875347, "uuid": "294a90b1-c054-4340-adf3-9676b56a35f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630875347, "uuid": "18f3fde8-9182-4084-b5e7-56db1a4b5746", "value": "d352d3067454d63f0dded078ce5f50a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21b4a837-0e26-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630831747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831747, "uuid": "986debb4-8238-46e9-888b-eb8f3bfeaff2", "comment": "Malware payload (Formbook)", "value": "4cb07ed8d27c0d11f47f908eadb0dec5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831747, "uuid": "b21f4112-bf42-4cbb-9f52-e8c34380baab", "comment": "Malware payload (Formbook)", "value": "372c848ae0f6c70042516b71bf8bad2fa6a12249b682da3c47c8171beaaabd08", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831747, "uuid": "be199fcd-30d5-45d7-b0ef-26f2ca5bcaac", "comment": "Malware payload (Formbook)", "value": "381e433054357abe35a22438c5d86deea133c953", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831747, "uuid": "01b16839-3807-4be3-adae-18537382bee5", "comment": "Malware payload (Formbook)", "value": "f3dfcae9b7a028ca47e3ed2ac94ff94684a06048ff62474654ccf1914f348efbdacd535385ee1043f4deba226ae0c657", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630831747, "uuid": "99d27f38-940c-420c-a43d-8a8689a2d92c", "value": "T1B0A423A2F4E96855C39258886DA5D2598EAF751127EBFD6BF3DD38906F0BCF820C10C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630831747, "uuid": "66586b34-0db4-4e0b-a6a8-f56446e5c07c", "value": "12288:7WIXfpAXPlDEg+2bCLRrA7D6xJZBLfhhk3Lz6P2D:77XfGfd3+2bCy+Vfj0WPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630831747, "uuid": "0a54eb88-31db-4b22-a76b-8518dfe6c683", "value": 452684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630831747, "uuid": "d92e8c06-2959-4cd7-b68a-8c70571a8f9e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630831747, "uuid": "19f055a3-2f06-47f2-996f-495ac24ed3dd", "value": "scan_quoatation_2021-9299928928872662772.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d0c8789-0e1d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630828089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630828089, "uuid": "9037751e-d309-4a96-bac7-e17b3b9999d3", "comment": "Malware payload (Formbook)", "value": "64bde8caa65e2494b4ec4e1a6e991f22", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630828089, "uuid": "698b5128-d6b5-411a-86fb-172caa696bf1", "comment": "Malware payload (Formbook)", "value": "3852be198d71c6f85aee3c72958388125676b6fdddc0f41e31792fd0f2f4c528", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630828089, "uuid": "72be2876-b857-4c16-b8d0-adbc7413549d", "comment": "Malware payload (Formbook)", "value": "3ffe8f3307dfabfb08a2555bf67e702f3759e066", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630828089, "uuid": "46f8b59b-2167-4fad-8ddb-32feed829da8", "comment": "Malware payload (Formbook)", "value": "c047f760c022e15960fda2f626c0637114540283f7019aa6e0e7b0d3bd8fb117b941a011e0aaf6831be3095583f3b6ac", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630828089, "uuid": "2e60c0a9-5560-45d3-bc6c-f136c12f9368", "value": "T1126423F00DFE685A375A4429362D3B24E48316CCADA4D6CBCC76593FD0E216E42C6D9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630828089, "uuid": "704e618a-b0d0-495a-a1f7-88a6599277ab", "value": "6144:c7UGHJb7iplcndWNYrJn0x3ouztS/vAV1GG0FQLD7Ft6S3BM9AibhGUGNS1T5Sc:4Jb7JndWNYrJnqLQvA2GB7FsSm9AEGUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630828089, "uuid": "b0bf7f52-7140-4e6c-a637-8d3e67f77aa7", "value": 318142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630828089, "uuid": "99d32770-a777-4a43-adbe-644c75ebead7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630828089, "uuid": "216ba9bc-7ca7-4f50-a6c1-4e368e2b5fad", "value": "Past Due.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9318f05-0e0a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Lucifer)", "timestamp": 1630820029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820029, "uuid": "f4ba1b3b-fc93-4ec4-806d-c0b6d721d302", "comment": "Malware payload (Lucifer)", "value": "4a4ebb3cf7b712d80b590bcb41b5f787", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820029, "uuid": "c9757424-cd3b-4885-a5bc-95a7ff057c51", "comment": "Malware payload (Lucifer)", "value": "3a0ee908b32a4b2e4eeeb79ddb1a7fa712ac6e0f0bfdaef07a68c6d941cca0e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820029, "uuid": "76e05dd9-8d8b-425e-a3b0-85f3f767758f", "comment": "Malware payload (Lucifer)", "value": "402d3d98be85ae2430571f6bd9125d6d2ca1f21b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820029, "uuid": "b66617e8-b922-49a7-a80a-b4c2fe256e8c", "comment": "Malware payload (Lucifer)", "value": "9782c23093af2b39c6a3490e04dbdc0db33b4e99b72c8b6fcdb723db6208ccf431f60c42d20f7b42b14b796a8a94c821", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630820029, "uuid": "c4ef0f6b-be86-4a28-99f6-669df8faeec1", "value": "T172D39E004E3E437CD6DC1130F0EE3C799AA91439130F5AAFEBE8166DF15A3980E5E65A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630820029, "uuid": "86cdfa98-cb50-4c73-ae44-a41f91bfc529", "value": "cbacb16336a297da0498d754fe4a3ef1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630820029, "uuid": "01530db5-fc0a-4364-ab81-752340ae7496", "value": "3072:ulic65cjOIt2uLnQpZfYBhLmNAh1k5eGFyNVMi1:uli+kuOfYhNDk5PFoH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630820029, "uuid": "83735cfc-5337-4396-b291-c8ddd26dd459", "value": 137216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630820029, "uuid": "138ce504-74b0-48b5-84dc-79d35b89dbc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630820029, "uuid": "5739321c-eddc-4787-8e15-c84c43f348b2", "value": "Reckless Hack 1.7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "424c3435-0e8e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1630876470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876470, "uuid": "9f5838a8-13c7-400d-a722-65feab2365c1", "comment": "Malware payload (NanoCore)", "value": "c1ccf7e2d0a7bd50075864220ed746a1", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876470, "uuid": "59062b31-9371-473c-883a-ff38bd8a033f", "comment": "Malware payload (NanoCore)", "value": "3a872c346d3603d12b21360244499c4854e4cf559b2247ed2c08104612484b43", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876470, "uuid": "e5941545-5397-4844-81d4-693648f7e014", "comment": "Malware payload (NanoCore)", "value": "e27a2e0b216b2a963a2c1e8b681ca2ef02a83f2d", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876470, "uuid": "c37c4727-c788-4d68-ad59-3d2472d50fef", "comment": "Malware payload (NanoCore)", "value": "25bae5aaab9bcd9074efc91f000171b0d4b20f7300bccd2d6c3d0f4e1809e6db5290f61cd843942c5aeb9d883c8041a9", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876470, "uuid": "248485bd-6fd9-4e11-b4c4-928ff3680b1f", "value": "T1E87562F1FE643ED80F6DB7C4123C3BE93C599A47A944E10A7EE506A074368B22FB5095", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876470, "uuid": "fceaa0c1-7b3e-4ebf-8ca2-ad47a3272f73", "value": "24576:+a/cKrXnrcFMXqdN9/8srv+ia5erV0Fwq:+KLr+MadLOia3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630876470, "uuid": "7ed8f927-2b99-49af-b15c-62072ee08d23", "value": 1580233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630876470, "uuid": "0f9bb1de-061b-4230-8f7d-5df87bddf9aa", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876470, "uuid": "74a27bc1-ed29-407c-bbdd-54de33e95ade", "value": "09052021_PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fdb9839-0e0f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630821973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821973, "uuid": "2ca35aec-edab-4943-8890-d8c3da63cf4e", "comment": "Malware payload (AgentTesla)", "value": "4b6f76cc22dd742131189052e544769e", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821973, "uuid": "845d40b2-987a-4bcf-8583-83c3450e3463", "comment": "Malware payload (AgentTesla)", "value": "3e9dab82e7ad127abe566e8a350d88bb749f6ba9cfbe9ca7fcde1787e2dc0b06", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821973, "uuid": "953b5655-d7a8-4446-b062-753aa5f35ece", "comment": "Malware payload (AgentTesla)", "value": "25111ef2259db92e9914965631ec92378dbde718", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821973, "uuid": "ec09ed4f-be01-4821-9b9e-3b54c21e6a79", "comment": "Malware payload (AgentTesla)", "value": "bc0a8174a411c1e22a0679e3dcb3b2a10c7e5be1039a0d8057c2e58cdf695f4d02bca02a3e4b1884b5d92244694de175", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821973, "uuid": "f490d461-8803-44be-a539-52e5f5b827df", "value": "T13EA423DC66617C13E045D6E818C106FAF4EFDBE905920A3591E96DB42CA42F3CABCB71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821973, "uuid": "c2c6d10a-3a6e-4147-9cf9-c004fec7f99c", "value": "12288:pg5xQ7BH8CUDPgKbivcOSCHbaq5Wio3bk/1HoARKp3QuEWaq:pg5yBcC6PgNvH+NA9IaKpgDWaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630821973, "uuid": "29c0730d-349c-42a4-a0e3-49c3e4b5024d", "value": 473606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630821973, "uuid": "52eef79f-f93c-4823-8b7a-32b7789df3b8", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821973, "uuid": "9ddaf966-0306-45f4-9ab2-8bae4cf5c0cb", "value": "E-Advice-Otward Remittance.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa81d6a6-0e0f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630822233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822233, "uuid": "00454087-94c4-4ddf-a382-56684b3f48a0", "comment": "Malware payload (RaccoonStealer)", "value": "9ad5b82c98ab551e2fcb6a70b4af8312", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822233, "uuid": "443fc931-ed42-4198-9141-2578be1f63ff", "comment": "Malware payload (RaccoonStealer)", "value": "3ed184e52a68f9d35f39ad89b44b4432f94fbf273c9f715c231c51c4c662c048", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822233, "uuid": "066362ca-16c7-49d9-8a98-6781e9599413", "comment": "Malware payload (RaccoonStealer)", "value": "b73b75f46a885c3d36812f8a008b8e0c38544de2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822233, "uuid": "27d88025-1cdd-4dc5-b92b-68686f58bf55", "comment": "Malware payload (RaccoonStealer)", "value": "b623c8ad093de3dc6aaef8221a5ea0b70c92568c6e458d24bb3eba152953662234c24b57ab4745a2eb3302acbcf1867e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822233, "uuid": "bf2a80ea-03e2-4565-868a-8d38cb51505c", "value": "T1B9B4E030BAA1C035F1B751F469BA83ADB93A7EB05B2081CF72D516EA5B346E49C30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822233, "uuid": "db5e1995-32c6-4863-b491-c8f9e0a1fcdf", "value": "400fbb4d0298c92dcf0f4177f613bae0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822233, "uuid": "b006744f-7821-4ec0-bdb3-8262d860193c", "value": "12288:ajZeDp2c4tGuMitUVmD+4VRHvlRjBis7EXf5b:KUFRq+Vy7RUs7EP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630822233, "uuid": "f6db9a1b-18e4-4150-949e-785c2e911b52", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630822233, "uuid": "27ff895e-cc6a-4cc0-94ff-bfeff6818ff4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822233, "uuid": "678becab-0460-4484-b3dd-9fdb8563d3b4", "value": "9ad5b82c98ab551e2fcb6a70b4af8312.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "926a749f-0e0d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630821199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821199, "uuid": "0bdfb1b1-06b3-4495-afb2-1e6e28483d28", "comment": "Malware payload (Formbook)", "value": "db762da6e399bc9afb3a9c0ef2861cf8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821199, "uuid": "176d635a-7458-45e5-80ec-80c21193b29e", "comment": "Malware payload (Formbook)", "value": "3f0e13b32ba40d6a8f58e08e79ec003e1cf8cc79946ecb0fda8a67233b2b5935", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821199, "uuid": "bdb13f15-5523-4169-bc44-23fa0c95e5ca", "comment": "Malware payload (Formbook)", "value": "d928f07b05fc6d29dd47e1fc1c4681b7bee63ce8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821199, "uuid": "30907220-1a81-4b88-bbaf-2b7f421a9839", "comment": "Malware payload (Formbook)", "value": "9e66dbea00215adff8168b6d1948b44c81d1f8e4d65994b4216e91a286c13f844503ded461e476b42707c73ba472ec5f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821199, "uuid": "66ed7d2d-a969-4c13-8d25-235fb543d2d4", "value": "T16F92D5ACC42706A88F456BF9AB37AE08018C3A6CF3959933367C573427D2D7A951783D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821199, "uuid": "d70453ab-36bf-4ac4-a793-758b3f0c3a7e", "value": "384:LeYXOp3hyvohA/KdzQC1jqI0a8Yp6FmU1Pn+S3pzfE:lXOpxSohACdz7p1wYSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630821199, "uuid": "8d58eac2-9c1a-43d3-99d6-4914205b60cc", "value": 20775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630821199, "uuid": "fbdcb5ee-d621-4304-bb30-f939f24bad3e", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821199, "uuid": "c30a4d91-fd5d-40cf-a460-fba9ebb20b7a", "value": "TTCOPY.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7259ba0e-0e69-11ec-8fa1-42010a9c0011", "comment": "Malware payload (QuasarRAT)", "timestamp": 1630860659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630860659, "uuid": "22858661-60f2-4890-9319-b00061d28253", "comment": "Malware payload (QuasarRAT)", "value": "b6c5e59a9f59dfd0b73d59671b691421", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630860659, "uuid": "839147dd-95b9-4231-b2a4-ff1e1b382503", "comment": "Malware payload (QuasarRAT)", "value": "3fb8ef0e57d3cbad82483cba016a1380698f2efca89d80d29d2cfab35b5c5cce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630860659, "uuid": "0f34dbf0-632f-421b-a7a9-212ae9cb4825", "comment": "Malware payload (QuasarRAT)", "value": "71b745e90a56697062984e2c3d96f83395a62d64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630860659, "uuid": "ae08819d-7bd4-4275-af13-df0224e44f77", "comment": "Malware payload (QuasarRAT)", "value": "d14db3afdd0fbbe22004d047ce9f0f35641c7e5180b276c40443123cff76364b4d39651c73ac91a59e4344037eb97921", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630860659, "uuid": "c7d329ff-8273-49a2-bdc5-a92f5df93965", "value": "T186B47C4023E8852BE2AF577AE8B11811ABF5E417B667EB8F4544A0EC3C66707CE41773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630860659, "uuid": "290534b2-d95c-4c43-922d-e65b5b83a487", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630860659, "uuid": "c46a3b92-935c-4255-b8cb-d0831d82b077", "value": "12288:VTEgdfYKxUEiq2HjzTpBYEUqZNhOkQ5Ja4UcdR:2UwOIjzTp/UqZN9cCcdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630860659, "uuid": "2ab583d9-17c0-4315-af0a-2eb160f03f21", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630860659, "uuid": "e5d1b8cc-d497-4cf6-89af-ac9c761fa777", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630860659, "uuid": "e1004b1b-a4eb-455c-b729-0ace89ebd2eb", "value": "B6C5E59A9F59DFD0B73D59671B691421.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd6eb4e4-0e12-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630823446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823446, "uuid": "0b0bb63f-7636-4bbd-9af7-f1feed65c8fa", "comment": "Malware payload (RaccoonStealer)", "value": "bb2b9a0c64519bdc4bd2bf4b91e4342a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823446, "uuid": "e5da803b-7164-407f-a197-74b013a08acd", "comment": "Malware payload (RaccoonStealer)", "value": "3fe70737f4c556e55f6ff23ebde2d84d9867059847105623d9414a57abfda632", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823446, "uuid": "2a93ee3b-4600-4b34-9688-68c3863785de", "comment": "Malware payload (RaccoonStealer)", "value": "51b3729e3f3d49c9b75a95d24458a1c8c22f85ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823446, "uuid": "0795704c-c28c-45b2-99ec-7869a7d6ba48", "comment": "Malware payload (RaccoonStealer)", "value": "aac622d4895612d8cae7894be6e54e1ba176baac05b59ad258a7c937a2d543df0471825064dee7887e5622e8cfa92cd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823446, "uuid": "73e809d3-f4c0-4c88-b51d-eee0f03158a5", "value": "T19F348D30B6A0C035F4F751F489BA83B9B8397E715B2490CB62D526EE56346E8DD3039B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823446, "uuid": "e54f486b-c696-4636-92fe-a5b3c0d4a0b3", "value": "400fbb4d0298c92dcf0f4177f613bae0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823446, "uuid": "c4d28bd2-520a-4319-99f7-2acc8e89143b", "value": "6144:wiL+FOyWAZ2oOKheDGBx4k53jtcglzat7tV:w8yWAZ2eheDGBz3jtRzat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823446, "uuid": "aed332d7-e805-4eaa-a90c-2fa3bd9948d8", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823446, "uuid": "6a08ff08-c160-450a-9b9d-7968dc2948b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823446, "uuid": "c23e558a-80da-4551-9ece-a6e54a90ae41", "value": "bb2b9a0c64519bdc4bd2bf4b91e4342a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ef18a7-0e26-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630831786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831786, "uuid": "082e84fb-55b6-48a6-89b8-2b599ecd7d9d", "comment": "Malware payload (Formbook)", "value": "73e0bc975224dbc2b1c418d84ebdb9ea", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831786, "uuid": "27adb08f-1814-445f-afd8-be8e79b697c2", "comment": "Malware payload (Formbook)", "value": "4005552337149df6f4af82533f284449e3890e91f69cfa4a88c9e8f1e78d25ea", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831786, "uuid": "388505b1-c84b-41bf-bcf4-a057d0b22fdf", "comment": "Malware payload (Formbook)", "value": "5ca2689b4e88dd96a0035c5c4bc4dc9a0e7285c6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831786, "uuid": "9158bdc3-ccba-4b76-8be2-5a95d7aea604", "comment": "Malware payload (Formbook)", "value": "a3aab62fb5b09ad985ea2869225e72168ae1917e7981d798e886769e6e57a2288ab56e09b2be56c90a13c41232538287", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630831786, "uuid": "39e1106d-1320-4154-b008-264ee4fb1afc", "value": "T16A8423AD0B3C329CA933C46FF358D1827ACD6DB98B163CA3BD418B50D2C96F4156B192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630831786, "uuid": "d723cb84-be57-44c7-ad77-9ff0cb3b0d89", "value": "6144:WCSmmClYwz4PuFzt92j1uZWp3w9PFD/RsQG3eNz77GvNHkmTI/WVDWl1W4UYBz7:UVCewMWFqj1uZceNNxz7eHc31DV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630831786, "uuid": "fc1dd82d-f585-4272-b8d3-885b1ae833a7", "value": 399234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630831786, "uuid": "9cb115b7-1b28-49f8-b8f0-3c5066a4ad87", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630831786, "uuid": "4691d7ea-bbec-46f7-b0de-c7828ca13ed7", "value": "OVERDUE(SOA).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d04137b-0e13-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630823660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823660, "uuid": "c19711e8-b04c-4734-a410-4f0ec65167ee", "comment": "Malware payload (Mirai)", "value": "14479db7b82e552d472e02f5b80a4a25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823660, "uuid": "5c0c7680-3f74-49ca-864f-4dbaafd2ac81", "comment": "Malware payload (Mirai)", "value": "40e1801584ec0ed2027bca1ac1716a6145c6c1f0aa424d36e1297e041d099d4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823660, "uuid": "350d1d83-d7c1-4274-bd51-b48592c70b9c", "comment": "Malware payload (Mirai)", "value": "c5d45d83fb6287383057ef14569ddfc3ea3539dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823660, "uuid": "f01d3505-db41-4e0d-82cf-2068438afbca", "comment": "Malware payload (Mirai)", "value": "e3c3a50bcd89eeee5c994189237103dd10342f533f0d146c981e22dc2c12683e0edc01788a0433bcc4d62435a8d9a629", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823660, "uuid": "ade66143-6149-4149-93e6-03036519efb8", "value": "T143334BC4F143D7F9D84900717036EF369B33F1FA226DD997D3995A33AC92602A506A8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823660, "uuid": "f170f349-8db4-4628-a1e5-dd4a03bcd67e", "value": "1536:vbxZ+QmM0P+IWFWidh8dsGbLMuW80iIBYF0x5L:dZ+QmBto9lvBuEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823660, "uuid": "9ffd7b16-f2f5-4a08-8a8e-124a9bbb7931", "value": 51508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823660, "uuid": "b2187b73-fb74-49ae-86ac-ee72bb2c9e05", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823660, "uuid": "0d062029-879b-496d-8f9c-923af18c15ae", "value": "14479db7b82e552d472e02f5b80a4a25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85ab3ad-0e2c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630834684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834684, "uuid": "3632bf8c-c502-47bc-9299-0581edb86cad", "comment": "Malware payload", "value": "344ee1ffbb6eb65823ca61cce857ef17", "object_relation": "md5", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834684, "uuid": "d29adb5c-2e5b-47ba-ab16-6e1d4bff30fb", "comment": "Malware payload", "value": "4123e989943c00a8ecd34877cb59bbef0fead5b63329c64dac8632bea3500c03", "object_relation": "sha256", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834684, "uuid": "fc45f2ec-f2e9-4980-bcc6-2711bac8e47c", "comment": "Malware payload", "value": "3aefb8164bfa6e75efd4c35cd25d550edc666272", "object_relation": "sha1", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834684, "uuid": "0c0b8030-cdc0-4001-b01b-20aa013a8f1b", "comment": "Malware payload", "value": "40efa4187a9b9d9331056231df7336be22f2d834e417f611839e6edb0fe4e5dd1308763438b50e874764dfc9ca2de9b1", "object_relation": "sha3-384", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834684, "uuid": "2b3dff64-c990-4285-b0dd-ba18fb7093fd", "value": "T1FA86291277FA8939F1FB6B70ADB852954A7FFD615F30C08F2254568D1A30AC09A34B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834684, "uuid": "470cec33-f1d1-43f1-95dc-e55dd6e4b38c", "value": "e2d28022f7d79baf4229614e32d8540d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834684, "uuid": "bd11d36c-12ff-4f8b-901d-3ad895624d37", "value": "98304:KsVXH2gbTfJi2plgyFsVXH2gbTfJi2plgyxsVXH2gbTfJi2plgy:KstH2g/JlJstH2g/JllstH2g/Jl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630834684, "uuid": "45248cbf-7e27-44db-b0e1-7e4220858fc8", "value": 8595282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630834684, "uuid": "46a7337d-aa67-4bda-938a-8012eba15dab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834684, "uuid": "d9364472-8cad-4c23-aa81-bf14c317b916", "value": "4123e989943c00a8ecd34877cb59bbef0fead5b63329c64dac8632bea3500c03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c725d8-0e2d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630834895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834895, "uuid": "060f2a4a-38e2-4ced-8a70-1fc246357a26", "comment": "Malware payload (AgentTesla)", "value": "888f30647bea60ec09cea56fdb97135c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834895, "uuid": "3ef6cdb7-d6af-4b4e-a841-45e2c945a369", "comment": "Malware payload (AgentTesla)", "value": "42936800094c2c6695e43e2e2aea3a9ef22501835b8907b9b553cd2846aa0d93", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834895, "uuid": "739a9a4f-0033-413c-8f9a-5aa645c3ccdb", "comment": "Malware payload (AgentTesla)", "value": "ee3dddc8bf082484236fc3d0bd962d98c63c2d4d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834895, "uuid": "3594cb92-641a-4e8b-b2f7-ced56e9dcd65", "comment": "Malware payload (AgentTesla)", "value": "7597c3661f630e2079d53cf6478fc725483b1dfa21f2d5e76c47c9c7e8d60d35d8261d709da40708a41ff07724bc7059", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834895, "uuid": "5a0c2309-1f39-40cf-8cd8-12d2bf71719b", "value": "T1199423A0CEA98B1A9761C6D54E3AD493EE0335654571F7D80C6AF03211BFD4E3228E6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834895, "uuid": "d7f09747-d3a7-4613-b05f-7491e083149c", "value": "12288:j8Onc+rm8ZKV25ScXfX/Zgy4POichgfLfXc957J:j8Oxm8mgvXyy4Psh+sP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630834895, "uuid": "fe18b71c-d2ff-4207-8a5d-809cef33dd19", "value": 436189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630834895, "uuid": "42bf4d98-14a6-4659-9fd9-ca5cf9e0e0b1", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834895, "uuid": "412c7cb1-5034-4afe-97c7-d4b7745b50d4", "value": "New_Order_PO#960780_MT_Quote-HD.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "186ce8ae-0e12-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630823142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823142, "uuid": "0af76353-dda7-4ed7-a362-8cf5a77d6b0a", "comment": "Malware payload (RaccoonStealer)", "value": "f8074a042d946f0290874b97f4b3d429", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823142, "uuid": "c408967f-dcd8-4442-bd46-649120b5c228", "comment": "Malware payload (RaccoonStealer)", "value": "42dbfa5efe80e105779d68ff235e542aea125899495f2c7feea11471531238fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823142, "uuid": "78407692-4cb6-4612-b150-db62b9d48aa0", "comment": "Malware payload (RaccoonStealer)", "value": "ad3cad138a45e8a297becd9c1229aef3f9a82284", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823142, "uuid": "a6370ec3-930f-4ece-8c45-b6e9d2753485", "comment": "Malware payload (RaccoonStealer)", "value": "eced15a8bffd9854508522655ca35b1ee1a59ae23996ad5f739bdc95ace4c0ea9f4cb05a10c76a711cc5beb928822e02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823142, "uuid": "290e3e63-d560-46b3-a52e-505042fdd8ed", "value": "T132349D1ABE91E463D1A1C6308425C7B4DE3DFCB51A64814F7778FF6B6E302805A2E366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823142, "uuid": "e4e09146-ff7e-4162-84d8-9c742bffafa2", "value": "f530acf7acd4a5c8880ba2a4704d4cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823142, "uuid": "9a0a182e-db8b-42bf-861c-f86ff714f907", "value": "3072:zcILXfL7kD2CLGbewUDwpdW5C7d683Tm7uySP3/sj9K733E4RnHHx4bCvHOS:zjLDoD2exWDauBsj9s3VnWCfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823142, "uuid": "050ca461-8c1f-4a1e-9020-b7db0b869737", "value": 241152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823142, "uuid": "261b7d2d-5fa5-4000-bcc0-913ff01c82c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823142, "uuid": "b56cb2b5-e15f-4a14-a688-4c775bd9d7da", "value": "f8074a042d946f0290874b97f4b3d429.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad7088e-0e27-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630832139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630832139, "uuid": "404a0ce7-bdd1-4497-8c16-b93ebd4d553c", "comment": "Malware payload (RaccoonStealer)", "value": "1d0bd55c66ac9eb273f4017230d45bd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630832139, "uuid": "b6f9e7e1-9bb3-45cf-b549-15965ea12c57", "comment": "Malware payload (RaccoonStealer)", "value": "435025a3a84b8da4ccab5d7fd59de3f2c4f58b11db8e11adcfee10c99f491d63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630832139, "uuid": "b3ee2247-5789-4a19-8ed8-9b1848ff3e3c", "comment": "Malware payload (RaccoonStealer)", "value": "c8607d9a05e37f7eddb6a2660173b3127dae88f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630832139, "uuid": "6dfafc91-cae7-4fe8-8641-be61e33d0089", "comment": "Malware payload (RaccoonStealer)", "value": "caf20afe83e121c9a64b80b384ab362e8c168fb84fa8d1dbaea968ac5aeb844f89ba59ab172568eb48d6d1270f91a4bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630832139, "uuid": "a1fbe5da-917f-4b8d-8f87-7d4e59ad3241", "value": "T115B4011E7E61E433C5A6C6700825C7F4EF3EBC6219A0814F7684FB6AAE702D0653D766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630832139, "uuid": "91c48706-271b-4e3b-8598-dd038e2b4200", "value": "f530acf7acd4a5c8880ba2a4704d4cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630832139, "uuid": "cc684f90-4407-4129-88f8-2e8719680aa2", "value": "12288:F6xbODRkWS+dzdcBygQ8C/jKr/eStlNDkjEonf:0OSWxdeEPjknmnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630832139, "uuid": "7278ae60-b2ae-4085-ba19-2d1014c0666e", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630832139, "uuid": "7e4302fe-db5b-46f5-939a-71d026fb5c18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630832139, "uuid": "fc704b84-4ca1-48e3-ac52-8a3823dd7c2b", "value": "435025a3a84b8da4ccab5d7fd59de3f2c4f58b11db8e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f80ece7-0e2c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630834401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834401, "uuid": "0a7c6130-5e57-4ab2-b21b-2fe75f834833", "comment": "Malware payload (RaccoonStealer)", "value": "e6bd29ebbff7f61c31e43703ea84f013", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834401, "uuid": "8631d69f-fe39-4d19-ada9-ec02f7285bc9", "comment": "Malware payload (RaccoonStealer)", "value": "43c1845bb2ce2c59575a8a04bec910716232d59aa3022c1a489079fd46ce93ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834401, "uuid": "64a04ae7-7969-4b96-b6e0-765c550b6234", "comment": "Malware payload (RaccoonStealer)", "value": "809e80a64f580343c1530c89f4476068dc65c4eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834401, "uuid": "630252f8-87b3-438e-abaf-de9ecf0e13c3", "comment": "Malware payload (RaccoonStealer)", "value": "ef24356560972e24fbff0123886e4522501b99d07f5de1f18a5fa42cc2f889b4972fa6b58480ded28c0edcf7cdfd1df7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834401, "uuid": "02b2320a-4fb5-4791-8eaa-c00174197346", "value": "T186D4AC92AE00D021FDB8067040D6892512E39DC7E8E5EE0F254E77FA6B71E9E5F06E1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834401, "uuid": "a934945e-95d8-45bf-9f36-7e319a93d77a", "value": "caa5e6a2892587c2324418efee31c648", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834401, "uuid": "66d8b90a-1c81-4ef4-a0bf-8f126511235e", "value": "6144:erb/itFCWlItHUvApF2RFj9IU2VTvPZCBiBBbCQSoWd0ME6BBsWq1FfIUTVZOYp2:I7iuUvUF2JIU2VbPwiBlCOkkAU5Z7Q99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630834401, "uuid": "153a6e46-415e-4da2-b573-009153289fa9", "value": 612768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630834401, "uuid": "07f5e42b-198d-49d1-b497-f6bb5f023adf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834401, "uuid": "6b0e3c76-68b4-44b3-a134-e6eb8cc34218", "value": "e6bd29ebbff7f61c31e43703ea84f013", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d2aac60-0e28-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1630832706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630832706, "uuid": "cee1d878-13de-4b81-a0e7-a20153a3caed", "comment": "Malware payload (NanoCore)", "value": "6aea5c6feabadf7a5f56f2466fd52ae6", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630832706, "uuid": "118e4fe4-da57-4275-ac2a-329039939891", "comment": "Malware payload (NanoCore)", "value": "43f8d77087d97005dadf8c46380dcbebde125c4472045bc5d5c19f50da112424", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630832706, "uuid": "ae46b822-e751-4834-9e08-4c1dfe2da015", "comment": "Malware payload (NanoCore)", "value": "45f8219420b1195c5f8f23bca93be404532bae5a", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630832706, "uuid": "48e56833-5333-475e-af44-7b6563fac397", "comment": "Malware payload (NanoCore)", "value": "2181462c3debdbe5905a3ab4858db7ea5df04c5eed2be70bbce9e06cd243aab189fb57e91b6ff647449143fdb4897f3c", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630832706, "uuid": "d0ba4d67-841c-48a4-b490-ca6996b0b2a7", "value": "T1B5A423F6CA02190933930874460C434335492CCD6664DAEEED476B99E1FC6EB36BA5EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630832706, "uuid": "83fce535-9d10-4caf-9d86-c0e180c299ea", "value": "12288:Dv89DqQ3Lp5LkXsv/r9qOMTAIV2w9Q0kuA:r8sAaXsvTVMvMw9QnuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630832706, "uuid": "db572eb9-f262-4e26-93cd-3bb8243956aa", "value": 455542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630832706, "uuid": "3294048d-f590-4490-be9f-fda19ed0903c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630832706, "uuid": "1537f5ee-359b-445e-be33-bdc57f2b7e9a", "value": "SWIFT.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ebe4cd2-0e33-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630837541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837541, "uuid": "a1206a4a-2161-4a8f-9682-372cdac44b99", "comment": "Malware payload (RaccoonStealer)", "value": "0bad20da98d5c3daa47909d1a0779df4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837541, "uuid": "e2128aef-798c-4a92-a5b8-f3e884ab6b5c", "comment": "Malware payload (RaccoonStealer)", "value": "4468428f16aeb36c8c1a53f40c68806473201d37d94b6ac8f1c0d324d1e17006", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837541, "uuid": "6e48ebe0-bf87-4c03-a333-9e495861b6b0", "comment": "Malware payload (RaccoonStealer)", "value": "db2446d526fdeee60bc504b7733f4330791035ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837541, "uuid": "c15502d5-f839-415f-901e-4509fc1c98be", "comment": "Malware payload (RaccoonStealer)", "value": "b039a40ec7ad8430f7247b9ef70f2fe1d266466b45fdfc3bb19087753321960b1b56dc57f62ec19fe5aa8cf838717ab7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837541, "uuid": "1fc2ca5e-1f7a-4e6e-b43d-cfd1cf018fad", "value": "T1CB2633047ACDD4BBE9901279D5540E71A875C3B40A344E877322860DBF7C8EAE5BDE2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837541, "uuid": "efc04f91-abce-45ca-91ea-309643d77e2f", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837541, "uuid": "99903355-53b7-4fec-89db-959bc4b504c4", "value": "98304:xPCvLUBsg8kB3VlQ/iPpnD5pnretnLz/uBlfRKaVWYezJB6:x8LUCg8Y/QkFuqD8aVWLz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837541, "uuid": "86f77e7f-96c4-441a-8be8-5037ea2fe543", "value": 4836273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837541, "uuid": "2c78ad4b-f30b-4fc5-8c4f-081ca7ae3dea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837541, "uuid": "e41e4c4b-e57d-4859-92b5-a5459dcf19cf", "value": "0BAD20DA98D5C3DAA47909D1A0779DF4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13124faf-0e33-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630837306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837306, "uuid": "79e424a6-5d09-4600-9012-35701c80ebe1", "comment": "Malware payload", "value": "55ca5d5132b0685f38c02972c5851f06", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837306, "uuid": "38f43bf9-91a7-4b49-87c2-59859b3d7adf", "comment": "Malware payload", "value": "44782fb4eae4e74f734147eb6326b0ed4834552def2ac3b8272c089999de6b34", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837306, "uuid": "23e0af71-fc58-4b41-a217-8a2ab8a69f44", "comment": "Malware payload", "value": "5c5b0d99bb79fbbb5565c09eaef8325321bbf86d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837306, "uuid": "5d1acf37-72c1-43f6-a8cf-47193a1e75ad", "comment": "Malware payload", "value": "888f2190a60f7a923f0ac4bdd34bcc3602d62eaa43ffdf5e950732cc02569dabbe916c9502f7ff1605789ea24413bdd3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837306, "uuid": "91f065a3-b707-4a33-8496-5b193285c83d", "value": "T10594AE50FA4011660EC313979C1262E2FE3CD511975021A9E99E939C6B476ECC3BFBBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837306, "uuid": "055d25af-d60e-4576-ad7d-0890540c7df9", "value": "6144:/jIHztTJG8axogyOBT8AEMdTSNsafwqmrwkOBFat5zLdoITc3AFLM6Mwanr4eU7b:LmpTU2O+AEMROsxkkO8QQm6IAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837306, "uuid": "242d9728-627e-400f-825c-ac570787dc1a", "value": 441783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837306, "uuid": "5eefd588-24a1-41be-8b13-5b8ee2f589ed", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837306, "uuid": "3ff42881-6710-4694-b982-1aeaa5c14f25", "value": "5445.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34fe2425-0e8e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1630876447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876447, "uuid": "910ea55a-db07-452d-8282-3356829649db", "comment": "Malware payload (AsyncRAT)", "value": "4d8ef54a5c203ea1d8d2fb7aa3effe4e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876447, "uuid": "8ad67244-8e26-4646-bcda-fa86dbc417fd", "comment": "Malware payload (AsyncRAT)", "value": "4695d368edd8c9b4e636a003f60efa5a9f671b55839b3938e6cb4bda6eec7594", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876447, "uuid": "26b12753-9879-40fd-92fb-4f06fa8adcc9", "comment": "Malware payload (AsyncRAT)", "value": "dcf883f365a1227406d85ed4abd66ee8b40ce356", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876447, "uuid": "5af77655-6782-45c0-99d1-00031aaaf996", "comment": "Malware payload (AsyncRAT)", "value": "276ad95e6645e2f83826268434254484b97df3c4cc0af44d4303d72681703b181be619411ffea4e56ba91305ea0e5118", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876447, "uuid": "d88be81f-6b18-4fc9-85a4-9c0c91cb3c9e", "value": "T16AF02345C5DFFD35498BB2AB94CB8841F93C014213E06547303AE185D07E1B8D6D92D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876447, "uuid": "6ea1b9bc-57dd-49e1-ba5f-ce3cf060a35d", "value": "12:UcoQY8bUFe6Ci9o0ggd3pm9iV5R9Gg2IIxmZ9y5H59gxl8o6R9GguqQcAb:U3Be6Ci9ol2EUMg2IIxmZcFgxOoeMg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630876447, "uuid": "6ff1a5b4-8eae-43df-90a3-046a801bed29", "value": 644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630876447, "uuid": "3711eb62-adaa-45a1-9187-e8444d6b2fa8", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876447, "uuid": "984ff372-42bb-4689-9cea-17e3e562f5b6", "value": "BJJKIKGTUZZSWC_(9-5-2021).xlsx.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc506532-0e8e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630876674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876674, "uuid": "ebab6db0-d567-4fb3-bb5e-4848bb0b7e52", "comment": "Malware payload", "value": "24d31ce120e3740d10f7335a55504b2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876674, "uuid": "f98e9f88-1aa2-4830-8740-b3ea30b7c83b", "comment": "Malware payload", "value": "486658750c2204bf7924086f67e9228d7d604deae84dfc5caaa66ea7d2222179", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876674, "uuid": "d112f861-2d87-4295-a062-2edc41b7131c", "comment": "Malware payload", "value": "820270029109394983d9d3d1b2c1d54ef648fb0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876674, "uuid": "eb61576b-494f-41f2-95d2-76c418a3dc78", "comment": "Malware payload", "value": "0fd54aa97bde87f69fcadd3b4e5ebfc555d8ac5e305518fa0078372600d808d83598c98ed210cf0a1a12f16a698ba8bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876674, "uuid": "96843b25-7e2c-4e6a-bf1a-22055aabe622", "value": "T13AA52361AAA1C2D5D217E63E116A892AE50370677C6EF56A730F38D00F527913C4F2BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876674, "uuid": "411015fe-32ad-4bc3-afb6-209ccff6d04e", "value": "4f0265512a1363fc11fe0c410b950baf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876674, "uuid": "ee691707-f167-4fa9-a11e-1a50f9d9fa49", "value": "49152:VLe9+2YUKl9RSn8CEtKfxWcHPrAu/GiSH2Zn+08HH/XtjY:VL6EKn8CHPTc2x+pHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630876674, "uuid": "d7ce378d-61ff-4b5a-9399-e0609aee8375", "value": 2071552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630876674, "uuid": "df5db959-ed86-4900-b613-0481cfcc9914", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876674, "uuid": "ff364e34-e5c5-4a54-9379-e590ab82c881", "value": "24d31ce120e3740d10f7335a55504b2d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd543d7-0e30-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630836328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836328, "uuid": "89f8429f-3912-4d1b-9bbb-0a9065eab2c2", "comment": "Malware payload (AgentTesla)", "value": "96ca7da31f8216b55fdaaca60d4ea9fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836328, "uuid": "6e0b5a0d-4d8e-47b4-a164-bb6094b638f2", "comment": "Malware payload (AgentTesla)", "value": "48c640b045adffb05f010f8bc5806763deb19fb08922908cbace3c6461872d63", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836328, "uuid": "53a64497-cc09-4e3c-b7d4-15981d740339", "comment": "Malware payload (AgentTesla)", "value": "83c4079a6b61533e72466cbba2379f9c61c80fb0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836328, "uuid": "b35b901e-95f6-4746-b458-221cfcd01396", "comment": "Malware payload (AgentTesla)", "value": "3437ce879cd3a5b3b45850da96213df70a8096ff0d9dfccd94b7d04b3e58d69ea9c71b8bfebc466a2d728c8e813f2876", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836328, "uuid": "eda0954a-50d0-4747-881e-360533e5d4e4", "value": "T1AC94232BB3096F6A8B8DF5B4BBF84B735047217A7515FC22E38A8801D57E967014329F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836328, "uuid": "0ba8b48d-c7ad-4a36-81eb-bfa8bf337941", "value": "12288:meLfKbsozGl5fBXgKYkAFwmiLsDEKcm0+djBLzs10ZSK:mkfdoK5fNYkWwmiLiHdj0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630836328, "uuid": "a216aded-f065-4f6f-ad06-87ef324e127f", "value": 438949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630836328, "uuid": "41bc046c-982f-4a81-b093-096c629fe2a3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836328, "uuid": "50f3121b-e461-42cf-bf34-6e19df64e048", "value": "TT MT103_copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51012d4a-0e1b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630827102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827102, "uuid": "d6799e99-790f-4b32-93bc-954d217de46e", "comment": "Malware payload (Buran)", "value": "192d054c18eb592e85ebf6de4334fa4d", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827102, "uuid": "ae2e1b9f-d251-4bbe-8d06-c750e1e972b6", "comment": "Malware payload (Buran)", "value": "49b82df4aa09a6d940d5ce77b59eee993521064ce50d7a3f9b4e6caa05e7f30e", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827102, "uuid": "6c617c9d-b008-4e41-bf1f-de0b3b589f90", "comment": "Malware payload (Buran)", "value": "7b8affc4f4e4bbad08d6ae2d11d025ae657f90ce", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827102, "uuid": "1756a023-aa51-487d-aae0-f412e7dd1b45", "comment": "Malware payload (Buran)", "value": "5abb1838d8851802aa8bcd9dcfe0a3bdd26d386a02dba446d037fe34486fe27428f2f2142510d06342496d4e2cd6c560", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630827102, "uuid": "12325116-3d60-4ea5-b90d-c70697470dc3", "value": "T1E774BF50EA8420DA0E82636BED5751D1FA3DD10053402168ED9F93AC7B479ACD37BBBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630827102, "uuid": "7079ba0f-8d8d-46de-9f96-a4bd11396982", "value": "6144:+BrOF3cQnXasJqUBbCxx6hhe5niBX3jGmtjvzrnhKV64NN4q6gLb0wXt/0D9:siFNX53a6hhkncnjHtYVX7b0wXt8D9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630827102, "uuid": "793c9846-4bc3-4f34-a41c-0585141c2fce", "value": 362703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630827102, "uuid": "a12fce05-7120-4cd9-a946-b073bb8e5f78", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630827102, "uuid": "b5ab0080-e50d-4003-9461-3ed88403cf1e", "value": "4014.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3267079c-0e33-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630837359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837359, "uuid": "74fa5275-65ff-47f4-964c-225dac7c5aea", "comment": "Malware payload", "value": "045a325882241e1f1700040e0a13792f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837359, "uuid": "199c85c0-2e1d-4187-910e-8a6ab50aa6ba", "comment": "Malware payload", "value": "4ac021eb40a65c8e86f3d7c20d2a657abc8e835e6987045444d81931036ee8c7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837359, "uuid": "1bfdba24-c60f-4fd1-9396-564d165da6cf", "comment": "Malware payload", "value": "709a622ee95f4c9182c7f0727f68a11f15a98ef6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837359, "uuid": "5a38cfca-11fa-40f9-8c6b-318901cf5d1f", "comment": "Malware payload", "value": "b99eea5eaca3eface234ee7abe9d917b674052cc8722237d7016040b83537981b8da56dea453b17f461e025124f04d96", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837359, "uuid": "99783eb9-b713-47ac-8ed5-e797124a9456", "value": "T1DAB4CF50FA4411664EC3639BAC1222D2F93CC111935121A9E5DE939C6B476ECC3BFBBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837359, "uuid": "38bd72d8-ac21-4b4f-9342-dc4b94c89af2", "value": "6144:0kOBFat5z88I0oxEybcddproc8Ebu0+axtQSkF38PN7f6RfTWxdtZw5tKSwgTvOa:0kOD8Vbu0+qtZgLCK4qToWqcNOlOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837359, "uuid": "06aa9f28-ef3b-4c78-aed7-117572f08ee5", "value": 517912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837359, "uuid": "d6990957-a4fa-428a-a8de-3b6159c3f006", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837359, "uuid": "5cbd9e82-0e1a-426b-aeab-33bc2e3bbc84", "value": "4558.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1223816-0e44-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630844927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630844927, "uuid": "b8a6a751-fb5e-4c7c-a2f5-488fb7c5219c", "comment": "Malware payload (Mirai)", "value": "7f6403d6eb1e941b3b50972f5363beb9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630844927, "uuid": "a5eb2e5d-e9b6-44a1-82f3-d368b26b6bdd", "comment": "Malware payload (Mirai)", "value": "4bb187e2a539eddb7a5022084068caf33419ed703cd1e284b2a518081cda0e5e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630844927, "uuid": "b3f2bde3-4813-427a-b305-c6e052ba1672", "comment": "Malware payload (Mirai)", "value": "9fa8c1b6228790d948e00f1fb88d095353aad70d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630844927, "uuid": "08c18918-211d-4757-bec0-b751aaeba58c", "comment": "Malware payload (Mirai)", "value": "54b6a341ad08ec9225f87ad1a7da2507a83b508c81449b36ef352ff86cd815f479f3a4f1d0105e86929ab4f91068d84d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630844927, "uuid": "56a6c0a6-acb3-43b3-b6e7-95da0484d861", "value": "T10C33E840BD829A07CAC8437BFA4E538C372573C8E3DE7217DD266F51B7CAA1B095A461", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630844927, "uuid": "9ec49768-ea88-4d26-829d-41bd342a792e", "value": "1536:shHJC+UkpBqQFOr6mUPwfaZDJga8ZJ8ZwbZn:shHJ1UVwOrMPDZDR8ZJYwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630844927, "uuid": "e9461922-24a0-4853-b422-9284430346cd", "value": 52380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630844927, "uuid": "fc6a15c9-7d64-4146-8b87-5de5ebef1e9f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630844927, "uuid": "f401b543-e5d6-47dc-8a62-299c32379c47", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ce2489-0df4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1630810328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810328, "uuid": "b09fa3b2-3ad5-4589-98bf-44f3bcb67cb4", "comment": "Malware payload (Gafgyt)", "value": "935c923f417536743f4798c96ac2e6b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810328, "uuid": "6b410dd9-53f9-4c5e-9ca6-3df4271629c7", "comment": "Malware payload (Gafgyt)", "value": "4bdfc3b2b7f30c80e0c54de7414fe2443f4bc54be9e0077013530e29fef34566", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810328, "uuid": "38923401-9324-48c1-9262-42b37b33cdcf", "comment": "Malware payload (Gafgyt)", "value": "c57d0bc6b797bd3e2b9110335029c05b67c23493", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810328, "uuid": "7af837b6-7e6d-4ef6-beab-39df1c9cbc1f", "comment": "Malware payload (Gafgyt)", "value": "c8ce27126234e87016e20b35abd8b17331ba014231aea79d3a44625eb5b2c67aa8eb732a7703dff7b27ff398622fd909", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810328, "uuid": "ceb4ba0f-5fa4-47a2-97b9-ca48e7429ff6", "value": "T15CB30831A740D972D14301F212A7DF260C32FEBB1A6E9A5AE7687CB0DE36085B561F5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810328, "uuid": "19688b72-be0f-4258-bca2-a5bf8fd8961d", "value": "3072:/aCt7tRUUReZqHsP/jQb0dxn/dyc7dAmmRjcqn0GnDdT:/aCKWeZ0asYn/scBAmmRjcqn0GnDdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630810328, "uuid": "94fa0660-4e0a-4165-99bb-e27508959e3a", "value": 108380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630810328, "uuid": "1e229530-0756-4cb5-9cbe-bc779c6c93f6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810328, "uuid": "9bf78a38-6f01-47a6-b4c6-53979ec78a07", "value": "935c923f417536743f4798c96ac2e6b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91fdc1b0-0e68-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1630860283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630860283, "uuid": "89c08f47-c6b2-404c-b86d-dfb8df1c7c17", "comment": "Malware payload (Cerberus)", "value": "db95cef0f183283e50a32c00e43a9fe7", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630860283, "uuid": "b5bf45d5-77b1-4bbb-8e7f-6d424e81bc5b", "comment": "Malware payload (Cerberus)", "value": "4c92f96a9d95836b0e6c9d0cd871f694625ef5c83ce2d6b38c8fead22ccdd405", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630860283, "uuid": "6d9dd252-979f-4873-a592-9839ea5b19f0", "comment": "Malware payload (Cerberus)", "value": "bcb82aa2a4b15d2bd144a80809078aa13af6d80c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630860283, "uuid": "7a75a5b9-96e7-4a86-9573-5b966f41d360", "comment": "Malware payload (Cerberus)", "value": "9bc131a55ae6ebfc9d0b25241499dbcc0ab965578449c10710d7d13bad501c8968d6607ecd25108f986436823e672e64", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630860283, "uuid": "42f4b789-6c42-4b1b-86f6-ae9ce415f957", "value": "T102F5339AD743C969E05381B2C50730E71A7A208C67D9407F4B3A8A565CE7F2DCF2ADD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630860283, "uuid": "443b3827-85ac-45c3-95ba-2d6ef93474d0", "value": "49152:56B43DV+P49B9HAFS+VPEjuzhgRQ8FH0YCLwf253KpiI3JuoQw4VAkNcUL:WPgBKSqN6lzCc+5wxuo4AIcUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630860283, "uuid": "101a119e-e7dd-44e6-999c-34ec1cbfed59", "value": 3412436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630860283, "uuid": "b37a0118-d11d-4255-9957-beb83c18abaa", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630860283, "uuid": "ef1bf11e-b105-4571-b642-bcbe84334722", "value": "Yerli_Gizli_Cekim_Ifsa_Videolar.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca11ead0-0e12-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630823440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823440, "uuid": "2306a164-cbf2-4073-b308-1ce04c2d2fa6", "comment": "Malware payload (RaccoonStealer)", "value": "b109da0a86b4075cc43637f326d87c87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823440, "uuid": "76ff73dd-8514-41f8-b97f-5657698cee3c", "comment": "Malware payload (RaccoonStealer)", "value": "4dd3b8c14d77c4099c86f0fe88a0e58995f45da816eeb36845b1192b91c48e66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823440, "uuid": "af505a66-93fe-497e-886d-5fc9961987cd", "comment": "Malware payload (RaccoonStealer)", "value": "8ad048d878fade106a9b81e806f6d04718a680d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823440, "uuid": "b0d67b29-02f5-447a-97fb-2171f75a762b", "comment": "Malware payload (RaccoonStealer)", "value": "547c8bd8e2d0d14acff6c307ed2abf2d7863ea76df497cb5b8b78dcbe91ba94b0ea4cb2315a6c94f77445a6f0ad119aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823440, "uuid": "e966f25f-e7f7-42b0-8410-b2ae8b540fbb", "value": "T17D34AE1A7E90E833D6A5C2704425CBF4DE3DFC792A24459B7758FBAF2E30280552E366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823440, "uuid": "6ad89c0c-e19c-411e-9e0c-f9c417bd7270", "value": "f530acf7acd4a5c8880ba2a4704d4cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823440, "uuid": "de133c5c-f045-40ac-95a2-a4776be3f4e1", "value": "3072:aMoL3vb7EV3HcORQ5jZ683Tm7uySP3/sj9KTIDuHHx4bCvHOS:aTLDolcXDauBsj9wmyWCfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823440, "uuid": "37222736-e5dd-4be4-8f57-43e724864cc8", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823440, "uuid": "1bb7d67e-c913-48ba-9e68-253d4ca11694", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823440, "uuid": "a28064cd-9672-404f-8cc9-aaf9b62487d1", "value": "4dd3b8c14d77c4099c86f0fe88a0e58995f45da816eeb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb5e532f-0e13-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630823925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823925, "uuid": "ca056eb5-205b-468c-87ae-aaa6db84c17f", "comment": "Malware payload (Mirai)", "value": "0bf3ad65a66595ddf2a8cd1bfc9293b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823925, "uuid": "631ef24c-f154-4fcb-a450-75244692e52a", "comment": "Malware payload (Mirai)", "value": "4e34786a98300bcfe13b31bc79c9d891bbbed41b916207759c43f6740aaef946", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823925, "uuid": "2a83400d-ee86-4501-95af-03503aa07b45", "comment": "Malware payload (Mirai)", "value": "3e1df9d896a03c49f70233f2faa48ebd981fd370", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823925, "uuid": "575798fb-a9f8-4f0d-93d9-4a04cf866abe", "comment": "Malware payload (Mirai)", "value": "547b0cdd4ce57d2d7f25dc7923702eac43011e957416a244051739f97b39fe2173f42cc7b54e82ff3c768aa96420a18b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823925, "uuid": "707bda36-112a-4e40-aee6-adb6ed63c93a", "value": "T172232A96F8829B2AC5D0227AF57E995C3764A7E4D3CF3227CC601B207A8650F1E63F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823925, "uuid": "548b20d5-5c3f-44b7-a180-25a93e7c2f47", "value": "768:FGg7wgy62tyWWEUgpdYNlciq5HtfA/iEQwHpYPf+Qsk041JpXJxhoajXzZY10U05:326EUgdYNlGS/iE5Hpwj5RjDa10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823925, "uuid": "49b451e2-9289-4cfa-901e-28443afd3964", "value": 47728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823925, "uuid": "db6cecd8-ae21-49aa-9723-2bc83e36807e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823925, "uuid": "e01e4d2a-9208-4548-8860-7f2b8535b38d", "value": "0bf3ad65a66595ddf2a8cd1bfc9293b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c0759ac-0e33-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630837429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837429, "uuid": "56f91a40-c307-4206-9a59-cea9e611f16d", "comment": "Malware payload", "value": "64cf396f7c08cf4569b759a113daa748", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837429, "uuid": "2d5156ab-0f7c-4871-ac2c-2a4d957021b1", "comment": "Malware payload", "value": "4f7f14b3a4cf415a0a7fba795456272e260a5321c7a897cf0c1b7be48861983b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837429, "uuid": "22530706-c679-46ac-9443-4d0ba1f512ce", "comment": "Malware payload", "value": "5842220284d7ada6748943542b03d64debcfd36f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837429, "uuid": "c49126b8-7239-4ab6-b9cf-f7ddff082f10", "comment": "Malware payload", "value": "f63c1fe7007d3c6a1c5bba8cac0c7a35d8e715b776437cd2148efc403a3310196b4fc7b4c433d9ab2148b776a939d0a0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837429, "uuid": "cfc24cd2-a196-4e90-aa48-e8205e556d49", "value": "T158A4CF50FB4421560ED3639B9C0262E2FA3CC150534121A5E99D939C6B976ECC3BFBBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837429, "uuid": "63344d8b-48c9-4eaf-a7d7-e053c6657cb7", "value": "6144:0kOBFat5zERWnWvgVTOnIuwrw+jp7ibs830a5QzUl0L8wpOBpFBxiJx5Mk8jNG9:0kO7CLynIrk+tNLENwp0qlMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837429, "uuid": "d9dfffc3-4f3e-4092-a5df-2e9428711e07", "value": 477225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837429, "uuid": "da28a487-8987-4ec9-a68e-4570124a6e35", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837429, "uuid": "00b76f5d-9573-486e-b97a-8b059e2b33bd", "value": "1161.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa10f3ee-0e19-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630826393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826393, "uuid": "a6614115-a358-451b-b3fd-ec01d4c6f32f", "comment": "Malware payload", "value": "e175ae0a266917e5a0dd4e464dd47a7d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826393, "uuid": "e53592c7-701d-4535-b106-949c227755bc", "comment": "Malware payload", "value": "4fdf6820cf5f482c0638e168284e61e75c46c3bbc5064eeda8f0cfcab32367c7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826393, "uuid": "2ee1a458-f8a7-4c27-a53f-cfa454b69ee2", "comment": "Malware payload", "value": "d871e37c83814521a86856f70c0ae4ce51ce51fc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826393, "uuid": "85ed819a-3e15-4232-9df3-c3b8f8f674d7", "comment": "Malware payload", "value": "e5f6d150ce2c8e4a4d1b85fd6928788e649a91787584cdad2c0c812630da85a49032ba878492133f7e5b270fd21fdd82", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826393, "uuid": "a750bdc5-1a80-4fb2-865a-c4e3bdaeef4a", "value": "T1DE44AE50F78830DA0A8223ABEE5351C1F67DD50052401169E99FA3BC6B539ECD37AB7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826393, "uuid": "caf706ee-bd92-4aac-b9d5-d5da3491c600", "value": "6144:0Xt/0DoSR47e3YQKI/7EtIThCJebeSQiV9aVB:0Xt8Dfa7eHCITSeSSQsED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826393, "uuid": "f279e1ed-9b72-4a62-8967-2bb1a2bcf007", "value": 266075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826393, "uuid": "c5a91b2b-f97b-4d1e-8060-58c100a32e05", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826393, "uuid": "43c01307-7ca6-4938-858d-2de09b2866c5", "value": "2747.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b69243-0e34-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1630837853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837853, "uuid": "ff212790-c835-4401-bab4-05a7edcd745e", "comment": "Malware payload (CoinMiner)", "value": "30b20f179895b8cfc999e551193d43c4", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837853, "uuid": "1dc5b133-0977-410d-bf49-5e0e17d7c312", "comment": "Malware payload (CoinMiner)", "value": "506a485744a8e87c63ac2c420ae19be50a33e7ca375bfb123fbb6e317333b992", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837853, "uuid": "c2668c85-722b-4a4a-bba1-17aa9c925923", "comment": "Malware payload (CoinMiner)", "value": "f0502ca730982d79671737a296ed01146967103e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837853, "uuid": "2631ed82-f16c-4a7f-ab2b-14141f8dd9e5", "comment": "Malware payload (CoinMiner)", "value": "c913cb5c3530f1a712e21a3964049913c021ef48cfc94575fd96acc8936789b1f2c709f9e6b94a3a12c4ac5a3f6905c7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837853, "uuid": "5e86115b-3d3d-4857-a9ba-e394175fad0b", "value": "T10A34AD1A7E90E433D492C770C465CBF0DEFDBC751964416B3358FB6B6E202909A2E36A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837853, "uuid": "5c66839f-e9b5-4fe0-a980-485ad991136f", "value": "b2c249fef864036a8cc857592c5ce556", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837853, "uuid": "94a917fc-6ffb-4eba-bc0e-2b6a3a69fe91", "value": "3072:wIeuqcTZam1OkZrsSbRNf5/r683Tm7uySP3/sj9xKZVKYA/HHx4bBvHO3:hnqc7gkZY+LDauBsj9aEHfWBfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837853, "uuid": "87ec75bf-ab4b-4170-9aa8-c4cd556ecf56", "value": 247296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837853, "uuid": "b0010ea7-b562-4701-95ba-674f3082e36e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837853, "uuid": "c03a108c-6934-4e39-9356-a307a32a1ecc", "value": "30b20f179895b8cfc999e551193d43c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a6db6f-0df4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1630810259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810259, "uuid": "fb1da7d7-9467-4eb5-8c86-25010cc3e08f", "comment": "Malware payload (Gafgyt)", "value": "e687a16c9be18d9fcddae1bf51b46dea", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810259, "uuid": "6f13399f-6c31-484b-a800-827d471df602", "comment": "Malware payload (Gafgyt)", "value": "506f1ab5a09ed58adf14d80a55ba0a7c1acccc352fc85fb094616a2ac84115b9", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810259, "uuid": "7acf5539-cfc5-452b-9306-efbf62d7a3fc", "comment": "Malware payload (Gafgyt)", "value": "50b271382fa5c1b2ab867f4600f1d5150fab801f", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810259, "uuid": "d5090dd1-945f-4005-bb3c-e8a2cc2aa4e1", "comment": "Malware payload (Gafgyt)", "value": "2d99b97b971a6078faa07cccb0d2462b9b22bf8ecfd696de87f97a014efd3394604d9cd047ed219bb56d60176cdf7baa", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810259, "uuid": "c3a1ad77-0c17-4995-931d-6409edf5cc6b", "value": "T12FC32937A291C97AC04352F126EBD5729D23BCBB0772308B73947D606F368C61E99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810259, "uuid": "05f574e5-0734-49af-8675-603c3dae759f", "value": "3072:mir7wq5rVh0SXNfCJfB7yYqbAsrHlbfA8RdHm7R1VqSJXFWnNb:lOS9odq0APnHm7R1VqSJXFWnNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630810259, "uuid": "90b3f257-6b73-4bc5-9a1b-2ae1fdc6ad30", "value": 124566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630810259, "uuid": "c0d801d5-7e7b-401c-8908-10ec21cbccfb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810259, "uuid": "6e661ee6-aa03-497d-9d6e-b975c0c5deed", "value": "e687a16c9be18d9fcddae1bf51b46dea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "522cd67a-0e48-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1630846432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630846432, "uuid": "cf8819f0-c293-4172-9b07-db40c5fdfeb3", "comment": "Malware payload (CoinMiner)", "value": "206ef01e49cf89cce3ae37b77147637b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630846432, "uuid": "ae26d927-2838-4c3c-8a23-3c9411f3b930", "comment": "Malware payload (CoinMiner)", "value": "50ed7ff89205b20b7aa7538438b2af93bbf61bc9488f5eb7e3dc673b0579a2f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630846432, "uuid": "615f864d-f531-465b-97d4-784c1a6d14a3", "comment": "Malware payload (CoinMiner)", "value": "e3a610a77740f91b8085534bdf4ea530d9a8ca1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630846432, "uuid": "6997ecc5-685f-460f-8a05-d5480bacd907", "comment": "Malware payload (CoinMiner)", "value": "0442e12ad2a55632b9d70e4211773b48b6d54397ff368f41e6875fce47a3c9708784bd3811f44eef4468ee528d3227a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630846432, "uuid": "2261af32-7b8a-4dfd-a8ff-38edd0eecf7e", "value": "T16D44BE1A7EA0F473D5A6C6304524C7F0EE3DBC751B6041AB7358FB6B2E70280962E35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630846432, "uuid": "dc03b8a2-8622-4f7b-8f42-9e7e25aebd8c", "value": "5107fa4193c2849c77704d8870503de7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630846432, "uuid": "e717c0f5-315e-48bc-be3f-24216ac8ec8a", "value": "6144:Df7ySH2VV6yOoxypbVchDauBsj92P2hdLP4WBfO:PjEV65kypbVEDkj8OhdP40f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630846432, "uuid": "8ba1a47f-324e-48aa-90bc-855c5c6eda77", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630846432, "uuid": "59beed1a-a2b0-4f32-9e4f-c4cbc8d5dc46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630846432, "uuid": "35bc69c8-4a9b-4f57-bbd0-05496a7f047e", "value": "206ef01e49cf89cce3ae37b77147637b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f0a821c-0e31-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1630836467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836467, "uuid": "31e11867-f5b0-44d1-b1c1-08ecaf879b2b", "comment": "Malware payload (SnakeKeylogger)", "value": "4747c42a5710697f39b121d106953954", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836467, "uuid": "01ca8574-2004-446f-9c74-01b69ee28d2f", "comment": "Malware payload (SnakeKeylogger)", "value": "5275f75696741e8fd97ef5b3da80d7dc7f2ad7e9c24620f2dabbdf10bf49c703", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836467, "uuid": "90731b43-5331-42f6-aa0d-f9c900e75358", "comment": "Malware payload (SnakeKeylogger)", "value": "8595fedc5258d8258ac35c1f619bae9edefbbf39", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836467, "uuid": "48177ee9-ab78-4d3e-a5d3-d3a0a4f48c9c", "comment": "Malware payload (SnakeKeylogger)", "value": "80fe4a33652a4101c723a2430c99872050df7bec94da7e1e788fc764b4c8dc51a077b5c77d34a84ba606e79846577a19", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836467, "uuid": "257fc3b2-f4c8-44b6-bfaf-b685cac6903d", "value": "T150C42367B1201BEBB01EF1899297B570CC1F253B6EB9ED8B98B477DF095203117193A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836467, "uuid": "54e0270e-59e7-43b0-b048-9e71f5e46c2e", "value": "12288:iBnSI+jSr5fFhncxHoitG6aoOj4sAPgGbrI:0S9SNYHy6aoMdYgSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630836467, "uuid": "006978a1-6723-4f42-9939-8dc8a377170f", "value": 576326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630836467, "uuid": "40ba39ad-ee44-45aa-a97c-c3b7ed08e226", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836467, "uuid": "9d528d36-7a7a-4c90-95f8-24ccb35c2c17", "value": "SOA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f78130-0e79-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630867666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630867666, "uuid": "8cc60114-e376-47c5-9fb5-6b44068b9ae4", "comment": "Malware payload", "value": "73e5185bc8f0103df5eebd65c7226000", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630867666, "uuid": "fd7a0d48-7955-461f-bd83-01c2aa599c7c", "comment": "Malware payload", "value": "55d18909ff6050a0bff5ff1d38428e2cb438b156bdf142ff81607760c25d2391", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630867666, "uuid": "e02710df-9062-4a4a-bf17-936669d5a118", "comment": "Malware payload", "value": "d286d6df977903e23cb36b54846a0b72015708c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630867666, "uuid": "70075694-92c4-4e4a-8249-b0a6f5a144fe", "comment": "Malware payload", "value": "b78cefd10c74de0648706af313df50bcfbc2436ae8bf7dfde71b9409d8c0115942b1f0ebbc76329e5862a11822f79c2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630867666, "uuid": "5cf145c6-d3e3-445a-9108-d2e382d15889", "value": "T144050D3E18FE2327D166D7F5CBE0C823B2D09CAF3122A92457D75B665356A4634C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630867666, "uuid": "81358b76-5bf7-4f00-9722-f48cc9c1231b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630867666, "uuid": "baead56c-d1d5-4180-a593-b3ee32b62be7", "value": "6144:GaTJ7FJLgGaeYk2n2mwnAkNZNh+7S6lECl9uib4EhDSNjGBqifFVZ7B+pezaZ:GgIj2/nAo6buibRtEGBqaj7Yeo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630867666, "uuid": "e2411f15-53c8-4ac0-a2a9-88db8773e72f", "value": 797184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630867666, "uuid": "495cc50f-06fd-49bb-b74a-76579a195ffb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630867666, "uuid": "5efea80a-3d37-4c5c-80bd-cead0094f542", "value": "d0eX6QHBZLk9wcA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c03e4949-0e59-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630853918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630853918, "uuid": "e7d1873f-2f5b-4076-948d-6090775785f0", "comment": "Malware payload (Mirai)", "value": "d48b1e38099161e95fdcfef720cfe637", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630853918, "uuid": "6b501335-e013-47a1-8f7b-a20edafd1ba0", "comment": "Malware payload (Mirai)", "value": "55e778989a384af01f7a6c4dbca23330f4fe1b46f5d3286f4226d2b411595431", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630853918, "uuid": "9fdd1882-ab6a-4b41-a1fe-4f8127a76cff", "comment": "Malware payload (Mirai)", "value": "f07ac20af145dbc87a9a225c56a27249540c4f99", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630853918, "uuid": "b859438d-2bb3-4dcc-a4a9-235d8a2b6e34", "comment": "Malware payload (Mirai)", "value": "ed2dd808ddcfa6f8d7c838bb5b44344b599fe43402da39dea24f1d6d05b0b778e316788454efb0aef8ab19dc5b8eb0d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630853918, "uuid": "7e6b2587-90af-4f67-bb86-cc2a1344993b", "value": "T1D6830881BC418A26C6D513BFF91F008F331257E9E3DE72128D251BB07B8A91B1D6BE59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630853918, "uuid": "f7b39eae-4827-481a-9143-ee64c8ca8a9c", "value": "1536:+Nn7ftEjXshEGeBcxOo6jsHv5nqRQg5/5eyAMS1PoCQycFgIAilTMwOsGMDgM:8EjXQE9BNorP5nqR95xXXSlcnMwOsGMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630853918, "uuid": "ef5771c4-1e34-4720-a04a-9d2dc3a4b946", "value": 83248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630853918, "uuid": "5499273e-2563-4b7b-a543-8f49683a8198", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630853918, "uuid": "07d472d1-7871-4fcf-8c56-ae33e3950e60", "value": "d48b1e38099161e95fdcfef720cfe637", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "048c3b28-0e33-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630837282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837282, "uuid": "6a16b6e7-1970-4e0c-a642-63019e73465f", "comment": "Malware payload", "value": "c8aba5f44a0e5e51942e09d7d694303b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837282, "uuid": "0980db04-0364-42b7-8fcf-5ba6eab03225", "comment": "Malware payload", "value": "55e9e8c31f634b980ce2a638ffe808624db7fd373c0d6b662195f432a159ac9d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837282, "uuid": "846d1cdd-77ea-43f2-acfb-f3089edda1e7", "comment": "Malware payload", "value": "f8e81786906171f2fc49d8ea1d762dc0cd8617d1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837282, "uuid": "a1a8bfda-6417-47c5-9b2e-45b56cd0fac2", "comment": "Malware payload", "value": "ed40cddacc1dbaa70922c5cc14a62585089083fae254002cf767cb7d860c2da708a7199f79409c4abf594c5ae9deb23e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837282, "uuid": "b05eb90b-6aef-48a2-882b-8f61bf544288", "value": "T1B0C4BF50FB4411565EC3539B9C1262E2FA3CC111534121A9E89D93AC6B47AE8C3BFFBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837282, "uuid": "b034ac31-de11-4ff0-9c1d-88a9142dc7e7", "value": "12288:+8MujvgzPQABVybLOUPYkOa8VySuquTb8yO:+83AjybLdPYkOLDuquH8yO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837282, "uuid": "bbf72253-d9c5-4b67-8487-1e5fbf44af7c", "value": 576613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837282, "uuid": "f67fd21f-9668-4676-ba4d-6eaaea0c6fd5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837282, "uuid": "7f93cdf6-08cd-4fd6-af96-26d22f5d0cc3", "value": "125.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5b5c55-0e19-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630826341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826341, "uuid": "b087eed9-4595-45f9-9ec9-82e50c4a8286", "comment": "Malware payload", "value": "fea04a49c79fdb3b0099365c49546356", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826341, "uuid": "1586e047-c7f3-4a40-82d1-36bd9ba9309b", "comment": "Malware payload", "value": "55fd38a2f0baac8576e5cb0eea67e67fec3918ee05b6735a62db6591dfc00a21", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826341, "uuid": "3594999a-8f4e-4d60-8388-5f89646e2ed6", "comment": "Malware payload", "value": "093bb4a83c9d81d36ab73c3815555c0fdafdf7fc", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826341, "uuid": "0d3813b3-99cf-4071-87d1-acc32eb58f97", "comment": "Malware payload", "value": "154e353e429cd5165cda6d9ca82743aae60eb87d49759758bfa6e3befae6620f5fc30e2a34c95fab2b839c0fd0b6ba8c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826341, "uuid": "7efb4aa0-0160-4531-87d1-8cc3fd3658d6", "value": "T139142346D7EDF14524FE638A8F37E8C7D8E6047671832009711AD87B97837E92F889A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826341, "uuid": "b5eca790-f9ae-4196-8320-ba3908507d20", "value": "6144:dw7rxmFLHMjukLxUQnBPh6Fq/5Bf1qXlPWWGXg:y5mFLsjjjBIqbtqBWWGXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826341, "uuid": "5bf37c2c-c7aa-4bd3-840f-4c90c802cd15", "value": 201824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826341, "uuid": "d541c97b-7fef-44a0-803d-e0433790a5e4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826341, "uuid": "63f5a2f7-f3a0-442f-ab5c-a9d41880439e", "value": "68.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d77339-0e34-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1630837707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837707, "uuid": "052e9f97-d4a8-4e56-9e41-7d2d800a93e2", "comment": "Malware payload (RemcosRAT)", "value": "2536916e803d4b733e7f71a8bdb9e7db", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837707, "uuid": "50a506c4-0945-4e0e-a78d-6432496cfd01", "comment": "Malware payload (RemcosRAT)", "value": "5714c679f9b081e0e4d73fbd45228d1ad65a7fe9e8d90a8eb76bee72cb7f1147", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837707, "uuid": "a8b78ca1-8612-4a5e-9aab-92d62cd85fd1", "comment": "Malware payload (RemcosRAT)", "value": "1333a899fafd582dd4585005fe71ad7ea7b0d7b7", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837707, "uuid": "b0311b89-a738-4a9c-8c6a-0c1f02321cdb", "comment": "Malware payload (RemcosRAT)", "value": "8797787c138914d66af086a710c7499eafb961c2b59eb03e27ece4cf0dba694cd6d96e59dc33499fd8555163b0f868ad", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837707, "uuid": "2416a02a-bff9-4f5e-b1d5-6f54049f6316", "value": "T1EB558E167BA2443BF51B4535AD87F3FA9D24AD28190DC0BB2BD71C0FEF3A5863126621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837707, "uuid": "bceeb1be-70fb-4236-a33e-36138e83ac83", "value": "12288:wAQ4TXPbFLYhC0MPsgGsXxItI0X/m/zOOMH9L9T5kLvRJ:wZaZUhJOskXOtNvmb6kLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837707, "uuid": "a8a447c1-75a7-4f66-9561-93eb6e4b79e0", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837707, "uuid": "76712ab0-0f4c-45ab-a059-d5763f658faf", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837707, "uuid": "6728f8ae-372b-49ec-b0fa-421f0dd10832", "value": "Attachment.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163fe707-0ded-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630807247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630807247, "uuid": "98f5eb0e-9970-4fdb-a095-25f31a9d929e", "comment": "Malware payload (Mirai)", "value": "73d8d957f41874084d97bac3c05a934a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630807247, "uuid": "fcf6f949-e547-4435-bee8-52d57f149807", "comment": "Malware payload (Mirai)", "value": "573862b8b22241f95ce6780d4473668df07db2eb29bd59bbd92e7755f5372a9c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630807247, "uuid": "cca5b41e-a1c0-4194-b598-c5aace14af1b", "comment": "Malware payload (Mirai)", "value": "ceb32f765399427dd3c873f58ba5cbba644fcfb6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630807247, "uuid": "bf656f3a-2d31-4ad8-a950-8d374bf14200", "comment": "Malware payload (Mirai)", "value": "2b591e7ee6608753e27175bdb391d02ce69ea90701ce0c2f8ee90e639bdd9030d0e7048665fc68a2149f16ca8840a57f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630807247, "uuid": "ad06b5a4-d9c5-4128-a1c5-69c88319f242", "value": "T176C20892B8918A17CAD45377FA5E418D3B352398E1DF33039E123F40779692F0EAB642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630807247, "uuid": "90765717-cb29-4f94-ae34-c29e9cdb65c8", "value": "768:Ft/Sk32oDd+i8hbqpS+XFxKhAHm1U25lh:XSkdD8hbcFxpHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630807247, "uuid": "1be82eb5-f476-4691-aa6a-daf949c1e84b", "value": 26432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630807247, "uuid": "c119f21f-f0a1-45bd-9846-4a7dbee8a410", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630807247, "uuid": "3d647e3f-5b86-4a9a-929d-9c0d0203a0b7", "value": "73d8d957f41874084d97bac3c05a934a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28bcc4db-0dec-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630806848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630806848, "uuid": "12fab913-83ed-439a-be65-40abb2acb272", "comment": "Malware payload (Mirai)", "value": "91032f4fcf1f04cb6f052e9cead35504", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630806848, "uuid": "9be4e76c-68e1-4bfa-832a-724a1e7943bf", "comment": "Malware payload (Mirai)", "value": "57399ad14e93fa53eb8a863dde5abacc114c10c48c3f0b1a8a4317bb364d763e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630806848, "uuid": "cf292c28-ee5a-427b-8471-4bea217b247f", "comment": "Malware payload (Mirai)", "value": "7d777e74fbed3165a6226386bec5ea7a775b34d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630806848, "uuid": "f9c0094b-90dd-4c96-b913-7e1b1856c6b7", "comment": "Malware payload (Mirai)", "value": "2223826cfb929ebdf192ef4ea68a3ccc2107acd8a9e0eaf22105813713ccd8a2f63a888eb5d9201989207d6e6244b789", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630806848, "uuid": "4110fda2-7863-4518-9eee-57e6b7e3f09e", "value": "T1A8B22AC6A883D5FDE82146B620B6EB339776F42A7508DD47C768D6B36C825009E0728F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630806848, "uuid": "ae04503f-90ff-4dbb-b235-807b52e4aceb", "value": "384:fnyB7bc0ebo5hwEBA7E/zmDsQR0OyLLH9NHvSKC17bqE9jPMqdTjNHkkDZ:w0Sm7E/SgtOyrqKClPMeTjNEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630806848, "uuid": "c98e9a0f-d8dc-4704-a251-352226d47d24", "value": 25176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630806848, "uuid": "223d184f-41b5-402b-9b64-9c4de1d7356e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630806848, "uuid": "0e182a38-8236-4cc1-afde-2d6464e23cf9", "value": "91032f4fcf1f04cb6f052e9cead35504", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7afd7b51-0e7d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630869263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630869263, "uuid": "1a435a96-9eeb-42e5-9205-d1558232aa56", "comment": "Malware payload", "value": "590459b833a0d6846c570d35e7f3344d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630869263, "uuid": "1e03dcee-4cd2-452c-b376-74af7e02decf", "comment": "Malware payload", "value": "57b2efd438bf6c7eb64a4a2d454f215361e2f96ac4bd50284b89c64742bc307a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630869263, "uuid": "3ef2981e-f6d4-47f0-83fa-a0b11455b35c", "comment": "Malware payload", "value": "b095954830b51651520990b275220bf50cc89a4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630869263, "uuid": "7f29799a-db77-4d6e-a06c-f414821dcbc1", "comment": "Malware payload", "value": "3d62a572a4a30e0b8ed2bd4ea0d53d6b02900cf34b03e09aa2850130d773c909009b99b5e2d7a502d9de2dbec1fc42a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630869263, "uuid": "e9b53c81-89d1-45a2-9948-19c123c56f9b", "value": "T11714019922C91F65D7694BF53A30B780ECB5B0AB3402FFAA748D11EC135B3D949E9780", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630869263, "uuid": "28aeae9a-c194-4c8e-8f17-3d3ef7d7d80f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630869263, "uuid": "02c054dc-3cf9-49e9-8c70-4fa0f0510cf8", "value": "3072:cV3GrOMSrfyuq5mUF5eWEFb3AgM34udq9Y9fNgbec+1+F3t2OYD1Du5S/x:A2Tfet3Agp0q9ygbX+1RzDU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630869263, "uuid": "c1fc5265-5985-4f6e-8595-89f77b0b79eb", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630869263, "uuid": "6dd0832f-43cf-4f55-bf17-e0533b8abb03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630869263, "uuid": "4e18adad-7fcf-4b93-ba11-e32ff44732b2", "value": "SecuriteInfo.com.Trojan.GenericKD.46929464.6664.11196", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b42d14bd-0e1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630826839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826839, "uuid": "8aa14ec0-b2b7-4a9f-9654-8cda2865b1d1", "comment": "Malware payload (Buran)", "value": "fbd32f19d1798fb99de785252d795b4f", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826839, "uuid": "9972be01-6e50-48bb-bcd2-f4b8762e72c0", "comment": "Malware payload (Buran)", "value": "57fc14536453b971218a4c0e31f7ac707dcc0d0cf0f4d7ff1833930c93ddfba6", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826839, "uuid": "c1804887-c57c-4cd4-87bc-e848877df614", "comment": "Malware payload (Buran)", "value": "f6033c4a2a9f714da14d469285c37928ae40fcc9", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826839, "uuid": "e63e15a3-16dd-4d55-860e-5cc76b351768", "comment": "Malware payload (Buran)", "value": "18272213da3554c8488a4380b0b3243e1d41e455d81bcb2d399339ac0e4787f8ce66cecb897362cf8bc8253d90d5e4eb", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826839, "uuid": "977da063-a980-465c-a56e-4a5121ba81ba", "value": "T1A2F4C050EB4411560EC3535BAC1352D2FA7DC111934121A8E99EA3AC6B879DCC3BFBBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826839, "uuid": "4a4d9f9d-22d1-4a05-895d-8ac3bfcd11d2", "value": "12288:dHu7i78czUQbhhoX1WKsC81llAxGaQvjeH0+s5Xt8DHpscKYdFA:dGi7BzTFnHllAxGJeH0/X2DprzFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826839, "uuid": "d16b9cb5-49db-48bd-beae-8197a76249c4", "value": 779571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826839, "uuid": "0061bcc6-7753-4c34-ae3c-2c24b3c89987", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826839, "uuid": "8735cb51-69fc-4201-bde7-b8e3c91ebb5e", "value": "8363.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d966bad-0e12-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1630823338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823338, "uuid": "3ef4b0fd-8c9b-488a-95e2-3621e20e7b91", "comment": "Malware payload (RemcosRAT)", "value": "9fe1db34036afc1f70be7bf92a9ebc4f", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823338, "uuid": "15fc519c-cf03-4a41-babf-f5eaa73b3663", "comment": "Malware payload (RemcosRAT)", "value": "581309c06c8e7dc4a4f0567283efdce3b28096959037fae74472084269d45c1b", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823338, "uuid": "948716e9-e0bc-495a-9eaf-1fc2a2070bf4", "comment": "Malware payload (RemcosRAT)", "value": "050fe4428451b97714c74920dcfccce42fc38094", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823338, "uuid": "2fb64bb0-c20c-4c4f-9351-40c8f68814e6", "comment": "Malware payload (RemcosRAT)", "value": "174160538b2dd9c037601bb7dd0ad8641cfc63faefec1b834558d50a840a42514fc52fb6def27ac84898ff6a5970cc9a", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823338, "uuid": "8fb35051-5e26-40de-b309-63de2548b282", "value": "T192E46C6162D94833D2BE817E1C1FF238D8153E122D28AE605EE4FC4A5E7DEE472152E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823338, "uuid": "aa11af96-4ed6-42b1-94ef-6709c7fa678b", "value": "b80f4f0a086ef8167169248061f9b4a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823338, "uuid": "589157f9-8120-4441-bc29-0b8d5155bb55", "value": "12288:732D6sAniEeWwhvT0Xq7FZlU2i5DZ/iFXCj:7mYhwhvTf725Z//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823338, "uuid": "cd54b985-7fb5-449f-9728-bf0406f1f58e", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823338, "uuid": "8a74a900-7264-41aa-b782-5112e3bf4da8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823338, "uuid": "9f26acdf-9fc5-45d7-a4c4-a0c485d44bae", "value": "DOCUMENT.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42048f39-0e0b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630820205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820205, "uuid": "57a493c0-3aa2-4465-9997-ef486aaa2457", "comment": "Malware payload (Formbook)", "value": "2ac9b7aaee0cf79be88ed5703abc75ba", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820205, "uuid": "9f7bd8d2-1898-4c77-9048-ed3e272d50cc", "comment": "Malware payload (Formbook)", "value": "59994141a89bb9be2d56fb10d81b9ead22f4d171b6e1cc3d8bd406d7fe41b2b2", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820205, "uuid": "c68acf40-9a1b-49ca-93cf-ec3628a79102", "comment": "Malware payload (Formbook)", "value": "4cbecd4bfc4b0af796269b7d08cd9f0ad8d15295", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820205, "uuid": "9d4239fe-7749-4b17-a23c-5902f6fa952e", "comment": "Malware payload (Formbook)", "value": "778053c60c0af0f742f09762b2b4b1827027adf26e11f2a902950de6aed82afe58f13b43233fa448fe7d0fc3cc5e469a", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630820205, "uuid": "b9f14555-db46-4103-b7ae-d3d74b8114e9", "value": "T137B423AE71F3A459D87575EC69B8E487B28A83B835F57CF67B1B5022204CC68B3C0D09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630820205, "uuid": "72a7c6c1-0001-47b1-802e-f828f933a4a7", "value": "12288:xrwELgWgTX0NxRWZ3/GWJg75ze7D3db5xzNTXXF2eCVMk:xpL3pRWZ3/dJg07d5xBX12j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630820205, "uuid": "c45dfc9b-25d0-4510-90eb-23536ac89ed3", "value": 519174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630820205, "uuid": "674e3e26-ab13-4dce-8841-2f48dfb2aad8", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630820205, "uuid": "b1228941-da1d-4552-9aad-f954dece11d2", "value": "PAYMENT INSTRUCTIONS COPY.ARJ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2b749cc-0e5a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630854432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630854432, "uuid": "f628f4b2-4b1e-4eac-a0df-cad403817330", "comment": "Malware payload", "value": "46368fa1ddd3b1a035727afe1ab5908a", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630854432, "uuid": "665c0393-61b9-4b04-8e5c-412646846325", "comment": "Malware payload", "value": "59ab5ebbe8aa602439a456f62a92716f167e237389d892306a900f6775e9d61d", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630854432, "uuid": "bac333b2-1a02-43f4-8eda-e25fee852f2b", "comment": "Malware payload", "value": "04a238d514014a6f5253f387a7bf5b85a3825723", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630854432, "uuid": "4e7e1d6a-0d6c-4020-b62f-1163c9efd7d4", "comment": "Malware payload", "value": "49af5825ddb0421a78fb3f5f0332958b0cd01fdab60d235146c94b22838fa998dd73b1d740fbcb813a1fdb028eef0756", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630854432, "uuid": "fe549b60-0299-426c-b855-d30bd1364033", "value": "T11751960AF847D10C9BB5232BED978922FF1B401B9EA2104871DCC2495F20809A6ACB9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630854432, "uuid": "1e67ec91-0f98-4e2f-94f3-edfaf49c8768", "value": "48:Axv4HiLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBozlC:BGhrffvIypvK0elkEYZ85zk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630854432, "uuid": "f2caef18-6a49-49d6-b121-4ab040d781ab", "value": 3133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630854432, "uuid": "95a17c94-eace-4677-acfd-c0fa1d26f38b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630854432, "uuid": "5f5be746-f9a8-4320-9824-26ee46d39165", "value": "9JiSbUVL.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a2d710e-0e81-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1630870819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630870819, "uuid": "8179ad60-979a-47b3-ba8c-2f05cc31fad9", "comment": "Malware payload (njrat)", "value": "c865447ddf5a946a5663c824ec3a8f28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630870819, "uuid": "5c15b3b4-887c-4246-ba33-df1f723039f2", "comment": "Malware payload (njrat)", "value": "59b45ef1da7d5dd6d2cb29796794fae90f67f13566dd15864fe4a65e42b9d7b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630870819, "uuid": "c5301993-395b-4434-a2ab-144540aabe06", "comment": "Malware payload (njrat)", "value": "dd713980b874a10f6eb1c8e4cf6343e2d28afa8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630870819, "uuid": "4d793553-5820-40a4-b59c-c5ccb7a2ab03", "comment": "Malware payload (njrat)", "value": "d9ba69a5ee43d5a35ce92c4cf9850ef37b6c377748b3209c6dbb229ab98e18461ae5aa2d7936f606e0686a0961c6949e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630870819, "uuid": "75d669c1-ff90-4254-9404-e1aa79530a3b", "value": "T107158E23ADE18433D1F217389C1B5E5D9929BE112D28A87A2BE50F4B4F3B64174352BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630870819, "uuid": "9a0acc27-b90a-46cf-a956-43fe5f85c53a", "value": "b5a0c7ba0cba09906e28efc162bd8832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630870819, "uuid": "efda15d9-1335-43a8-8b6b-c366baeb1afb", "value": "12288:B9HKVuiD5kftXwRFsM+gfgXx2TbKUhFGspKl4+k0SYlZ5NjWFm1fwFQYYNGKGB:BtuiFARFsM8h1UhIscl42hvWcGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630870819, "uuid": "36e7bfe9-0845-428d-b8eb-4efb537e99e6", "value": 905778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630870819, "uuid": "0771adb7-ed3c-41e6-87a9-6a0e035a5f2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630870819, "uuid": "ba9ba299-6ac9-457d-a11f-78f008cd137b", "value": "59B45EF1DA7D5DD6D2CB29796794FAE90F67F13566DD1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "569c77b8-0e33-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630837420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837420, "uuid": "18905f03-c72b-4294-8d11-ea5350d53e68", "comment": "Malware payload", "value": "2103346ebae8bcb8e0313a4d5e033c11", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837420, "uuid": "6ba01a6c-fc33-4fb9-88a9-b5252ae666c7", "comment": "Malware payload", "value": "59d36b9b7dcee394ea81dcf49cfab9f545759b194e5c411fbf5cba1bb2ddd8fc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837420, "uuid": "a5ac5d4b-9dcf-4c7d-8d35-9d4dc6634ab9", "comment": "Malware payload", "value": "a91ca6b9c36eee4a3c5e919feda05252c68b8a91", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837420, "uuid": "36f7b99e-7568-44d8-b970-0b9fc5fed92e", "comment": "Malware payload", "value": "611558c6f95046c077c9881923f79f3e1c383938af241e4a504318aeaf56a4899cdc42f0d856cef8e91f515bc046a001", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837420, "uuid": "f41e3e52-df75-4592-815e-6dc8319f1f55", "value": "T1F25423A9A31716DACC18F98452F2D242F095C0A5533446D77FFB8610B81FEA9643FE27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837420, "uuid": "ed7b9290-5496-4558-a125-c6fe7793edfb", "value": "6144:y8dlckKx6wCqWTG2HWsTGTlhZVKxGYo5BowHNBspzV1oIWd0SdeXal:xnICqWTG2HITlhexRnwtWD1oIWFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837420, "uuid": "39751ab4-75a8-44e8-a7bc-2ee268a047f6", "value": 286265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837420, "uuid": "697a718d-bc2a-4177-a911-a48d9cc9c29f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837420, "uuid": "12a49f37-b2b9-4f68-a62d-57a891739433", "value": "1161.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "769b65dd-0e92-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1630878275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630878275, "uuid": "77a1643c-3f8f-4311-b408-90ab7823c6df", "comment": "Malware payload (ArkeiStealer)", "value": "40fd1879df3a6e137c75f6358fdf2089", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630878275, "uuid": "7c27c198-ad3b-48da-91cb-eede41570a6d", "comment": "Malware payload (ArkeiStealer)", "value": "5abf906c7f9f29927c0a9bef9a1ebf70cd86fdfb2014f3f6072e67cd6b68b65c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630878275, "uuid": "d307ada4-4036-4aff-8143-d84a7ec3e483", "comment": "Malware payload (ArkeiStealer)", "value": "38d9477cd737a170ec0dd3010401abcec56e3cec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630878275, "uuid": "60f89671-c6fc-450d-9d21-d3a744333fe5", "comment": "Malware payload (ArkeiStealer)", "value": "9b09334126ce54f6ee5399d43ecfebcefa382a90a2dd565a41662cb0692cb2bb673cca4c226897229743c64eb16cabf1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630878275, "uuid": "fbe74ebb-5c4d-4ccc-80a0-2c9803c679a0", "value": "T1CF85ADA86F4DE443FBF709368C1ACA18D6767C65460AD14B3549738B9CB6BDF6C088C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630878275, "uuid": "86d82ec5-8c03-4535-8937-54dd3d9b7386", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630878275, "uuid": "07d0ce31-3783-42ec-84aa-02cb74d35022", "value": "24576:WjYEvjWAZwGjEL5KBef93XV9JNJ75HdObXeC4OQhC5OXGo+QMdouoF9NkxChx4IV:WjBZw9oS9nhLOjahC5BadGxChxTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630878275, "uuid": "e85cee19-35a5-4b42-9ec3-818fc9309ae0", "value": 1830384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630878275, "uuid": "e30d3884-7b69-4bc0-bb37-4bbc213194c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630878275, "uuid": "a03b7c90-48ec-4993-9f4b-4ae42314ed83", "value": "40fd1879df3a6e137c75f6358fdf2089", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85e87ea9-0e74-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NetSupport)", "timestamp": 1630865416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630865416, "uuid": "e7865034-a93d-449a-b782-34b03177b783", "comment": "Malware payload (NetSupport)", "value": "bdfa8bc2ad2d79924dbc9f7a8037086a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630865416, "uuid": "d71f2b72-d9be-40fa-a3cf-f22fad0caa46", "comment": "Malware payload (NetSupport)", "value": "5c5ef223c061bcda14cb952d54e500c62d6b606222487dee334b3766bfb85449", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630865416, "uuid": "ab72bfe2-9e55-437f-b132-b5477d38089f", "comment": "Malware payload (NetSupport)", "value": "af2c2fb756eb69ba8f94e85a08da167dd3387fea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630865416, "uuid": "373845ff-972e-4a08-8437-533d219e3c44", "comment": "Malware payload (NetSupport)", "value": "7d6567faebfd0d13531f8f3edcf4ba3ce0d1998a148c38c0453f677732ed58474da432f07e99563c6788e58a92e0ee7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630865416, "uuid": "51339c85-0af3-4ec6-bd13-582589d38847", "value": "T1B685C03FF268A53EC45A1B3245B39250997BBA60B81A8C1F07FC384DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630865416, "uuid": "395dcc09-123b-47a0-9e57-e83d8f2f14b2", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630865416, "uuid": "8f598c91-ddf5-4306-99e7-b813eaa1dbd3", "value": "24576:t4nXubIQGyxbPV0db26WK7qKnKsv1Et9uGpckT52zedlq89Ws5uIzk5aM/phdON:tqe3f6D5jSffPMWrQ0ZkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630865416, "uuid": "96387eb4-5253-495f-8694-edb1c2f7b933", "value": 1764126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630865416, "uuid": "ec0b7e2d-8244-480f-8e39-a8b77ccebde2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630865416, "uuid": "91bf8d40-3b9f-440e-8e73-cf84d48b511b", "value": "BDFA8BC2AD2D79924DBC9F7A8037086A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caff6e57-0e32-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630837185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837185, "uuid": "ff0d211d-50fe-43ef-a3a4-8e2653b68b04", "comment": "Malware payload (AgentTesla)", "value": "ca1a3f82bbe65c7d12c681413723c3b7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837185, "uuid": "fbce739b-dda5-4849-8fe8-fadbdb39d893", "comment": "Malware payload (AgentTesla)", "value": "5f1a0d1ea2a23eb9f10f04370cc7c88f6acb31dbc821210b67e5d3ef97728ff8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837185, "uuid": "0aea3e89-b123-43fe-9153-249ad705f90a", "comment": "Malware payload (AgentTesla)", "value": "0f78872576c30461f4f5be257c415e8b3f01f671", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837185, "uuid": "bad174a2-0e66-4b5b-ada0-388a97d39814", "comment": "Malware payload (AgentTesla)", "value": "3818f22d0c690c61972b6c7db2caa3602a1a8759446b532163fbcb68a11f62d71651d7c44b9ff03c8755219bef4efee6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837185, "uuid": "917b068c-1686-484d-b859-11b0e33df8d7", "value": "T175E423AF27A181B47CBB0CCA0D8586D59472BAFCC2B54536DCC70F0EB6049796DD8398", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837185, "uuid": "959ccd5c-2025-4b3d-821a-91dee72d06a1", "value": "12288:mStej/y3efYB5uhVhNbD+rdfrY5G3LyLQ9PDc5IFnyvl1UJ1H//wSDqBCdCPf:mtj/8eAbiVhNKgCLyUtcxliXV9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837185, "uuid": "3e4a52b4-3e6b-4ea8-8732-2f389d222783", "value": 679894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837185, "uuid": "54d51ff0-028f-4873-889e-c97bf1223769", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837185, "uuid": "8f34a814-38e3-4f9e-89a5-d7ed471d8097", "value": "TT copy.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84e5c6ab-0e1b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630827189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827189, "uuid": "411cb961-2ae9-4208-b56c-bdd9fc65025c", "comment": "Malware payload", "value": "85b455f61c679d481ff562b4454c78ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827189, "uuid": "51a51159-31f5-4dbd-819f-741bad84e0ad", "comment": "Malware payload", "value": "5f1ff93cf4eb1ec53402b5bb959a6fd1d4c94fed041606a39d7b334b699514ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827189, "uuid": "71aaead5-e867-40f9-9e96-bd29ea64f0b6", "comment": "Malware payload", "value": "419cf72cb631dafbc2a8e219e9e2d2d571d34b7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827189, "uuid": "f5da7b2a-0399-48fc-93bf-2e729e180511", "comment": "Malware payload", "value": "36e0b7d5f1fdc91c9c322a6db8291ab79dcb9d9105f49906e5c3024a5593f996d664873d31d4f105721fbfa9c71bb822", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630827189, "uuid": "66ea1f40-b59a-4c81-b1a6-896556adbed3", "value": "T169E4AF67F3D7F6B4E6BF827A86B1C92C5276745602B0938E774075892D22392493CB0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630827189, "uuid": "95e75043-6bd0-44fd-b918-4142842b2094", "value": "946c7b5f0ac6d3a47863eb46459f9075", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630827189, "uuid": "88106598-46c9-4919-9826-b8f80316ea4d", "value": "12288:HHGqRJHO4pMetgC8bzbBSregUIVgFK/UqWgqUAS:HZRJHvkJX1IcLg5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630827189, "uuid": "8f964428-03c3-423c-8f84-2e823135c533", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630827189, "uuid": "0503b81b-cc74-431a-bb7b-66aa1ba1d086", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630827189, "uuid": "d9707334-8483-4641-810f-4442b9ad2e33", "value": "Approval August Orders.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a6b373-0e24-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1630831051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831051, "uuid": "a5246681-2f2d-4f15-a21e-67c31ad5a0c8", "comment": "Malware payload (GuLoader)", "value": "f83442099ba3eef67e071fcb9739698d", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831051, "uuid": "b3519304-6ce7-4cda-a63c-93e25e331c35", "comment": "Malware payload (GuLoader)", "value": "6106c050de378e825ce908e3454f445c483d7c02e9dbdde27adacd9ef61e964b", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831051, "uuid": "f38cbd86-08cb-4135-ac4a-ee70e5a64f3d", "comment": "Malware payload (GuLoader)", "value": "7c72e5f1a0424ea66ad72f616cada8cea3c1fd4b", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831051, "uuid": "35c788fd-8eba-4859-a784-67a0e7142150", "comment": "Malware payload (GuLoader)", "value": "4569b7f9ba24db5d1119c7a3813455c5de385bbe9d314629cefe261a3ff997fe3fe7622bb9649ff758729a238c809d57", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630831051, "uuid": "b79a27f8-6f7b-4dec-bc31-5f027185c90a", "value": "T1B413F142A57235218F1C6CF14B4BC95D9D2ADAF12F3D429F926EF06D9FA91B02CA00D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630831051, "uuid": "fce59d34-eb45-46d1-99a7-3934c4760be5", "value": "768:yiawWTnrlpCWiThZjfrTgDqhWZiiUf7XrBRV6J/RHMc/1E6RaZZMxnMcB0O//2:yNwQJcWiT3fXgDqh/bP45fpMA0O32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630831051, "uuid": "408404c7-90b5-43f1-8815-01ec7233bb28", "value": 41989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630831051, "uuid": "95caacb5-36e3-4d7b-829f-a3923cf052ca", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630831051, "uuid": "68ed6014-333f-4996-8c78-34d8a36c7e7d", "value": "HSBC Customer Information.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e5f4af-0e99-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1630881497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630881497, "uuid": "9ce26b69-01e8-41b0-be65-1f12e9a9a96b", "comment": "Malware payload (CobaltStrike)", "value": "a60a142a250b18f447fa8865539bab0c", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630881497, "uuid": "42429dad-598a-4c8b-ab5c-12e4ebd45a35", "comment": "Malware payload (CobaltStrike)", "value": "61a0bca8460972abed1f283c9e8a78e43e17e5177cc3a826d8d6beb4fcff14c2", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630881497, "uuid": "2700631e-8cb5-44b0-a8dd-878b9e63bd50", "comment": "Malware payload (CobaltStrike)", "value": "4c13c4bdab4a899ca00808a85f2a888caf2150f4", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630881497, "uuid": "dad16de3-3c27-4c1e-a59f-5e952ba442d2", "comment": "Malware payload (CobaltStrike)", "value": "598844624eb42ccea455d8a28f213dc2c276ed65e9f1992b38922bbc0c64c5c1dcb845899ecd40b1bd1b299e78946408", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630881497, "uuid": "434561f6-1938-4ccc-ae65-1a30052f8c56", "value": "T11724CF3DB22EE4B2E55B7F340EFBA0769E67CF13828640F57679420B79048F1260761A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630881497, "uuid": "38f8df42-0cb4-4882-96a8-92077f296047", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630881497, "uuid": "b8a24407-75c9-4a61-a449-ca39e7686140", "value": "6144:EDYVb9w5+4k4nAv8O5S0eU0SMRDPbXH+F8PEL09RYkBX:6Ah4zAL5JeU0SMRDjXjPEL09J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630881497, "uuid": "2ece5fdb-d8a2-4b59-a712-ae25d76f9c2f", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630881497, "uuid": "ac425cb7-d360-47ba-aef7-00b11852808d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630881497, "uuid": "19d56443-e152-4349-88e1-a666752b5c30", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "335726bd-0df4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1630810302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810302, "uuid": "ea777677-f0d5-4f8a-998e-17945074f48a", "comment": "Malware payload (Gafgyt)", "value": "d123d4fded7685206deaf2d906ad3a59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810302, "uuid": "2a83a33d-36b8-4e91-a827-4d955936318b", "comment": "Malware payload (Gafgyt)", "value": "62179f43e5ab521355e96ded0e476a52d877d41b5d63c12d92db6f6289d82ba7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810302, "uuid": "88ad0900-4b02-42cd-be5d-0b2f180dfc1a", "comment": "Malware payload (Gafgyt)", "value": "784dfa005e05b04e4aef838a64a8e92bc5228b09", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810302, "uuid": "1e3940ac-5b6f-4d52-ac68-aea70a387376", "comment": "Malware payload (Gafgyt)", "value": "fc47c03fde19f333c37f700cd16135f2e3111f6c2f2342fee90bc25da6e8a825d4a9fad891cf5b16a8631807746a988c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810302, "uuid": "18142f87-28c3-438b-a306-81338d0ff433", "value": "T1C0F3843E7A22BF7EE268827107F75F70CF5529D326A19381E26CE6185E7124D0C8EB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810302, "uuid": "718af9ea-7ec6-4df0-9169-84430763d268", "value": "3072:gphi8tvynt0V8qHcEmvmeMutphPmrTdNaLrnvPvNb:+hX8HmgPmrTdNaLrnvPvNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630810302, "uuid": "58d3d9be-9036-4ae5-a289-b9ef3f553211", "value": 168042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630810302, "uuid": "e27e5007-3334-4a4c-8bbc-1bdf1d7f51fe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810302, "uuid": "2ef99bca-a615-4ff5-87c6-0e928ae28b38", "value": "d123d4fded7685206deaf2d906ad3a59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc0b592-0e1c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630827417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827417, "uuid": "5674cdd1-3c3d-440f-a907-30c450771186", "comment": "Malware payload (Formbook)", "value": "eb0e6e07b0b9f81f6f08b9be52e3431b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827417, "uuid": "b52a8441-13cb-4b5d-81aa-4056effd3b3a", "comment": "Malware payload (Formbook)", "value": "629992bdefee29b9d3547814daf62c79edc6adc5d4607f1daf0bb617f0085c3a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827417, "uuid": "a9274918-6203-4530-9077-c32ce873779d", "comment": "Malware payload (Formbook)", "value": "98a4f63d0d1b6f3797f588f06ba1f6c6e8568cb3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827417, "uuid": "6640eb46-b63c-40b4-b21e-81c4f7549275", "comment": "Malware payload (Formbook)", "value": "a59c9075bbb8d4684fb414d07d3ae96272f02dad54aa6d9b7d8269ce0baf8e4c968d426de461ea3d63a98d31ab75f249", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630827417, "uuid": "64f479f8-0f93-428d-a836-9db5c1e50116", "value": "T1F8C423313726173D5F093FB6A7A0BEE78F56C43BDA8218D18541A23682179C8F86857A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630827417, "uuid": "0d600b0f-23ec-4b45-9916-915ce7015edf", "value": "12288:MmXSer3FOAFh06jxDZf26VDu//GCGhJYA9LpiwRcNtnfbUCZveqT9AxB:/XSaAcS6vf286//WJYcliwRcN6CHTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630827417, "uuid": "3f8075b4-7248-4f14-a1c7-6cfb6a10d2d0", "value": 596553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630827417, "uuid": "786ce159-bee4-4c76-9bf8-7b61ef4a33d9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630827417, "uuid": "350bc3fe-b838-4e9d-a462-a3592e6b93ff", "value": "RFQ_PO_009890_pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d5a141-0e66-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1630859180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630859180, "uuid": "1906bb5a-48ac-4e01-9787-9d5ab361f3ec", "comment": "Malware payload (njrat)", "value": "7013f4f226a8bae3d0ad18346a5cb41a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630859180, "uuid": "81b87326-b9bf-4f18-b79b-083174f06842", "comment": "Malware payload (njrat)", "value": "63619660ee0cb7ce28fceb3c7cb597fa73c1c609f1c77fd75a4c907cfa34ac09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630859180, "uuid": "c1f9b1e5-97bf-4418-8ddc-2dfa4423d1cc", "comment": "Malware payload (njrat)", "value": "837031fcef921fa65910357c4122f4e0bccc0f8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630859180, "uuid": "8de77f65-2340-43fa-a992-ac8f67e1799c", "comment": "Malware payload (njrat)", "value": "c9d65b296a94c0ea6f0b40405648c21e99e9d74d3d04216b90937f9ec34d2e2acfa906eba9258a3024ce2527d2620ace", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630859180, "uuid": "4ac055d5-47ac-4ae0-854d-d1f70dddebcd", "value": "T12DC2076C37B68232D2EE067F4562EA5543B4D04BF223FB0E4CD998D94B5B3890A41FE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630859180, "uuid": "290a6c0b-356e-4f84-858e-ac6e5908d55b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630859180, "uuid": "ce684bda-1835-407d-a98f-6a2a77e59ada", "value": "384:8LS89wzGgqhZo3qXl0EGuPh5BrM0AQk93vmhm7UMKmIEecKdbXTzm9bVhcao6arZ:afn0Wm0A/vMHTi9bD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630859180, "uuid": "1165cd78-3927-49e8-9d5d-1e17605c5256", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630859180, "uuid": "d0d092d0-65eb-465c-b9b9-8044f7327e5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630859180, "uuid": "ceea12b3-d80d-4047-9567-71a981ad801a", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ce354f-0e81-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1630871112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630871112, "uuid": "6181fd25-18d7-4a24-b37b-3b40c31ad9bc", "comment": "Malware payload (CoinMiner.XMRig)", "value": "5161b92e3274d1f9a9c3f6d69886ad37", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630871112, "uuid": "4549a66f-27d1-4fb7-8e6c-69df9d2c0326", "comment": "Malware payload (CoinMiner.XMRig)", "value": "64434c8c20fe4b64041795ac2a1472662fa5d33fa0cbbfbb1555a7eaed7ca685", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630871112, "uuid": "668aca1f-7851-413c-86be-537a03d6c13a", "comment": "Malware payload (CoinMiner.XMRig)", "value": "3a6b0554d5baa615520864e2b77151f7dbf22ae8", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630871112, "uuid": "a4dd099c-be15-4b95-b190-dde565981321", "comment": "Malware payload (CoinMiner.XMRig)", "value": "e759a88188e978cc158f0dcb7c5493f1ba35867b9857ac8ff0ea35cc82ffda045596b0b724a076723532e9c988692b42", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630871112, "uuid": "a952d006-06a3-4bfa-9926-1bd8c77fe0f1", "value": "T1E0249C02B6D0E837E5D606304425CAF06EFEBC721D66854B7358EB6F7E702909E62367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630871112, "uuid": "58a5ac17-82af-4aee-9cf8-f47fbe96e096", "value": "a5091bd61667ae52b24f539467c52b28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630871112, "uuid": "7fd369aa-0d46-46e2-ab02-fdb6ed7a266f", "value": "3072:5/1nLANEKor9+fSRUlc5G683Tm7u36J4Ze0jhZDuHHx4bV:Z1ncorQfLpDaufE0F4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630871112, "uuid": "1ed5895b-f4e9-471f-bc78-7e0f10a8fe58", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630871112, "uuid": "7595f27e-6839-446c-bf82-a0c698bd9b89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630871112, "uuid": "71784be1-fb30-4438-8a00-07d4d4d96a73", "value": "64434c8c20fe4b64041795ac2a1472662fa5d33fa0cbb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91509fce-0e32-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630837089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837089, "uuid": "28e9e3e4-6264-4216-826e-0bc68fd17ad9", "comment": "Malware payload (AgentTesla)", "value": "ab8ab4186600c368169a06e921ce359a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837089, "uuid": "4a5125b6-90b4-4417-9d56-7672fa81f143", "comment": "Malware payload (AgentTesla)", "value": "6531f2587b3451f1bc5d8e3a05fcee47bbd86b20611dc3de979e33b51b4cf2aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837089, "uuid": "0d333296-3f00-44be-aec2-f015d3b7a046", "comment": "Malware payload (AgentTesla)", "value": "767c0e064792858d8bf591ed3b6b3a49b24d18ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837089, "uuid": "468d4d1f-2b36-4bef-be09-3255df3d99aa", "comment": "Malware payload (AgentTesla)", "value": "39b0633b263e770c191f552b1bb3b5b44d9654df3e03a0e76c77425379905dff0a57b9d769a8614eeec27ef21f5a91f2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837089, "uuid": "c17712f5-39f2-438c-9ac9-0abcfdbc449b", "value": "T1EFD4330FEE19A17441DDC0DE91AFB016AD0B9498F79CFA1A3B8716729EFED167013881", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837089, "uuid": "bd185ce1-8711-4074-930c-6d450c23aa6f", "value": "12288:86SURMd+UeA5yfUefoOewyTYTcuCDkFDG1kAkQb46sRa:86NY+U55yfNg3YqSFAJ0Ra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837089, "uuid": "9a6a3fec-d468-4af0-ad6d-8efd2c355e5e", "value": 647223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837089, "uuid": "7a1a9b3f-eee5-4404-8b48-a029d2888913", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837089, "uuid": "df8b1998-caa4-4445-8a91-0f6fddceee45", "value": "PO-I20100309.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2830ae-0e1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630826770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826770, "uuid": "6a727a18-0b63-42a4-9989-83c547e400fd", "comment": "Malware payload (Buran)", "value": "327a23323a19213d4b38b6d8e3ceb1c8", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826770, "uuid": "60c503d0-a0c1-40af-be2b-d1fc0b87da1b", "comment": "Malware payload (Buran)", "value": "66299185f73e001578f67be1fa81e2e1ac7a947e3725a195b33569e09a0d3b05", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826770, "uuid": "a14ef8fd-3f88-4ea1-a488-7ab2458515a2", "comment": "Malware payload (Buran)", "value": "c05d8b6f9ece92919749d487cd53011aecabc754", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826770, "uuid": "104d41b2-e133-4bef-a153-cbabbafe26ab", "comment": "Malware payload (Buran)", "value": "e32adacb1fe435ec47b2019788dbeea83e243f6e74b1ccc3cfdf31d52143b849de45b67135599f63a303ad5669221678", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826770, "uuid": "15ac6847-5e4a-4e91-b600-f39b03e09f54", "value": "T15E74AF50F78821960A835357ED5312D2FA7DD00153802269DD9F93AD2B879ACC37BBBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826770, "uuid": "9b2271ac-e090-495c-a314-c8560d22caeb", "value": "6144:o/WVovO5B/TtmfLYMNBqyHpTJE3zh90hXS/gk6hmXt/0D9:ocTIfLPSIoXt8D9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826770, "uuid": "697d29c1-9286-40df-994e-ffab2409bf62", "value": 354438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826770, "uuid": "6b07ee75-fb08-4975-b25f-28411d1efa5e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826770, "uuid": "96b1b69f-edd0-4629-bd80-29736db359c6", "value": "5540.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d0e4bf2-0e24-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1630831068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831068, "uuid": "bd65585d-f16b-4844-9928-798f1ec1f6dd", "comment": "Malware payload (GuLoader)", "value": "d3a8868a065e42121247f3cb952937cd", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831068, "uuid": "73ba27eb-7220-4956-a54e-03ea01eda0b3", "comment": "Malware payload (GuLoader)", "value": "67831d0bd8a8dbd27f8179817ecf35f8a8a801f5137865c39ab0c302e405acc3", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831068, "uuid": "7512ffce-f6c3-4ae0-8a39-584bc20b0dbb", "comment": "Malware payload (GuLoader)", "value": "2421494d922cb95a5bf7dc1c8a9cdb016f34492a", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831068, "uuid": "26252018-3936-4fb0-ad3e-426462697fe0", "comment": "Malware payload (GuLoader)", "value": "31e59497d0a2dd5e1390cb49cec9f935c7fdf3d89afd60d816a5414dc1ec3310fd3581ec109573c886a301f9975de227", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630831068, "uuid": "653b25fa-7490-4758-bd88-b08c3cdbcf02", "value": "T1C013F146B9723521CF1C7CF14B4BD99D5929DAF12F2D429FC26EF06D9FA91A02CA00D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630831068, "uuid": "2b6772ae-5153-47b0-be53-8a13c541c01f", "value": "768:MawWTnrlpCWiThZjfrTgDqhWZiiUf7XrBRV6J/RHMc/1E6RaZZMxnMcB0O/HV:TwQJcWiT3fXgDqh/bP45fpMA0O9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630831068, "uuid": "7f8597db-7981-4921-b00b-04c7c36b607a", "value": 41977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630831068, "uuid": "e7c361ae-0143-4113-bc59-ae06331479cc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630831068, "uuid": "29f51a10-f2aa-4cb2-a150-c84e95079cea", "value": "HSBC Payment Advice.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eed5d83-0e13-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630823555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823555, "uuid": "3a685248-1b7d-4ff2-8529-36c0c53f7f61", "comment": "Malware payload", "value": "12ad2e0623fdd0a51698113fac095bf7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823555, "uuid": "156125e9-473f-4a8c-91fb-dc8753eab28e", "comment": "Malware payload", "value": "6803d583aa19990a4cc9784b1bce1a3e3c83bc436f1011d355cf2454c66f6dab", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823555, "uuid": "742bef4e-42e7-496d-a4ef-e1d5258b645c", "comment": "Malware payload", "value": "0fc4cb9c8f25107b98c5549113d47d1d3cdcfb19", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823555, "uuid": "820f01c1-0d94-4aa9-8326-65e83c6d58c0", "comment": "Malware payload", "value": "1abaf33c11f68306b75a781b49781bff6df601bd55af78f47d30a6f857afa0034eab9474682514fe10bb5ceda83a6301", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823555, "uuid": "f1fa1528-0751-4910-817d-4d4d35b5e550", "value": "T1B954220AF463F6291068B10914DE88E4BDAF997DE3531019FA66FDDF0BE69E0044D87E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823555, "uuid": "dbd8a769-9239-49b1-b4a8-45457b91603f", "value": "6144:pddMuvZ2G77ayy+QuGiYoP8Bn1Ldqg/OVoKMU7uAucy6PgZSFOOdg1c:PdP2+7aylzGUP8BRsgYrSAOSFOOmC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823555, "uuid": "cab5fcbd-8381-485d-ac0e-608d91bb8dfa", "value": 287615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823555, "uuid": "1d10d047-a5d5-4bac-b95c-73148da608bb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823555, "uuid": "acf3bb4f-4aad-4229-94ba-9a6e2e0826cf", "value": "7770.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccdcb62a-0e19-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630826451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826451, "uuid": "ee902cfa-c79c-4b6f-bd94-24089051e895", "comment": "Malware payload", "value": "2ac2952b5d7bd6490143667578987f77", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826451, "uuid": "e8302e8f-1c8d-41b0-a4db-424f9dd3f82f", "comment": "Malware payload", "value": "6b63de55700fbde12aca1119a50e28e3abda70ad75d21c4aef0f36b6f76e4688", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826451, "uuid": "e526c3e3-c1ee-4172-af3a-8023ce38ae8b", "comment": "Malware payload", "value": "cf8398e0328bb6b4418e2c9e5c1dd39455ffd132", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826451, "uuid": "41294f56-fd2c-449c-abe5-01f4708174de", "comment": "Malware payload", "value": "32b46b2ef2999d49bd6299ff41096b31fcd20bf6ac061b998be72e6812b272d53bc9c1b17954b65b7ff2c53db18b7c51", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826451, "uuid": "4367722f-a820-40f2-9f70-a7efb793ec12", "value": "T1D414AE90FBC430DA0B83139BFE5361C1F66DD44152841128ED5BE3AD6A539ACC37AA7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826451, "uuid": "416eb7b5-7ca1-44f6-95d6-a051c938beb8", "value": "3072:0XtbL06VLNFAjWWFFVU5qRHWniD3XgwB7VlJAJv+EKYp2syU9OyPXTS0u3WE/H5C:0Xt/0DVlJi6wODEQFDf8sOwB78x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826451, "uuid": "484cc069-35c7-4440-9995-cc6af4e36b14", "value": 196633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826451, "uuid": "81ae995c-7e1a-4ac0-a542-ece0d55240a3", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826451, "uuid": "39714e79-7e8c-4569-9476-bfabdb220084", "value": "3659.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7923a31-0e2b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630834146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834146, "uuid": "01d295a8-873b-4d40-8b53-938bfd665b29", "comment": "Malware payload", "value": "0f41234ce843d72a64c622ed1a7a8cb0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834146, "uuid": "9c088f3b-56b1-453f-a16e-3f8304da1c5b", "comment": "Malware payload", "value": "6b7a2535ceb032e616fff2a08328d38b98a60870e7c08e7c600d7b945d2f8fcc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834146, "uuid": "2e997074-c5fc-43bd-8f4c-1c7fbc62e466", "comment": "Malware payload", "value": "ad0365f6fb9de1b29e01b8b13ae6bf329ce897eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834146, "uuid": "947b5255-fecf-45e9-9998-53fb8a3d5097", "comment": "Malware payload", "value": "43825ac97424638aef2491f97aabc5ab8d4a087dbc797d1dc6a248a6d9b51d7ba3ed87b9a00c0d616847dd3ea4bcb810", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834146, "uuid": "670668d3-899d-4ec5-a3ee-42e8075a64ba", "value": "T12F537C1575A0A133C45605701439A3A2CE3EAA301BA281D7BFDC2F7F5F74BD5963A326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834146, "uuid": "fc95743d-9e2c-46ef-b2ee-e6375ad2dc3b", "value": "4c2a534098486955f846a0368c9744ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834146, "uuid": "789b9a8e-fef6-44c7-9ac3-8169f0dc9237", "value": "1536:KjRsWpkPNlmRWpeLKei1yX+oVm6LGHy+6XQYcwCwV1/wf:9ziWpeLKei1yuNynXQYcwC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630834146, "uuid": "a4b46177-947b-49d8-9b54-128e6926ab19", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630834146, "uuid": "c0dfc796-16f1-4bdc-9106-4faf85a2aadc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834146, "uuid": "9a42a9f7-fd5d-4003-bd66-3af13d909c61", "value": "0f41234ce843d72a64c622ed1a7a8cb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c35966-0e13-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630823535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823535, "uuid": "dbfbd0a1-5224-4f3b-b8dc-a626c6e2cd8b", "comment": "Malware payload", "value": "67f059c2cd8eea63363080622a60e871", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823535, "uuid": "1cac93c2-8c28-412f-841b-73146663c922", "comment": "Malware payload", "value": "6bb16e83f2519ef04ff014bb63be38c34b53f8a247be0408091eb214b06e314b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823535, "uuid": "a7a7738f-fd2f-4a12-87c3-e9a6daaab4f7", "comment": "Malware payload", "value": "ea6922be918e83a0cbfa7e2e0816c7ace7585496", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823535, "uuid": "6f625a21-f547-4afe-a71d-a5e44bf03cd9", "comment": "Malware payload", "value": "a4218d21c3f7711c6388aa12fc23fa8e91f17791741503742a26f1bc9fc653a25b279eb774a7fa0da6e000a61af56794", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823535, "uuid": "07611ba2-9306-4b06-8252-f7deb017c86c", "value": "T1F21412A12266C614EF93487159CAFD68258BD217CF7216FF91E8D6A5CCB0DF4483A0DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823535, "uuid": "59509f11-a7bb-4c5a-ad78-e0c461834954", "value": "6144:nWECx+iv5ic2TebZ5XvhMF18bA1OnZenDli:ndCx5H2qNNpO801OZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823535, "uuid": "1a6f88ac-8b9c-4e98-b116-148c3b1462f2", "value": 200532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823535, "uuid": "667b6472-1d6f-4e93-9b6c-932690056c94", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823535, "uuid": "2f710424-7626-4f01-b7f8-ed7270e4e1b9", "value": "6252.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f97657-0e0a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630819970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630819970, "uuid": "cdff7651-8872-4bef-9fd7-1bb0fb37c262", "comment": "Malware payload", "value": "a1e9466cd40f50cba45e8b95ec166101", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630819970, "uuid": "b48069e3-279f-4af8-b7d3-c09a6e89ca00", "comment": "Malware payload", "value": "6bd868cb47e55bb820b596dce4891151c243a52c4371cebbfddd77b750bbfe6f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630819970, "uuid": "f25efe7c-ab96-4f00-80bd-52b2db8b7858", "comment": "Malware payload", "value": "047a026783669eb460fa426b34650fa7ee83e4bd", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630819970, "uuid": "86d4b707-5a8b-4bba-b658-afd3f50915ba", "comment": "Malware payload", "value": "0fc8f3882b8f6d3ca6e0fc11da7e90414c20156b6ae07ece4a881584f834ba917f877513359bc96243e6cfccd2b72de0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630819970, "uuid": "3c5f9349-40ae-4779-ada7-a8c9732556e3", "value": "T1E60412ACD8A68B2DED4389B103084F40C60DE876AE9F67513D4E48CD3E6B96A4B17D4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630819970, "uuid": "a20f7dc3-2595-404d-be09-add493ff41a9", "value": "3072:SPoqlo61lTDFQk7zgcK0+9BqXR/b46KEsq8mE5ul3WdHAJ553:Oy6lTDFQaYSR/s6+XulmdHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630819970, "uuid": "b86fba4f-61b8-4f85-8cb3-b82f0d0d7919", "value": 187414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630819970, "uuid": "dc20b251-eb80-44eb-b2d3-72f7525635db", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630819970, "uuid": "b743f53a-30b5-4da2-86ed-ec417c215b99", "value": "The final decision.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "171e9899-0e12-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630823140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823140, "uuid": "7c5db3cc-43a0-4768-9d6c-4dd767a6d4a1", "comment": "Malware payload (RaccoonStealer)", "value": "64a6a7af946e615f6f6a0da733cce42a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823140, "uuid": "b352469d-1207-4deb-bf1d-c85c743144c4", "comment": "Malware payload (RaccoonStealer)", "value": "6c7390a207bf7d3ce9df2c9df04609bbc6176eb958294f760e9167553fd05428", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823140, "uuid": "81b4e853-d637-49be-85aa-d86e41e62da7", "comment": "Malware payload (RaccoonStealer)", "value": "04a304b95b23fb4bd3070f098f67998fa94ec847", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823140, "uuid": "9c5c3f6a-4964-40e1-b03f-d3498c37409b", "comment": "Malware payload (RaccoonStealer)", "value": "8088f5fc2e0a2003484d1454544800452b2ea77799bdb71ba1b9a29f0f041021b16cf090e39f3d5902a0358c7510767b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823140, "uuid": "4ce9675d-8890-4f0d-98a6-19b7737ab68c", "value": "T12134AD1ABE90E873D5A6C2704426CBBCDE3DFCF59E64458B7348EB6B2E30280552D356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823140, "uuid": "4bd73266-fc19-45b5-bd05-d3d3957bb806", "value": "f530acf7acd4a5c8880ba2a4704d4cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823140, "uuid": "c8caceb1-c08d-45d4-9ba1-b6d0f2de401e", "value": "3072:JMoL3vb7E7CwAevnUaa8jCYE5KZ683Tm7uySP3/sj9S/q//HHx4bCvHOS:JTLDo7daoVDauBsj9S/yWCfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823140, "uuid": "4779c1a4-2f6a-4d18-b2fc-27f5a8b60f28", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823140, "uuid": "3b2bed3d-aad4-47b3-89cf-a84508e82278", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823140, "uuid": "cf3d8e5d-e99f-4be6-b972-8e457b00b7e1", "value": "64a6a7af946e615f6f6a0da733cce42a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "292e5413-0e22-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630830042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630830042, "uuid": "297e4990-6dee-47dc-9042-56e5ea74e128", "comment": "Malware payload (RaccoonStealer)", "value": "062abd2ebe1c0edb0dafa021e95c4fa7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630830042, "uuid": "e21ee809-49d8-4eb4-917d-02f4671192d9", "comment": "Malware payload (RaccoonStealer)", "value": "6c9063a9eff83a71d5cf09591de3f3cb09fc9a209ea67901b939e53cf16eea4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630830042, "uuid": "cbb33128-edae-449a-8621-1e7cf6fa4dab", "comment": "Malware payload (RaccoonStealer)", "value": "c5a0295a500e8d9b7ce0251188fba9b2047003ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630830042, "uuid": "37ebbb80-0473-4dd0-bfc2-c2d203ad3820", "comment": "Malware payload (RaccoonStealer)", "value": "e21b605c0c4416e1d72c03e5e0a098cdcce633040960678478352f38c89da26c574c735706fc0c3310ab0099a5eddea9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630830042, "uuid": "b7fe8ce0-b972-40f5-9592-3f8b7add24db", "value": "T18865F01C33D678D3E0A09A3F2561B36D8CBBF75B206796A929B00C89BCD54D85944BFC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630830042, "uuid": "73096520-8099-4921-a2e7-2305cde41c10", "value": "67260fb2ac11e8fa504fec7af97d8fe1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630830042, "uuid": "8bcb62ae-d85d-4370-80c2-d4aec8d885c0", "value": "24576:6ZZn6rg7mqeZPQ3uYaQx7SD95AuT1PVeT5u+aFAKDKf2iI9q3HCrchjfL1fZXzwo:6Wrg7eQ3uk7SDLneDxdC4ZL1VzwJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630830042, "uuid": "c249103b-163c-4cb2-b115-bb2a393e6b79", "value": 1514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630830042, "uuid": "613b106b-232e-4e0d-b020-fb2ba6322e69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630830042, "uuid": "ab4eb334-1f84-47c8-ac1c-f72cedf6429d", "value": "062ABD2EBE1C0EDB0DAFA021E95C4FA7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efca6d0a-0e32-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630837247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837247, "uuid": "2306766b-b5f0-486f-88a2-0c664965aa5f", "comment": "Malware payload (RaccoonStealer)", "value": "5dadb777edf175b11347a15c386a28e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837247, "uuid": "7bea893d-41ca-48b0-8043-cb18f53bb532", "comment": "Malware payload (RaccoonStealer)", "value": "6e2bf5a1a59b6936fa85bbfda3c6733e19f07afaaf026ed0a3d00634252d0133", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837247, "uuid": "52e3d017-2ab1-468c-bdb2-a22b7dcf816c", "comment": "Malware payload (RaccoonStealer)", "value": "ba9fc62325b2d9499afc0a59c4666a16368e1ea8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837247, "uuid": "33170c62-3987-4828-9e17-696c525a0a77", "comment": "Malware payload (RaccoonStealer)", "value": "7ef130b1ec06c7b48cb44dc01961509909977475438b9ac16d47c5cfbf4f8d8bf9040c03639c11c0cf85e77474813ca6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837247, "uuid": "982b8627-286f-4c50-924e-46557d9ed3aa", "value": "T1D6B4F11A6E90E963D5CACA700426CBBCEE7EBCE2191048477784FB6F6F302D1482E355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837247, "uuid": "909b493d-46bf-4f3a-aefb-2d274ce7988d", "value": "9258099a7e5adb7f2e1fdf3536b86000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837247, "uuid": "bf8c9c05-102c-4afe-9057-fc88fd556abb", "value": "12288:fP8MYwO/Ye/+rW60/D9TRaEIxszvyQh4LDkjiR0f:BY1Ye6WNwEIUvTyLmU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837247, "uuid": "687d0421-9cb7-4df8-9890-73891a410b36", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837247, "uuid": "6d3347c2-00af-41a6-a61b-83aa3986e48e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837247, "uuid": "c3680cbc-68ad-492f-ad79-ece6e85fa8e7", "value": "5dadb777edf175b11347a15c386a28e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09851a93-0e2d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630834713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834713, "uuid": "a4310f46-ef70-457d-85fd-bba43fc7bd3e", "comment": "Malware payload", "value": "e927a6179e8a5746b4675df0913fb2dd", "object_relation": "md5", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834713, "uuid": "bc2b7d23-dae5-4dd1-99f5-75cdadf9eb40", "comment": "Malware payload", "value": "6f0a7e4991596f239526574639fadd9e01b5de7812ec3200cea8199cb27228a6", "object_relation": "sha256", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834713, "uuid": "452f1085-88b4-4e97-b61b-c47e121574e3", "comment": "Malware payload", "value": "286fa3f4dc0eee3f8793be2709293fed2bc2b5eb", "object_relation": "sha1", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834713, "uuid": "4d468fd0-2d40-44ba-8b7c-989d7113583b", "comment": "Malware payload", "value": "721aec281a2208133ee388d70abbf1245a07049fdf966cfb627daa067470b96dd9fdaafca6f8d302b81bc8851a690df2", "object_relation": "sha3-384", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834713, "uuid": "bb9ae04e-7763-4d6b-a882-49ed49ccae4e", "value": "T18146191277FA8939F1FB6B30ADB852A54ABFFD615F30C18F1250568D1930AC09A74B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834713, "uuid": "7ab44600-a1c3-4e57-be62-f990e20f6758", "value": "e2d28022f7d79baf4229614e32d8540d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834713, "uuid": "7f9e68a6-6c3e-438a-823e-e48d937da739", "value": "98304:KsVXH2gbTfJi2plgyfsVXH2gbTfJi2plgy:KstH2g/JlLstH2g/Jl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630834713, "uuid": "442f385c-71e0-42d0-9732-559859962895", "value": 5702316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630834713, "uuid": "1906ba86-a5b3-4d02-a4e7-afa45e03fc2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834713, "uuid": "e8de2e39-6f47-43c9-a43f-bf191f5298b8", "value": "6f0a7e4991596f239526574639fadd9e01b5de7812ec3200cea8199cb27228a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d5e78d5-0df4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630810346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810346, "uuid": "738c29c8-7cf7-4438-b543-a68fae7ecb9e", "comment": "Malware payload (Mirai)", "value": "21f876e30511a5b242ec5b4bda184bdd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810346, "uuid": "3b1f5b9b-4013-4d31-a8e2-04a30625e273", "comment": "Malware payload (Mirai)", "value": "6f11e200c029f1eaf613da0f1fd91d9e7bb43dc7998623b2173aefcf178fb199", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810346, "uuid": "8493409c-0e64-436f-a0df-d701ff6bf648", "comment": "Malware payload (Mirai)", "value": "bfa3168435442c1eeae5ebaaa2570a79f8126567", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810346, "uuid": "a53774fe-60c7-4544-b3ee-214389a0b3c7", "comment": "Malware payload (Mirai)", "value": "3a117b4f27113922f1204d58fc1afdcdd120b71011466577f458df533c4768010a13eb4ad750ee3a75af6ef60995697a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810346, "uuid": "45022329-7503-464e-86af-c046e62d6fec", "value": "T1C9C31877A4A09F77C081A9F114BA9D310F12AD931F5F1A89623C76A04A3F5CE784EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810346, "uuid": "8ba0e088-7317-48a4-835b-872f8cf68946", "value": "3072:UBeweGy4NStvOoXGvfSvVpwhkhmTDcuzgvniYN/:UBevGPaWCLwhMmTDcuzgvniYN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630810346, "uuid": "335645de-2f32-49a9-ab6a-91e59501bfcc", "value": 120944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630810346, "uuid": "9ce6dfed-7b91-475f-bfc7-ac0a91dfee37", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810346, "uuid": "68f1a2e4-b4c5-4e59-ba94-217878216201", "value": "21f876e30511a5b242ec5b4bda184bdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d08e537-0e25-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1630831444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831444, "uuid": "b2771a8d-9010-42ed-890f-b5d09f930631", "comment": "Malware payload (SnakeKeylogger)", "value": "de886f28a667dc92a89aa9cb4e31a349", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831444, "uuid": "fcee90d2-254b-41bf-b621-e0b7ba4eeb1b", "comment": "Malware payload (SnakeKeylogger)", "value": "6f447e36db21ba9d451bf33b542f01569ddbcfbe9a3442c348f479c69193268f", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831444, "uuid": "a0d94f1a-26e3-420f-9574-461be4718ff2", "comment": "Malware payload (SnakeKeylogger)", "value": "4f8d42fcfd554a95e53f926f491c8cd857582885", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831444, "uuid": "58ab5798-c6b1-44c0-927f-3cc29c8438f6", "comment": "Malware payload (SnakeKeylogger)", "value": "b74a106286a123b32e5ede9d3f9b7d45a2fe80cd7e52541af7d8ea390717c68f47fe23e312a260771986d595ae9f61be", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630831444, "uuid": "cc8cfc1f-8dd8-4a9a-919a-52e85e6d12e7", "value": "T16FA42327F11028BFCCB23EAFF629D34630A6D652C2690FB6A52175181FBED89D51C858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630831444, "uuid": "72f28065-50f6-42f7-ac60-ac310ba26441", "value": "12288:or/2ZPUt4OBQvbyNxiOUgDtdNDUC0qGTK:or2Zc1cciBsdNDI1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630831444, "uuid": "325945a3-1029-49f7-8e76-b60c6d4446bb", "value": 457368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630831444, "uuid": "5f172e46-f04b-44db-b312-c6a30ddc6b00", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630831444, "uuid": "f342bc29-24b1-41e9-9fbf-00cb61f74b19", "value": "New order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b44228d-0e30-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630836005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836005, "uuid": "972a6b48-65f7-4536-a566-27818dbb5c4e", "comment": "Malware payload (AgentTesla)", "value": "45f4bb75898a91d8a56c99de1bc63497", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836005, "uuid": "279a2f6c-e635-4458-9a50-3fd06d9a1233", "comment": "Malware payload (AgentTesla)", "value": "6f54dc8b4e37e0bbb38de47b118afae840d7e413c06605e46dc90bb7fd3efc09", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836005, "uuid": "90a533dc-9469-495e-8fd2-1e397ce7e65c", "comment": "Malware payload (AgentTesla)", "value": "bf9164f5c89fa497f716a70fb3cb5b737cfb44ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836005, "uuid": "9dbe1974-f657-4fd1-8150-22cd540a2f2a", "comment": "Malware payload (AgentTesla)", "value": "41c0277dc2a76521bb08f135a1ed791633e8e22b2d2fe0b4ac55cfc021a9d5a47e121e772c46d74faa5571e2f1a1f828", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836005, "uuid": "2550dfe0-e5a4-4d18-a3ea-593e840384df", "value": "T19EE42324D1A6CE9DEFC74A2D17CF3823D535EC679530C2594B81B8DFAA98843F42AC84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836005, "uuid": "e739bc1d-63a0-4123-8526-fe4cd88c3bc8", "value": "12288:5srItewT5zfy7TfUV3Eny4T5jLtFWNgx9gayBFSpieyKe8BUZnE:2rzMeQ3Ey6jLfWfayBLePe8UZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630836005, "uuid": "96b8d4ea-3384-4e40-b796-cb2cdf7bb905", "value": 692184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630836005, "uuid": "147599b1-9fec-4a6e-828b-c0c21b77a98a", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836005, "uuid": "65368abb-c51d-47e0-86f3-bbe22553709b", "value": "Purchase Order_Last _quarter 2021.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "956d0a87-0e14-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630824211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630824211, "uuid": "d220f803-ffac-4f08-a45b-6d0c921ad322", "comment": "Malware payload (Mirai)", "value": "c2a0801d674155f50169ea2552a79f9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630824211, "uuid": "9d0a50e0-c665-4c2d-912d-2d69f867d65d", "comment": "Malware payload (Mirai)", "value": "708e2255e466e0fa8e5767680d08f45411d9b79e80af67131d6f0dcfc55580b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630824211, "uuid": "2220d36e-d9d9-4491-af7c-5f9fad613234", "comment": "Malware payload (Mirai)", "value": "07e3d37747d600cffe1a73bd9b50dd11d6146a49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630824211, "uuid": "43aebe8a-8f60-4531-84ea-94e6ad8eb1e7", "comment": "Malware payload (Mirai)", "value": "061fab0cb5c65b8f41212342dc610635f3925a7f7e52fd8bb58b93124aa0b0e27ababfb2ad223d6d4ccc3c0db319c8fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630824211, "uuid": "23097be8-eb08-4dba-8a4c-deb11e07347c", "value": "T1B8531956F8814F21C4D512BAF92E254E371617E8E2DEB2239D201F257BC792B0E3BD46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630824211, "uuid": "279ecb12-7e26-42a6-bd9f-813cd0184825", "value": "1536:90nmKgn9ugqgJIplv85d66wX3UMqip3B2Hoqja10yq:Og9uKgKdgl3B2Hoq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630824211, "uuid": "1a46dd1b-154f-411f-a0c4-1d62e6039eed", "value": 65564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630824211, "uuid": "72b4b816-d7e3-4e16-acbb-fa29a96aaf03", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630824211, "uuid": "98e47dfb-e8d4-46a4-9960-41235a655df2", "value": "c2a0801d674155f50169ea2552a79f9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b4018fa-0e2f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630835817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835817, "uuid": "3c37de93-d1d6-446f-b97a-e2af6defccfb", "comment": "Malware payload (AgentTesla)", "value": "40128060b3c671ff2d77f346de78f162", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835817, "uuid": "c355c44c-63be-4b9c-bcea-919d18a93cdd", "comment": "Malware payload (AgentTesla)", "value": "7241ab5f030e14c1796873268bc503c54a2ca1de09951e5e613529fb4b9f6722", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835817, "uuid": "e8ac6523-2eb2-41f6-a7cc-8240ae68be62", "comment": "Malware payload (AgentTesla)", "value": "2c614db3066a26dcfa7fea63767f693750a65b74", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835817, "uuid": "81081ddd-7c11-4100-8f66-eafc23191b4e", "comment": "Malware payload (AgentTesla)", "value": "a3592a37166c3b4180db611b42c9d70bb71efcb923067207f57181079d18f6f441812ca9b0ed4f6f12400851e4b12021", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835817, "uuid": "6eeaea75-1a14-4f9c-8713-877b086c3b25", "value": "T10584237B54450A99F7ADE0B4921D610C7CB17C94A8ECF4A7A0E813E4BEB7330C6566CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835817, "uuid": "3710a17b-13d3-4c4a-ba49-eee2820854a8", "value": "12288:e+d+C3vEoYWvIYRea1fb/o2gjU3g9Avq6:Nd+C3vEoYBetLdG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630835817, "uuid": "032a7695-de72-46b2-b39c-e0ec0de2e99a", "value": 406432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630835817, "uuid": "e609cfc3-06b1-46b2-b564-207061b2275d", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835817, "uuid": "0d764361-5f97-4606-bb02-12c86d1f5a4f", "value": "B2B Order Lists.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97fd2347-0e1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630826792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826792, "uuid": "bd666afa-3fb8-41b6-9c1f-ea0debfb4952", "comment": "Malware payload", "value": "f032642375ae0582d19ca74d8c13aad4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826792, "uuid": "71ccb2bb-876c-4ba8-a571-7d1a402f43cc", "comment": "Malware payload", "value": "72aa587eddf11dc2066225ee9f70bf303d3a8ab16434e6bc451b064a72a6cbbf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826792, "uuid": "f3f9b01f-6d9e-4142-9259-59068d0e362e", "comment": "Malware payload", "value": "060874232895a9efff59a5975cf29fa155d173a7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826792, "uuid": "59396d1f-ed70-4cb8-8326-f1b90dad530b", "comment": "Malware payload", "value": "0041aaa1614e781435844ae90a3017815c823ce27b8cc124bced41e1f2b9218235a6bd0ad88348b634775e975260e939", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826792, "uuid": "e9f47c67-dba6-4f4b-a4c1-33f4774e1260", "value": "T18494CF50FB4421961A82135BAD5352D2FA3DD10193402168E99F93AC6B479ECC3BFFBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826792, "uuid": "9f5aefbb-881e-4c3a-bce0-2f1d16c5538e", "value": "12288:WxDyccBvkUUbYv95EXt8Df4tBmR5i/PTe:WxuPr9mX2W7/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826792, "uuid": "95e42b69-cb52-44ad-912c-dce94ae18686", "value": 430650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826792, "uuid": "83b15775-de04-406d-acd1-f3c14fbac18f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826792, "uuid": "5c7552ba-90b5-42b3-9312-c336e5c97600", "value": "7399.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2949b9b2-0e13-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630823600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823600, "uuid": "f3b3200e-3ace-4efa-a6a0-a8a09d827b44", "comment": "Malware payload", "value": "4f667768ff6caf6e6ef408179d7536af", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823600, "uuid": "917b124b-5c77-4123-9854-e9e24d1fb977", "comment": "Malware payload", "value": "743b698d7e4a4a1e018f01a463a6f0485965a0992305e3680dab0ecc2c66c647", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823600, "uuid": "618a3eca-8fa4-4755-83ff-707c569caaf1", "comment": "Malware payload", "value": "1146404067f138d2c1d66dd390fb4fa8ef7bfdf5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823600, "uuid": "90eeca23-6d9e-47ea-8ea5-1f1bc57837cf", "comment": "Malware payload", "value": "c86ff12fb7e49de6fb1a219a3de30a89bc3ac36f175f385434db6f3f3ebd3ce6c71a2c02d978356810627c1b85ab0e5e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823600, "uuid": "281fa10f-aac0-4b10-b41e-c52b7531a0b6", "value": "T1E4242261429939EF7EF600BB7778999D2B8C0CC991790070E2EA5CBD5F6B031265F938", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823600, "uuid": "59df37cb-b4df-457a-96e2-e2ddd9c30c7d", "value": "6144:4cKUL7JW6FVVP/Y6x2KqUgQ39Bkb2DEzae43m9i0i:9L1T/wiLqHQtlReam9i0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823600, "uuid": "9aef2ecf-9b86-434e-a435-8d9aa3f397c8", "value": 210091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823600, "uuid": "38a86938-e94c-47b0-b929-b17fbaceaa69", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823600, "uuid": "095fc12d-c3b0-4c2f-894c-b9c260849d5f", "value": "9887.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "352f9460-0e14-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630824049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630824049, "uuid": "d7fd2e32-1017-4200-ae3f-a186e44c7af0", "comment": "Malware payload (RaccoonStealer)", "value": "d2249aa9c05cd6f8670c30289eb8192b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630824049, "uuid": "8aae115c-8663-4a6e-a27b-f198838cf1e5", "comment": "Malware payload (RaccoonStealer)", "value": "74767ac4568804aa346e8519737f6aa4e8b67133da1782aac8fd12110858ef91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630824049, "uuid": "eaf44b1e-f27b-4473-aac2-864e3150add2", "comment": "Malware payload (RaccoonStealer)", "value": "95e9a54984a4437becb79e070af48ef7b1f9a2f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630824049, "uuid": "cf031db1-5b98-4e3e-b0a9-7d75f54c86cc", "comment": "Malware payload (RaccoonStealer)", "value": "9bfa986ee3dc78a5751b9efbd6864f2136c85d9d1d40aeed6ef6d0b15f3a74f9476660285757dd5a85d25319c90b61f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630824049, "uuid": "abd8280f-354f-4d50-aa26-2bdb09e790ee", "value": "T141B4E020B6A0C035E1B751F549BA83BCA93D7E711B2481CFA3D42ADE9A346E4DD31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630824049, "uuid": "4ff2a51b-a7bc-4df6-a3ab-b03fba9ebd57", "value": "400fbb4d0298c92dcf0f4177f613bae0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630824049, "uuid": "46b19a0f-f7b2-4b1d-9854-d1f9040dad5a", "value": "12288:jptZ94p2O4HGJWrZOT9NrpD7mACkrqp+lPsT3zzH6:dtX2dMA9NN7mAC9/zza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630824049, "uuid": "9891b47c-25c4-4a14-a620-974b478522be", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630824049, "uuid": "8893c591-85a1-4aa0-bc3f-5c9e75b40e8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630824049, "uuid": "206a18d8-c8bc-4b80-8a99-04e8650d83db", "value": "d2249aa9c05cd6f8670c30289eb8192b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d7882d-0e19-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630826412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826412, "uuid": "a2851757-5e23-4d65-8b1e-dbba6e394eef", "comment": "Malware payload", "value": "6f371e98f2c1341be92aea2e6fde74da", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826412, "uuid": "508a4bd7-5cb2-4eaf-9a44-aaabc373756c", "comment": "Malware payload", "value": "76a6d71294fc7520a3059c857a1be7084651fe199539139bc52937da13c43ca7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826412, "uuid": "557c43fe-05d8-4071-b40b-cf2a6566ea4a", "comment": "Malware payload", "value": "df0ebce3f25c4f1c72dbf4f30153f10133c52607", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826412, "uuid": "d19cc0c2-310c-4ce3-a40b-343a5f9c3cac", "comment": "Malware payload", "value": "b12f363f170189d4db595442605e9acce56968e878f6883a0b715b74da007b2bd4e375ae8ab71047c290ff957f6176e0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826412, "uuid": "5e365289-4acf-45c5-8c56-2427d3e01c35", "value": "T12B94C050FB4421961A83139BED5352C2EA7DD11053412268E99FA36C6B435ECC3BFBBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826412, "uuid": "488b1f24-717e-463c-b8e2-320fd62cd411", "value": "12288:0Xt8DEymrf22K+qdUK8CPcAtH3unNG2Sfgp:0X2gymrfxrK8vAtXuNG2S4p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826412, "uuid": "cc5cbc95-4555-42a6-b2d8-119bf83be89b", "value": 432927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826412, "uuid": "104c6b7c-8682-4c49-aaf8-3192744d1a6a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826412, "uuid": "c402bd8d-d4af-4f51-82ac-a7f74e0809ae", "value": "5210.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ba6540-0e33-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Tofsee)", "timestamp": 1630837556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837556, "uuid": "646bdaef-8f00-492d-b126-6c5fafa87455", "comment": "Malware payload (Tofsee)", "value": "1e927690f4a82286466a772d907dcd24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837556, "uuid": "6cf49d2f-29e8-47df-b666-5daf0eb62491", "comment": "Malware payload (Tofsee)", "value": "772f6fe2ec8b23617a2b26d78a9b512579369b1d870fc69fa2921bf5148ee69f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837556, "uuid": "bc38a956-8720-4fca-94ad-2106ff78401d", "comment": "Malware payload (Tofsee)", "value": "fee962f18eb782b38445a82749f2ce3af45e4849", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837556, "uuid": "d2d52517-9424-49ba-bb38-3b68d0e97f1d", "comment": "Malware payload (Tofsee)", "value": "5cc2c7b2caaf95a72e5775b922b7cb32f489668178d242a0f9be7801fbc8d47f9f42435ae5f13fdba54fc916569cb60c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837556, "uuid": "6b28f96a-3689-4384-8f0b-eaae567ec73f", "value": "T14234AD197E90E933D295C6704425CBF0DE3DBCB19A68448B7768FF6BEE30290462E356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837556, "uuid": "debc7140-d86b-474f-80bd-00bfb43dad91", "value": "f530acf7acd4a5c8880ba2a4704d4cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837556, "uuid": "2510a3f9-05b5-41ad-a329-09b61b293a56", "value": "3072:XMoL3vb7ELZjxIkU3AgLJaOd2454Z683Tm7uySP3/sj9OFNmvHaORkDpHHx4bCv5:XTLDoNjfUdaXDauBsj9sO5UWCfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837556, "uuid": "f3e56c1e-9d96-44d6-b2df-e93d4b9a828c", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837556, "uuid": "b9dabfb2-eb8c-43ee-85cb-a78557276eef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837556, "uuid": "43861340-4271-4b47-8470-54133b1ccb46", "value": "772f6fe2ec8b23617a2b26d78a9b512579369b1d870fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbc7925d-0e12-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630823443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823443, "uuid": "12dd6294-0f8d-4498-83ad-94276f1f67b6", "comment": "Malware payload (RaccoonStealer)", "value": "aa951fc3423e1b7605defdfdddbe3573", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823443, "uuid": "52d5167c-af42-409f-9169-0ee17df42b3e", "comment": "Malware payload (RaccoonStealer)", "value": "795c3be6da61368e6bd09aeb8056d05e69a59e179d27752b10b9773bf2c0696d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823443, "uuid": "9e8c34a7-5ee2-4828-acb8-2d3743e05ee9", "comment": "Malware payload (RaccoonStealer)", "value": "7ee1763907cb4a0fa9e6a3cfb292cf8d66cf8584", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823443, "uuid": "fd8e8ef8-5173-490d-a7ba-3584db17ee32", "comment": "Malware payload (RaccoonStealer)", "value": "74d8c7bcad032b841f7064c86f8d726ba9b10930ec6cc7ac98487043f692f70015d64dd1b43b2566f690d1e47c857078", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823443, "uuid": "808b15e7-1bd6-4a9b-af91-add3ac119758", "value": "T139B4F1196E50E833D582C6B18823D7B4DF3DBCB2592C405B7784FE6B3E312915A2E396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823443, "uuid": "7da7404b-2392-4d8d-83c6-9f7bd808c56b", "value": "f530acf7acd4a5c8880ba2a4704d4cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823443, "uuid": "1722ffd8-6869-489e-ab91-55b35fe58aac", "value": "12288:S6xbu/Zx80IL28tPTVVqZApGDkjEZAnf:FEZxCtPTVwCMmE2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823443, "uuid": "51fe1057-5365-4439-a4f5-fc648763d4da", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823443, "uuid": "b56220a2-e472-441d-9e7c-6badb1e27ae1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823443, "uuid": "c53accf5-6cda-449b-82c2-2f2b1eef2e91", "value": "aa951fc3423e1b7605defdfdddbe3573.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a506432a-0e1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630826814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826814, "uuid": "568eaf0a-4ba5-4d90-b3b8-42ce36898854", "comment": "Malware payload (Buran)", "value": "69850aab130dde5ccc6243a37e0248a6", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826814, "uuid": "d18511a6-bc59-472f-b1df-c8aaec46880b", "comment": "Malware payload (Buran)", "value": "79d3180a8d2f44422adca9e8f3a1316458c4f9b537996cbda2031c0d93f8532e", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826814, "uuid": "89064256-e165-4540-b968-0da39ec62796", "comment": "Malware payload (Buran)", "value": "d59bd4e67df765c14c7db0b94cfc6561436afdd6", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826814, "uuid": "5b25267f-2e29-45ac-9c6f-9ecc614e7584", "comment": "Malware payload (Buran)", "value": "bf2b04d03e83175259d49784e267d642547352e1f140ea342d50ccd3ef5b6b7022576f6a3ae23507490afc838daaeaec", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826814, "uuid": "8b976296-681e-4e12-a5f6-c302a6038259", "value": "T1F694BF80FB4821960A832357EC6352D2FA7DD11153402168ED5FA3AC6B475ECD37ABBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826814, "uuid": "084eda9b-32dd-4fbc-85aa-b220694bd80c", "value": "12288:0Xt8Dz7sPu29x3RgU8YmkTflvfXCsPoQ2RgJPii6:0X2DAx3RgYm+VPpQ1Sii6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826814, "uuid": "4d1ba9f2-7141-4b12-abc9-6b95bdde03c0", "value": 442461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826814, "uuid": "8d4d179d-27dc-4912-8671-fe6dcac73f0c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826814, "uuid": "3dba45cb-4a96-4a2e-9ca0-af34640b1cc6", "value": "6287.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b15b527c-0e32-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630837142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837142, "uuid": "0c4ed531-3fea-4e5e-8717-62c778b88368", "comment": "Malware payload", "value": "f72955ae17ea7c6aff099cc50d690f03", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837142, "uuid": "4db175ff-7ada-455b-a4e7-49025f4a598b", "comment": "Malware payload", "value": "7a07da99111273d0cfd40ec33e3e84cc0eeeed3748e03f03f95c2e0ae318b4a3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837142, "uuid": "fa343d7f-ede9-4135-983f-54cbf60d8271", "comment": "Malware payload", "value": "8e403eace481a60b3a227caf6f647d5d3ca8352a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837142, "uuid": "0a442170-f6b4-4e4a-9eb4-c3a6b8324f4e", "comment": "Malware payload", "value": "83557bef29cf18954747521298cc7d45be9f21aae583276391636b4c93f83ade12adf04df7a5887a76ff36d2d2adbd65", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837142, "uuid": "3ff7a9cb-a017-4f37-b3cc-3a537c8e715c", "value": "T123B4BF51FB4411561EC3639B9C1262E2FA3CD011534121A9E49D93AC6B876ECC3BEFBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837142, "uuid": "7a0c51c7-8d77-4fa9-8ed0-370cf1e4c2f3", "value": "6144:0kOBFat5zt3gTntrK6PeJ139rz/WC6Oqd3U0U1e/xD+XtlOfyF0+kZc6ksi04+6H:0kOvNa3h/PCPAbF++P6OruxBQCjJ5ydv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837142, "uuid": "67e4abc2-326d-4d2f-90ff-7692b26ecace", "value": 496957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837142, "uuid": "71a5e26d-6a79-4f6e-8a8f-2c6e9fdab03c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837142, "uuid": "26a57b68-323b-4516-8f2b-98ea140f1373", "value": "4097.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f55700-0e2c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630834630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834630, "uuid": "f146d0a6-dafb-4d2f-9e04-c2f2da641d74", "comment": "Malware payload", "value": "828d9c64c802a12eb1f69f478097a6d8", "object_relation": "md5", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834630, "uuid": "53cdcf1f-2f5b-4afa-8db1-8e675a0a17a1", "comment": "Malware payload", "value": "7a20e83b3eb11c81bafa619a97e3809d0631716b7b1cfea49bbdb93d8ae94144", "object_relation": "sha256", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834630, "uuid": "a001f0b8-def3-431e-941a-7c2e62fa3376", "comment": "Malware payload", "value": "ea5712b5aea446d9c441554bbf28fa00636e20d7", "object_relation": "sha1", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834630, "uuid": "0ca4ae15-436f-4ccd-9d5e-2e51560acb77", "comment": "Malware payload", "value": "537c21d2ece20b5c83fdcaadea4d5b9e39adcbbafee87cf15547a7cdc637c223d99b4ebd9f3057f02a61e188650d2be7", "object_relation": "sha3-384", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834630, "uuid": "38c09ee8-bcad-4b61-bd73-801910803156", "value": "T12086191277FA8939F1FB6B70ADB852A54ABFFD615F30C08F1250568D1930AC09A74B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834630, "uuid": "31980f26-7d05-4b4d-aa25-bb9a7efe4cef", "value": "e2d28022f7d79baf4229614e32d8540d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834630, "uuid": "a63398e7-1686-4656-b0cc-24f4639cef8b", "value": "98304:KsVXH2gbTfJi2plgyrsVXH2gbTfJi2plgyXsVXH2gbTfJi2plgy:KstH2g/Jl3stH2g/JlrstH2g/Jl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630834630, "uuid": "0472c3f3-c49d-46d6-8e47-261f96b09d09", "value": 8397371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630834630, "uuid": "e88b88ba-309f-40ab-b42b-870fb103892a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834630, "uuid": "bd3fda89-cec7-484f-a6a5-98ac3d63ad1b", "value": "7a20e83b3eb11c81bafa619a97e3809d0631716b7b1cfea49bbdb93d8ae94144", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16703a56-0e2f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (a310Logger)", "timestamp": 1630835594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835594, "uuid": "267668aa-98b1-4a87-87d6-887ee719aad9", "comment": "Malware payload (a310Logger)", "value": "780cc6d61d19eb61fbb2566fe8f39b4a", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835594, "uuid": "3b401e31-bf7f-4605-a0b5-ed588ee9a8fd", "comment": "Malware payload (a310Logger)", "value": "7a30162550b7e83cf48b73ad034251cbc6e053f9d20809c4f4beefaef28c8754", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835594, "uuid": "a44d5cd4-757a-4e38-b410-221a34b78502", "comment": "Malware payload (a310Logger)", "value": "08272cd98b5d17ba7f6bf204e7b0af78a2e44957", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835594, "uuid": "196fb9a0-b703-40b0-b224-29fee55d1a79", "comment": "Malware payload (a310Logger)", "value": "4ff226cd611b221f5bb963aa1751bed372b60e2b4a1e475cc871d5fb522646eada8a1e343466b3f37870efdaf14c8b58", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835594, "uuid": "9363e808-b1b8-499f-bd0d-c53df2c6ccf7", "value": "T1D024F636B781F42EE482447DB919EFA55424393069A8C443F7C2AF1B38715EBDA25F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835594, "uuid": "0c1d1077-e3b0-48ad-862f-37677f5aa8ff", "value": "d746df0c6d243e11e2680c79fdf70b3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835594, "uuid": "f8473f44-c00e-4844-b031-21f8f3b88eb3", "value": "6144:HwEfD/i1lkemVTtOASZNaEz2RL1enFSC2X:VmetOfNq1oW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630835594, "uuid": "0ac13875-6020-40ae-b7a5-55e82c0804ae", "value": 213504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630835594, "uuid": "af6910b5-4903-47bb-8c85-32064b87fc64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835594, "uuid": "4c3f3cd4-20dd-45d6-9f58-03e464abf973", "value": "090009000N.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc534d7-0e4c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630848411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630848411, "uuid": "e27d28cc-f9a4-4081-94fb-5fd47b072c22", "comment": "Malware payload", "value": "de2eabe14fe2c07a014231c81abab721", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630848411, "uuid": "e812ba6e-f1a0-4b64-a665-15c7917d2260", "comment": "Malware payload", "value": "7b7700d8f8e54a0fb0bcf0f05aeece48fca94abf975ba9ca1fa8dfdae435d392", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630848411, "uuid": "26b9167d-6f1e-43b2-a514-44402cd2d4c5", "comment": "Malware payload", "value": "a357b3ca1e9eb52abd4d129b0d46900f77404ca5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630848411, "uuid": "7f0f103a-8da1-4e74-8df9-23507a92939f", "comment": "Malware payload", "value": "d82c900f20c03aabbf1e88840825a576a1b5a1fdfcbc24b4d80a5299d13a858b31dfc275194bad56419db250aa097514", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630848411, "uuid": "904b838d-6313-4fdd-9b53-7abddde80cb7", "value": "T173E6234EFB58BD5AC0F7933246B69131B10A0C358743E6839A4577BC68B7BF40A46BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630848411, "uuid": "27919817-056d-4461-8916-e489f9542a41", "value": "196608:eDBFnI88FBCWpucjxPccZ90VBOw6du4PtvCk8jdTLm5FW88XfeXaVrXejt/hlyfb:eh2vIcFTmgduMtvCkqm558fmMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630848411, "uuid": "02b5d841-aa19-4ac0-99e8-3078ab04c38c", "value": 14953313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630848411, "uuid": "24885944-0b16-404b-8873-44e0f76b080f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630848411, "uuid": "dfda91db-4dbb-4f46-a7e7-2b62830c543d", "value": "base(10).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8acf084-0e24-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630831249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831249, "uuid": "4aa1cd07-8554-42f1-86ae-b76d24080442", "comment": "Malware payload (Formbook)", "value": "8aeb8cc6c631779bd9c927355d4c591d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831249, "uuid": "83d11c16-a734-4eb4-a330-ed53bcf1eca8", "comment": "Malware payload (Formbook)", "value": "7c58b95decda2100b74cbbd56896180a42b4a57ad3b7b2e6c69ac86ec23207e8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831249, "uuid": "4f5efcf2-8542-43d1-9fe4-88b084ba7c7b", "comment": "Malware payload (Formbook)", "value": "772315a9fcec8fc3244645c40c0e0a62508da139", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831249, "uuid": "054be519-a1ef-4949-9291-1bc6555c33b0", "comment": "Malware payload (Formbook)", "value": "9f2e90c608346266fda7688ec80f71e5e24fbce7fc59b4f71e84de953d6ce74991b8de6bd243537af1bb562cd17fdea0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630831249, "uuid": "90608325-7482-4b40-bd72-a9874760b0ea", "value": "T169A423F26146E6AA80C2CB367E72CF4C69D74DBF99A0410E4653F4894BCE1D37F9A811", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630831249, "uuid": "b6451a6b-86f4-4895-b372-9dba3d5d0c26", "value": "12288:K4+f5dYbjOIjhNfCPyMfqNOqSs1Vi00o1HSqKdFGh2:K4+f526IjHfCKxG0/Zil", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630831249, "uuid": "1f37ed1c-5097-4ddd-b4fd-3e8e8e37e546", "value": 463187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630831249, "uuid": "2d5d2517-ddcd-40a1-96c4-366e6a360357", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630831249, "uuid": "7f50ff91-8795-4e15-b50b-befab7459884", "value": "Swift.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64eeafbc-0e0a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630819834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630819834, "uuid": "77b9aaad-426b-4da2-a4fb-a6af9190d984", "comment": "Malware payload (AgentTesla)", "value": "6374267fc09cc18518f18f42244263bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630819834, "uuid": "0af3782d-de57-4da0-bb29-4b7538a011b0", "comment": "Malware payload (AgentTesla)", "value": "7ff75c0500031d395fc1499baf0df4451ce11a8bc8d5bafca1ff5e84a45d4aeb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630819834, "uuid": "5b0400bb-ffea-4536-a6f5-e37459203971", "comment": "Malware payload (AgentTesla)", "value": "53d7fd5ad1fd4d175fb3077032d23c5c0ef8e703", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630819834, "uuid": "8611968c-8b3f-48a9-807b-e742b55e5234", "comment": "Malware payload (AgentTesla)", "value": "1c72770674017b8c4c4c1db973248b1e53373283002329901e42c005e3119fb97c13b16d901b1576e85161617869c8f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630819834, "uuid": "4a067bdd-93ab-4645-8138-8ad88c91a607", "value": "T1BBB42321D21148725A4A8F65121AC79F3F8425F957CEB72F823DF318A3AA8398FC59D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630819834, "uuid": "9794df23-7698-4424-8805-38438a20f655", "value": "12288:9932Uj4gHXdifmNqJvU6biGRYpZwcjmPmDytu13TrSiJP:9DcWXdifmoJXm3nOmeA5TP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630819834, "uuid": "52032872-5ffb-47f6-9ce4-9782fd736e1a", "value": 515219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630819834, "uuid": "f7b1f650-5d9c-41b9-9f68-43990984c140", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630819834, "uuid": "6adbc477-1e9a-4932-ab3f-10ecfbe2640b", "value": "DL-PR-0721-2021.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd13ecb-0e12-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630823473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823473, "uuid": "585e9d38-9127-4464-a6aa-8f1747abae90", "comment": "Malware payload", "value": "4e5dfd7f0fb64d8df60c6b3491d9fd82", "object_relation": "md5", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823473, "uuid": "f3c206eb-cec6-495f-99b2-2c99047d8a7f", "comment": "Malware payload", "value": "813ab70488289f7a5625d12e8398bbc4167a146e6c0b01ffd601cd2d8fae1c5d", "object_relation": "sha256", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823473, "uuid": "3f3b43ec-8c56-42ad-9de5-29f9ca3a2709", "comment": "Malware payload", "value": "c4a0369167ace521f1406435e23097a72966d209", "object_relation": "sha1", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823473, "uuid": "2bf2554d-55aa-419c-8c9d-de115446d1a8", "comment": "Malware payload", "value": "0437c9cce40b69f32c75cbbae6e40fc2c968c85ece46bb7c62ebfe11f84ac0b58a7cdf9ea7d2df330f05a1115af068a7", "object_relation": "sha3-384", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823473, "uuid": "86b5c108-ef40-4626-bee9-e73eafc55902", "value": "T1DC72CF5CD162B464E3924FBA898D42D1ED451ACCD649D9B28F18BA7EA6072030F5B1CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823473, "uuid": "d41d963a-2780-4bd1-b68d-4cfa18b4e4f2", "value": "384:AKly87RsjlS7EEwXL1Y9DSW7Wurw3fFn2hcjuMQITMaTPk37:AKly87RsRGEnKZ7Wow39scju/IgF37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823473, "uuid": "bd3c8b72-d084-477e-9006-ed8a597cab6f", "value": 17273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823473, "uuid": "99318e23-0aaa-466d-b773-7df9c9b7ba55", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823473, "uuid": "6005ef81-7b49-4c88-9b92-16e977a87906", "value": "PO41906332.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a108d3ed-0e46-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630845705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845705, "uuid": "e70260d6-62ad-4b11-b83f-f05377b8ceac", "comment": "Malware payload (AgentTesla)", "value": "fc1fb20075d3c5a4045be6b3d2ba3809", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845705, "uuid": "0439b862-e0fc-4a16-a4d8-7e7ad23fe83b", "comment": "Malware payload (AgentTesla)", "value": "820a972723dc78598720cdb8ae70de172492f77b0cad219d8f27f3009a148b22", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845705, "uuid": "fb9d7328-850c-4f69-b447-237ac9530ad8", "comment": "Malware payload (AgentTesla)", "value": "a22e1cc99ad8c1e9e11973f04c60669cc7c1deb0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845705, "uuid": "59dc5178-ea62-42ee-8fff-3f4321418dbb", "comment": "Malware payload (AgentTesla)", "value": "85575fe6c6916db9086cdf2fa6b3ea7bba212c990ecaa4bce6f61345b61c1e9cc45b5fd124026441a1b9acdff17df0c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845705, "uuid": "c1c3bfb3-9243-4c7b-b728-2ce59b415508", "value": "T1259312414F8687662A83F1502F3D90253D8950B4AFEEC45D78E6F2AE6C42CFD1B5CC86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845705, "uuid": "0e30facd-b013-4057-95f0-f2539aa580ce", "value": "1536:KIPf6vK7EENTcxsEm9SjfOGzKrKy+lZcpoUAaANb+Tod0MWjhuH:j/NVkmgSGzs+bcp0BNaT5NhS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630845705, "uuid": "57d03ffa-ccb4-43f1-9956-a1d0e62923a9", "value": 95182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630845705, "uuid": "9a7b74e7-d6d5-4b44-b865-688092f319c5", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845705, "uuid": "544b1356-78be-4889-8560-3da0da100757", "value": "Offer List Lebanon.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54494ce4-0e1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630826678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826678, "uuid": "71c49094-420b-4287-8501-beababfd1515", "comment": "Malware payload", "value": "aaa401dfecb9b2df1b76e83ab533c1f7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826678, "uuid": "b35e178f-3e07-4efd-b9d6-cbf229546cab", "comment": "Malware payload", "value": "829185afaf0969a150d9af7f31cc5add114b444d142289f0e214e67911d239bf", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826678, "uuid": "bdc940bc-d125-4822-a855-75396cdd3587", "comment": "Malware payload", "value": "93c94b1bd6fb6e3a1ed6a802d64b8645d128ee1a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826678, "uuid": "7801003b-bc78-4214-b6f4-af157521f09e", "comment": "Malware payload", "value": "2686e7e547f3a2796d233ab2ec09bf65b5f1f8920e736d327b8b86f870c1d021d26cd95113fbaa2871911f53b9eac508", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826678, "uuid": "b506eeb8-379d-4fc7-bc73-88e271c1906d", "value": "T16814231B4B8A7CC0357829B7D73212DD803EA9D95ABC81F51FA71CB49CB9E709A300A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826678, "uuid": "c4762c8c-05fb-42f2-a8b8-1d6a4347ce1c", "value": "3072:FOAS7sbo7AouOXICRxW7/l5QkvCLurkDsifhhdx+1Nc/V/8Z/zbL4J4:Jw0Zo1ICLk5Q6CDX+1Nc/F8Jb0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826678, "uuid": "b4409f6a-0486-4b49-89cb-464e0a8580e5", "value": 199114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826678, "uuid": "1a0b75fd-f3df-444a-a64c-e783e286b0d1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826678, "uuid": "8a45b9e5-410f-47b2-a05b-4d36dfcf0cdb", "value": "4805.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d8c299-0de6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630804538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630804538, "uuid": "8996c5b2-0ce0-4265-9a4a-74d0687614a2", "comment": "Malware payload (RaccoonStealer)", "value": "a75ffc6ab58574119e960ec0b1f72bfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630804538, "uuid": "75ad7e6c-7bb1-42a0-babe-2644c0ac328c", "comment": "Malware payload (RaccoonStealer)", "value": "8303c9a626d7edb090bdd8f0d128fc887b7fa36b0dfc43a7f71dcb5b34b1bbab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630804538, "uuid": "580ef251-f435-4d5b-b0f1-c94db2053456", "comment": "Malware payload (RaccoonStealer)", "value": "f7addaaf851436721919294927253726b67ce17b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630804538, "uuid": "b6eb12e2-456a-4f1f-a4dd-c9074c9e1ddf", "comment": "Malware payload (RaccoonStealer)", "value": "c06be24f73ff1a884cc31fe32506e6029c98a2668a03ee648ecce4eb7a4bfa0d97d0b54ee82d8dbf2cbc7783f1ffa0d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630804538, "uuid": "82af912b-469d-4940-99c0-2e640fd7d276", "value": "T100E5331037D9C8F2D4821032CB886BB3E1FDD39C292769C77375561F5B28CD6626AB1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630804538, "uuid": "71a17d19-e0de-49d6-b1aa-2a498a4ed808", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630804538, "uuid": "82e2f02a-334d-4a30-a363-c389a350b363", "value": "98304:xnCvLUBsg9Xr8A8IzhdMLpxytoEKyCPwpAuYxoNl:xELUCg9r8jIzMLpxyKdXuYxoT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630804538, "uuid": "a3c301d2-88ae-44a5-99bb-04bdbd40a8a5", "value": 3158917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630804538, "uuid": "3590311c-538d-4998-99d6-5df4fd9a6dd7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630804538, "uuid": "fedb501a-b468-4b2c-87b9-98aaf4514598", "value": "A75FFC6AB58574119E960EC0B1F72BFD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6c3adcd-0e19-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630826495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826495, "uuid": "c7da31c9-19df-46a5-a5d4-eb38bb1f3bfa", "comment": "Malware payload (Formbook)", "value": "fa26144142a5e69b467750ebb5afce87", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826495, "uuid": "bf29262f-1739-4487-9194-eee36764a90c", "comment": "Malware payload (Formbook)", "value": "838bbbd9b48b401cb8d9c28671aaeba4e13358c682366a64f16e5460351c5ef4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826495, "uuid": "4440bfcc-eecc-4dea-a9a8-a2961862eae6", "comment": "Malware payload (Formbook)", "value": "cfc159aa742a9270b6f8d2520be9be5be751a599", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826495, "uuid": "df81a0ee-efcb-48bd-a202-5f2995a1713c", "comment": "Malware payload (Formbook)", "value": "639fdc906ce827c8bc6dbe1509868b6008ff5725d755fd05f122cbdc11143b2ae613fd9b2c32ed4cda1379b50d354ffa", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826495, "uuid": "e7547214-f665-4b94-8a22-5c3cb711d5a5", "value": "T1C5A423A300A10FE4B45716999144A239757FB288EB33F9D5E819B7FF73009178CAED1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826495, "uuid": "89857de6-9ee3-4fff-aefb-7b7cf3789790", "value": "12288:T6Eqs3L+WYnV03xby+v+cKadUwElJjUKsN/bQR3mvKy3:TP/3LXYnV03xG+2LavEnjUKsdbQRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826495, "uuid": "6579a8a4-b04e-42fd-bc91-9ed6c7ddfba0", "value": 466089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826495, "uuid": "5f8c7cd8-b75d-4a32-a043-43c71d723ed7", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826495, "uuid": "79d223a5-12d2-4694-aecd-88f7a1803068", "value": "NEW ORDER.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d8e04c-0e2f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1630835558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835558, "uuid": "8ce98280-c62b-42d3-b285-85f6bc14aefb", "comment": "Malware payload (SnakeKeylogger)", "value": "b658f7d886f1c85fe45f40acc6279339", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835558, "uuid": "8e12dd77-24cf-4e4f-9348-3087774e2456", "comment": "Malware payload (SnakeKeylogger)", "value": "83c2da549473b2d768dea84ecbf64be9b679d740e5942bb70e250e59b4e84a43", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835558, "uuid": "b7c2c0f1-a4bf-40d2-a45e-d99a9a08c8c3", "comment": "Malware payload (SnakeKeylogger)", "value": "47ee9cbfc039afa76b34cac43be9530c98153ece", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835558, "uuid": "4c61502d-6ea6-4298-a3b1-50eef8f80bcd", "comment": "Malware payload (SnakeKeylogger)", "value": "d909ce8322b947a2d3010c3472e76ceb319d42cac02f61a2b4b849a815d9d16ab07d247ff2681bbc282afafb4c5acc02", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835558, "uuid": "4a364dde-e655-4a64-9a55-0aae944bd0b3", "value": "T10074236BC0CB2B4BD558840BB9379F4B390BA4A1749C6D4347F635B369C9C68216BBCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835558, "uuid": "add93f6e-e40c-4cc3-9fbe-d928ed0d8297", "value": "6144:qnEFbD84Bu1QaDfMnLPhI2w9A4Y3P+z7yQAGB60I5g/wlV/CEYz8ELj5cOmd:qnYs4B7aonLhw9AfyWQADHg1EYHZ/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630835558, "uuid": "767ad883-5ddc-4c76-bcdf-4434f535b195", "value": 339118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630835558, "uuid": "ec28533a-839a-42c3-96e0-81c466a7e76d", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835558, "uuid": "105a23ea-31bd-4d79-a7ed-05914e6b6d14", "value": "Sales Quotation 309020032012.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e4dbf22-0e19-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630826373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826373, "uuid": "380f6076-74bb-4339-8f3d-15169d0a1a84", "comment": "Malware payload", "value": "8b23da56083d95d0665489ceba75a417", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826373, "uuid": "1728308a-d7f5-498f-a16b-7e1a24c2e3e5", "comment": "Malware payload", "value": "8499d01b9aeb88d6deb37e57e22049fbe6981970c4b461ec812ca64a976c771d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826373, "uuid": "eb7bed86-7ffa-4a9e-8614-3efcd1b8c20d", "comment": "Malware payload", "value": "b8388d44d4fba6bf98cfff33385507b242f1e4b1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826373, "uuid": "f8d086b6-8c2f-47cc-aa89-0914272f9f0c", "comment": "Malware payload", "value": "26a22a263cd72785b7cbfe43ed798c26df1ec39c49c907f0cb28ad72abf74a2c765d7f5d9b18a2249e56552ceb627359", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826373, "uuid": "d086f6d8-a1ed-4322-8200-7f3db2fd6d17", "value": "T1C505CF50EB4411660AC363ABAC5352D2F93DC10193402168E99F93AD6B475ECD3BFBBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826373, "uuid": "a4edf12a-a6dc-4e7b-91e7-e191b72168e1", "value": "12288:4+moeSLrIOcXKMPHib6EfpyXt8DtcgpUrS4W7kaJNG9JHS0no2:VmTCrIJ6Hb6EfpyX2xI7Akiw94Eo2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826373, "uuid": "63598934-d326-44fd-9fe8-599413d96a9f", "value": 813855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826373, "uuid": "67b97fcf-a607-455e-8bd2-8a82f490cecc", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826373, "uuid": "8fa93d87-7bc1-46e6-ba96-dc4016f3cc98", "value": "6522.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "879a9057-0e13-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630823758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823758, "uuid": "ae0eb501-8abe-4f91-8997-1adb1e3b454b", "comment": "Malware payload (Buran)", "value": "741cdc1daadc1a1996046d0333b23926", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823758, "uuid": "1de6f02d-80a2-4316-8757-ea50a109ea41", "comment": "Malware payload (Buran)", "value": "855c55aac5357288a303d5b57cc8f46334a5e1886b5343ad8a94f056e7eb8194", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823758, "uuid": "b1026467-2dc9-46c2-b052-14de52de86f8", "comment": "Malware payload (Buran)", "value": "f4e30890f50d161fcfc1158ba158b28f6d91aaa5", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823758, "uuid": "71c3db84-8de7-4288-9153-11a3c22edfe7", "comment": "Malware payload (Buran)", "value": "777a5d1eb18c842be8eebe0fbf17498f99fefd18f293e492ecfa3c578dfd69637f852f6cebe97ae933a62dcd4e5d0a5e", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823758, "uuid": "4f3dd0dc-a300-4be9-9df4-e7eaa6b87080", "value": "T144A423319ABE759C9C7A8402630BF8E52079EF1102BD2578A57D49392608BFFF704F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823758, "uuid": "244922af-2684-45ad-a192-47abc3975752", "value": "6144:fpsvnf+8cP73Jq0X9Stam7qgVoqfHDJyhs1vo9lcfr9jyKwPFsZETrEetN7SDbE2:x8k3Jq0X9eloCJbA+p3IFrEe/9uT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823758, "uuid": "d054a698-d897-4981-b829-81cf617dbdf1", "value": 472293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823758, "uuid": "8e11150c-1fd6-41e4-bae3-f85776cdf491", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823758, "uuid": "41e6c9e7-4436-4e07-9859-d06338b3d482", "value": "1332.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e48debdd-0e0b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630820478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820478, "uuid": "4260c181-83f8-4f3c-947d-fcd454fb2b6a", "comment": "Malware payload (AgentTesla)", "value": "32cd535b1d67a67f82e5f6e9ee258612", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820478, "uuid": "42e7fc21-6dd4-4069-ada9-c20b302f5004", "comment": "Malware payload (AgentTesla)", "value": "8682bda347b26e752dfbe5d907b80ca4727187fb96a9212e9bde95b46fe132b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820478, "uuid": "a481b4fe-eecc-4027-b441-0922cbb9bcf9", "comment": "Malware payload (AgentTesla)", "value": "82d71e4ac758498223fa78ed3028147b1e85adb1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820478, "uuid": "31272adc-9a0c-4b1a-a85f-7174cd669791", "comment": "Malware payload (AgentTesla)", "value": "8a52ebf33cc98050a40f6f524e25456c952d02e9e94fa4111a72c6bff9de8c5faff29076c5db2f081765fdd52ee8ee1d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630820478, "uuid": "c60cbb80-c669-4a71-bb0a-5f9447603697", "value": "T11EA4232901328E4EFED6EB17A1047A8566B7FA0AEDC302F9248D723537D5E785CD24E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630820478, "uuid": "3499b8af-30d2-45c5-ae82-24ae20d826cb", "value": "12288:XpQpTHOcmT4VcqlMhTWkbhL7Cb/JTBn0K5grTiu:WD+ylwbh3w9B0kgrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630820478, "uuid": "80e3e7e8-71d7-4151-ab00-9f3a77f86fcb", "value": 456256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630820478, "uuid": "9d1fc440-fb20-4106-83e4-0164a1ba3869", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630820478, "uuid": "985ba425-cc2b-4df8-85da-39896bd2a682", "value": "NEW PO 3434.Z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "713b5ba9-0e2a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630833599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630833599, "uuid": "ab18aabf-52e0-479c-8dd9-8ca63966c0c2", "comment": "Malware payload", "value": "6a5bb8dd8e1f6bb18602fca0e309f0e2", "object_relation": "md5", "Tag": [ { "name": "CLFS", "colour": "#F50809", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "STASHLOG", "colour": "#93012C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630833599, "uuid": "6db36868-7e0e-4d3b-bfa0-029de5f5374e", "comment": "Malware payload", "value": "869165044402a5f82f4cb8ddd51663ebb05f86345f346f765dcc54b20706cf7c", "object_relation": "sha256", "Tag": [ { "name": "CLFS", "colour": "#F50809", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "STASHLOG", "colour": "#93012C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630833599, "uuid": "b3604498-dbfa-4ec8-bfff-c52e4bf6899b", "comment": "Malware payload", "value": "4d1b8791d0715fe316b43fc95bdc335cb31a82ca", "object_relation": "sha1", "Tag": [ { "name": "CLFS", "colour": "#F50809", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "STASHLOG", "colour": "#93012C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630833599, "uuid": "3c0854c7-6317-4fbc-a27a-aec7a42a7dad", "comment": "Malware payload", "value": "5b9f663e792b7228d9817d0e3c80fa9a3d48decf1aca2877ffbb7da739447614292f83951062fc7f59a2af89e05c8ae7", "object_relation": "sha3-384", "Tag": [ { "name": "CLFS", "colour": "#F50809", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "STASHLOG", "colour": "#93012C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630833599, "uuid": "0b0fbb98-fb62-49a9-b6e5-8e3a5c2efb12", "value": "T15674BE02364088F6C0B5543C0EF9BF79C76FB8405968AACFA39C0AD94DB51E1D96939F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630833599, "uuid": "960b37f7-5f2c-4a00-9761-42a9f0b0af1c", "value": "82d6e4bf4f14c83adb28faf787bd64d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630833599, "uuid": "8174a40f-f07f-44c3-9b7d-4c7ba0d542d9", "value": "6144:eDUHgB9QEtvTzMmXy1A8jxdBp16BO1ATk9irTxp:aQEtvTImC1AuLMTxp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630833599, "uuid": "d7c9f51b-2880-473b-ad2a-f26fe80da094", "value": 363072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630833599, "uuid": "cc75fed0-58f1-424f-8ad3-6180d1b08205", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630833599, "uuid": "53accb3b-aee4-493c-80ed-9459193b6ba9", "value": "869165044402a5f82f4cb8ddd51663ebb05f86345f346f765dcc54b20706cf7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36117b57-0e34-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1630837794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837794, "uuid": "d542ed33-0111-4dd3-8845-e3bc6af72f70", "comment": "Malware payload (Vjw0rm)", "value": "f924ea1d9a529af64d57c5daa6f55bab", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837794, "uuid": "d11b1264-7160-4719-993f-dac87712d40d", "comment": "Malware payload (Vjw0rm)", "value": "872339e661e1a90638d6981b8b09d56cccebdfdfad0fabb2c5100f4c05bccce7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837794, "uuid": "f44f32f0-ee4b-469c-b988-a87f56e8059d", "comment": "Malware payload (Vjw0rm)", "value": "e39ec476abb7acce4e713f15fb121ceed72b12c2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837794, "uuid": "b035e46e-ca7f-4bda-baea-00347c776ba9", "comment": "Malware payload (Vjw0rm)", "value": "d4ab0fa810ddcb9bd5549c66acdf00d362a3362a29d78c2039fb5f23539350af8fe27a3781e6e89871e0e85c8046e04b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837794, "uuid": "40f77f82-9dbd-4ac8-83f4-2221f68d4c00", "value": "T12B24AD483DF8B57DCA4D822C742B2F9933A07FBA9435CD897CFCAE014B86D09D295199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837794, "uuid": "0ad19ab0-e509-46d0-953e-96d94fb98e59", "value": "6144:tU5lqJ5dGjL4i86p4hLznblMs57Rn+eiX:+Ed4E5bh/RXC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837794, "uuid": "4ad74d02-7b47-4bb4-a668-f1077600f99e", "value": 210388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837794, "uuid": "5d1d7b24-90e1-4533-a5e5-50e2112b4c90", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837794, "uuid": "cc4f1f51-47f5-4a0e-a501-ca2a90950eb7", "value": "MT103 PAYMENT_ANCHORS_4263782872.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c31779-0e32-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630836969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836969, "uuid": "d19558f6-f0c9-4f80-88f4-6c7fb04fefa0", "comment": "Malware payload (RaccoonStealer)", "value": "896ed70284997887f5a37775cf0da1b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836969, "uuid": "b90ddf05-eccc-4151-a482-0e3ec74817d7", "comment": "Malware payload (RaccoonStealer)", "value": "87bdc3438fc88826fa826f8f6ef5f9eb518fd63eddde1e8b371a96ae2ab0a3fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836969, "uuid": "1bfe7e9a-0477-41b4-bc60-eae836663dba", "comment": "Malware payload (RaccoonStealer)", "value": "8328a3bf6f2831456c25f031b7093aeaea88bfed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836969, "uuid": "21c6121b-70db-4c1b-afa0-56379d02ba42", "comment": "Malware payload (RaccoonStealer)", "value": "a78d9f1cb3258ec788fa141341aec660a09c572cfdd89c5abb59f9c0dd9fc1ae521a08e2668e742d9235355807d86791", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836969, "uuid": "dc33a65d-6caf-467a-8724-7dd68194a3fb", "value": "T194B4F11A6E50F423F48AC670583ACBA7DE7D7CB3596045577708FB6B2E302C0A92E356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836969, "uuid": "4a1c83fb-1f1d-418b-9cbd-079ff35eb75f", "value": "b2c249fef864036a8cc857592c5ce556", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836969, "uuid": "042a2341-4885-4da8-918b-718c2cc3fe9e", "value": "12288:HHYRgW5KtMplcwXO61ZvUG9P68fyGXDkjc0f:nYWW5sMplc+O4vUeP68fzXmc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630836969, "uuid": "1b66ad46-7b6a-4c94-ab93-f0e30aa386d7", "value": 534528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630836969, "uuid": "2f562770-ca56-429c-9263-3647f5dc13f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836969, "uuid": "b4b7ce14-66ef-4873-af10-a75c1ef709a5", "value": "896ed70284997887f5a37775cf0da1b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d9130a4-0e0b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630820171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820171, "uuid": "5f949744-9434-4eac-a384-5ec33bdcd9be", "comment": "Malware payload (AgentTesla)", "value": "7f46895ab155faaa4b63a62f180c5046", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820171, "uuid": "10af55b0-5e43-4f50-b3a1-bde81ff98aca", "comment": "Malware payload (AgentTesla)", "value": "884db1281cb81cf4240e620e1eb575c94c8be5c290837a761efc456cb56c17a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820171, "uuid": "96e53a15-852d-479b-b0e5-280c917eaae9", "comment": "Malware payload (AgentTesla)", "value": "576bca6fc6d176739fcaf9805a8ce84d73165780", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820171, "uuid": "4c3db900-3a6a-4b20-bdf1-ede7d44e15b4", "comment": "Malware payload (AgentTesla)", "value": "cf9d4d4ad496003932c848ded5bda3082228d904677fbd3cb60f8222a1062ac5bb59d80c0095f2e2dba0b9d33cb67465", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630820171, "uuid": "c6e0f629-624f-4d97-8b76-65b20903227e", "value": "T1A47423E53F5B080B056F0BB1BAA5873B234B6BC7549D483AE78B342B4656F145603A3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630820171, "uuid": "cb0c7c96-d1c0-42db-91aa-b58e560e1513", "value": "6144:BxOwpqdMNDD6FmzUZQ4ikJfSRN0EeTUveCzrXCsnRDNg9rsMYg+CJWefE:BUw0iDNzh4iLvXOUv7X8dsMYJYWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630820171, "uuid": "c7c5daf3-d473-477d-90c1-51702877b05f", "value": 358219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630820171, "uuid": "15d931e6-24ba-444d-b8d3-50ebc3076a0f", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630820171, "uuid": "8f96dca1-b930-46a8-9279-f6f9dea1980d", "value": "PI Copy.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c7d9f30-0e46-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630845563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845563, "uuid": "3b194f02-ac62-493b-9b7d-dd36f5b35ca6", "comment": "Malware payload", "value": "ff8f8fcb9433c8db82701215f9e84f28", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845563, "uuid": "7dff82f7-12a7-4c49-9c18-0c164bf06123", "comment": "Malware payload", "value": "88f6cdc1fe371dd2293beaa3a86b3b426dae82dfea6d53d4b248b98b92b3c979", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845563, "uuid": "4d761221-22c5-4fdd-8716-0617d8b35a3f", "comment": "Malware payload", "value": "fa9f68603fd7be401d1cc2a7f5a1a0bbf19df88b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845563, "uuid": "4b35ca50-e38c-4af8-8d5d-a9fc31176e4b", "comment": "Malware payload", "value": "41fccd4e5fc8128b1019fecbb0b00e90e87538e1251164b3385dc070a9e39f51a058f3a8f741fef480e99c8898bca2db", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845563, "uuid": "5e87e629-102d-4bc9-9bf2-8ac1c4389686", "value": "T1EA92CFE1FF09F839DE7B00B8955816ECF58C926F7212935D200C726CD250DDBA7A52AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845563, "uuid": "6b7cf6c1-6225-4e44-8107-cbb3db6cc055", "value": "384:D0WjL1Z60XogO7emuUyrBZb69+UH1bGYg3q1AK3CON4p+dVAw8XfjJHkh9N:wUxjdmu3r6JAxq1AK3hN4KV3efS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630845563, "uuid": "2e003d71-59f1-4a16-941b-12313f168187", "value": 20006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630845563, "uuid": "066ffaf7-60fb-42f9-b380-7e7c6b994b2f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845563, "uuid": "85421a39-d0be-4915-a76c-43798f4fccdc", "value": "PRESENTED..docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfacf7b6-0e2c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630834643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834643, "uuid": "230836c7-98f7-4bf6-83c1-e101d1f9f708", "comment": "Malware payload", "value": "06740aa489c1d62a5fd10c8d937efc56", "object_relation": "md5", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834643, "uuid": "3b6eef49-43cf-482d-a2fb-1e746a1f5327", "comment": "Malware payload", "value": "89d02981de5de72d0557bf46e622a9aa72370140afb5ce1ef1f5bf989d864eef", "object_relation": "sha256", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834643, "uuid": "14937c71-19ad-4c39-a342-3d95595839b4", "comment": "Malware payload", "value": "f9be8fcb62ec9dceb1c4639bd7e3e56a539057db", "object_relation": "sha1", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834643, "uuid": "257a81a1-7c1f-4423-9c25-6b29baffa1e9", "comment": "Malware payload", "value": "eb29479cb865e65a6756053f8993bdffdfdbed80fdb5575c68bbb31b56e088466b3aa1e512dd662c4bafdb4acaed2b3b", "object_relation": "sha3-384", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834643, "uuid": "2f13ca8d-015f-4107-8198-7a9a435eda1e", "value": "T18886181277FA8939F1FB6B70ADB852A54ABFFD615F30C08F1250568D1930AC09A74B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834643, "uuid": "15ef1961-d9f4-4e25-b222-ac719ead122b", "value": "e2d28022f7d79baf4229614e32d8540d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834643, "uuid": "3d123954-70e9-409b-aaf6-921ca1e8f527", "value": "98304:KsVXH2gbTfJi2plgy9sVXH2gbTfJi2plgy/sVXH2gbTfJi2plgy:KstH2g/JlJstH2g/JlbstH2g/Jl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630834643, "uuid": "bc34ebf7-c226-4863-870b-a0a9cc7984f9", "value": 8425644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630834643, "uuid": "d41ffb03-bebc-4ce1-a4a8-2282cbd47284", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834643, "uuid": "08630292-c6fa-43f8-a02f-0c3db0956150", "value": "89d02981de5de72d0557bf46e622a9aa72370140afb5ce1ef1f5bf989d864eef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b7abded-0e33-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630837455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837455, "uuid": "b9448f15-be1f-46c2-bb2f-825313b77c7e", "comment": "Malware payload", "value": "1c8f64e9486ea9fbe7446caa6aeb4364", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837455, "uuid": "739e132c-b3ad-411f-9a2c-860a97c2cead", "comment": "Malware payload", "value": "89f6880040b118c2a49087e1ca3c6e9c757c43f9abc6822aeedc0669ed589e35", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837455, "uuid": "b849177c-0193-4675-9ec3-31c102616f67", "comment": "Malware payload", "value": "4ded75a48f7bd9453219da8415e790a6085339bb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837455, "uuid": "5d12b042-2568-4675-be44-56054fe5ffb5", "comment": "Malware payload", "value": "fbd16329b51c235f1d87fa4580f055c92c4d617fbf27a5ed60d4a77cb3716a2a56b0e6c803f68849f51d79b6cb2df723", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837455, "uuid": "a59a84dc-88ea-4d4e-b756-4d2b84693278", "value": "T1C674BF50FB4411520ED3639BAC1262E2F97CD410535120A9E99E93AC7B536ECC3BEB7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837455, "uuid": "cff41da9-b968-4052-954d-05f838cc1200", "value": "6144:QCxkFIQamFa1gtoYu2KZ1Fe7KWMP+mcpDtGV6A9hReAfuB1QkKfkOBFat5zD:/5QRwwu2uuKWe+DRGV6+WIfkOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837455, "uuid": "38cde243-e916-47d3-a3ab-0915f6bba118", "value": 343565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837455, "uuid": "ea7fc94c-3571-495f-9418-f8d14bd9e7e6", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837455, "uuid": "8dbccb09-d827-460e-92ea-99eb49bdae8e", "value": "3572.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a06924d6-0e1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630826806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826806, "uuid": "eb84c139-1f75-46e1-9ab8-c84350b22f27", "comment": "Malware payload (Buran)", "value": "48a9231a63eb00cf30197ae9965caafc", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826806, "uuid": "41f8d4fc-d4cc-4825-82c8-d4538303c777", "comment": "Malware payload (Buran)", "value": "8c1c573dd45d517a80e3992f3ed57ee111b1d7ce551a00700f4e77ca1ab3aa39", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826806, "uuid": "cfc156be-cdbe-4ebe-b111-f34eeb284deb", "comment": "Malware payload (Buran)", "value": "133a1ef3a9c750503c5eaf0445de4c5483ae2844", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826806, "uuid": "c91b39ef-61e0-477b-bc86-21277b14f75b", "comment": "Malware payload (Buran)", "value": "934135dc42dcd6d9a34c52135210682ad85295cbf150da7dc228b1c6f26614a67441c3cfa20696be5e4210a444c8b5ba", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826806, "uuid": "60b81119-2f0e-4e07-90db-ccf95c7349e4", "value": "T1F7442336EB91D72327863C5BD6B64A60239C73EF31CB47C01AA30A7D26790B555A43E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826806, "uuid": "2053f745-e6bb-43dd-9d96-a0ff44b7ee19", "value": "6144:6fZbe9RjoC0OZmZCHif1GPN29FrYOP1QsuLtG8Mm7e2G1p:IZbCRj10lACcP6rYe18xGI7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826806, "uuid": "56212832-1f5f-47b5-be55-42de65709556", "value": 265075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826806, "uuid": "f7f8195c-02d6-4aea-8a32-1be530b1d506", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826806, "uuid": "137afaf0-0eb1-44ca-b36f-5430f659823e", "value": "6287.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab26ef9-0e53-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1630851224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630851224, "uuid": "2a83f90b-d968-41d6-aa4b-3ac9e953c1e3", "comment": "Malware payload (njrat)", "value": "895ec58af5ab00e5cf169d7277254c0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630851224, "uuid": "dd4476d8-7512-4486-9007-d90ed321534d", "comment": "Malware payload (njrat)", "value": "8d5b7810bddd8bec2381134833ac1ce03d753cabe26436b96cba35cd3b3d10c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630851224, "uuid": "48357eb4-2169-455a-a0f9-8bbe8efd20ba", "comment": "Malware payload (njrat)", "value": "9dbe8246c6e7873b56fa68683839f1e1d4c04d15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630851224, "uuid": "7f4e4102-d18f-458f-955f-0d6f714cb426", "comment": "Malware payload (njrat)", "value": "bff58b74961db365d54af993fbf94db7b25a6963d5e6246c915c3eb6868695cb536758d69665ff94f8a16140a8ae874b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630851224, "uuid": "4a631128-2613-493c-9e12-e8eea95ec467", "value": "T14E04EC869966B14EC47805730A137DCB386EF0F3A7611436F29E4F08DFF98490BA67A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630851224, "uuid": "3aa3d673-d6b5-4cd1-8d6f-9f3729408707", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630851224, "uuid": "b3d63ec4-7671-4954-8d20-4cc120ed229c", "value": "1536:An0JnYi9bHrM0AH/0gsaaaI4KQSlBWfRHPi84I/2w7ycUzD20l0wW4zNNk2JC/+4:A01Yi9b6K/DTjq/0I7esT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630851224, "uuid": "e36f5b99-11b9-4782-8394-2f8b8e95125a", "value": 185518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630851224, "uuid": "35c95c32-3026-44b4-b39f-f85c1559822a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630851224, "uuid": "02188d63-310e-40e8-888e-fcec26062ecd", "value": "UW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c43563b0-0e1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630826866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826866, "uuid": "08cddc5f-a25f-40f1-afda-d5ea8d29dbff", "comment": "Malware payload", "value": "7ed89781448d1648510b111d7976d477", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826866, "uuid": "0008eb3f-f4f0-4e4f-9df9-3d904e2825f7", "comment": "Malware payload", "value": "8e42f25608223cbef92482b1d99748bcf027201953b1581202ba490a4faeb52d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826866, "uuid": "6039d07d-57a8-4fa2-81bc-68c4c40ba53a", "comment": "Malware payload", "value": "647bb1e0b5cb341467c7adb9b5ce54f27f12f297", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826866, "uuid": "531dfbc3-a383-4d47-9bdc-38f7bace0435", "comment": "Malware payload", "value": "bda4b7151932f2002cdeaebeb87be17a585e5bf7595c1f7200f2e7847dfd8351fbd2c55a5ea454f662be0e918c0c7eb8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826866, "uuid": "3e36aa45-728d-4452-bc03-9e3db1d63323", "value": "T15D4423666793A94BFCB6399253AEACC6B328C6F783E108424F3B58DDE4374E538D0505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826866, "uuid": "3a072dcd-3798-4100-a621-2bbae28ef61e", "value": "6144:VBCcYasTYFvcSYEhFUaGFwkmfqAbRhlQKEEHhK+:MHYFES/QaJHfZbRbPE2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826866, "uuid": "001658b9-f4a6-4220-b248-7ac24a13c857", "value": 265617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826866, "uuid": "c8a1ca63-568a-40e9-8beb-499c56b57cdb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826866, "uuid": "1578fc7e-6e16-41a1-93d5-7d2a9e48dfb1", "value": "8887.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "842035ba-0e19-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630826329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826329, "uuid": "1af1e89e-de4a-4c46-8225-446c7c71963f", "comment": "Malware payload (Buran)", "value": "42835c950aa29a65277650559cdbda13", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826329, "uuid": "c7674065-c756-4184-b3ae-9465d076d581", "comment": "Malware payload (Buran)", "value": "8e8a773ddd7569d473c209ae83f60c0ecfbcb65f67e1d7e6da3d6c10025afeac", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826329, "uuid": "cd39d3fd-02bb-4a80-aa76-d5e5db9ce544", "comment": "Malware payload (Buran)", "value": "30e5ae100ad3035acb98a0a62ac3fec9fa37b7ce", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826329, "uuid": "79047b84-141c-4ee7-9057-758248194ee4", "comment": "Malware payload (Buran)", "value": "baf66e863fe634deb7d8986211ec6bb47c8e14f8961ebc188a0423a31d1e7a0e9a3ac8cb3ba54e1c90871d15164156be", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826329, "uuid": "c35066ba-a186-4237-9c04-fd9e8dbd9f8b", "value": "T17DB4AF50E74421960EC3635BED5351D2FA7DC10192402168D99F93AC6B87AACC3BFBBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826329, "uuid": "3647404d-d920-4705-86f3-6edca6cc040e", "value": "12288:0Xt8DE+v4xBEWjW6/TuE9udU13eSX+POhG:0X2Y+v4xO6/61UJeSCOhG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826329, "uuid": "7b1007f1-f731-40f5-a45b-c4beece01fba", "value": 511085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826329, "uuid": "45b3ca34-0224-470c-9846-b67d96e4bd2e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826329, "uuid": "f12d4e38-3262-4a93-a0fc-70b2f2dfe3fb", "value": "3247.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4e85a3-0e8e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630876676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876676, "uuid": "4fbfe124-4dda-4c3a-8048-21bda4343815", "comment": "Malware payload", "value": "d0ca4c08f8ec82639b942a0a37a0d8f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876676, "uuid": "edf023e7-e7c2-40a8-832a-87e991330d37", "comment": "Malware payload", "value": "8f40f34931cdd93beafaf7726d46bd9beacb3a15e642d68e156e22a778e576ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876676, "uuid": "5fd265a1-e693-44d7-8e90-b9da79d76cd9", "comment": "Malware payload", "value": "43888bee46edc2bd114cc52cc3a127403f25c575", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876676, "uuid": "fecbd0cd-c9cf-43a2-b130-5cb17abc81be", "comment": "Malware payload", "value": "51bfc6a66a5dfa3ae39d22c2ea4452b55e8fc4511603cfcd6fcb73e78748f7a6785f5b6a634d8a0d9188a9cabb4d21fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876676, "uuid": "7bc6e7dc-9d0b-4621-a561-097b6ecb9a25", "value": "T1B4E590925525C45BE1CF2B34E90AAEFEC0829F24D310051FBD9B7D8A7CF9169472E42B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876676, "uuid": "faabb75e-b35e-45f7-aedf-964e33b48bf1", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876676, "uuid": "bee23c57-fc36-4dde-9dd4-144434f38d55", "value": "49152:+dvdIv2D/gx2UZQW+xoX/UlD9/mKR42jwJ4:+dvky/gtF+yX/a9/mre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630876676, "uuid": "5107c1d6-b6d8-4b45-9b53-cca430db35a9", "value": 3116768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630876676, "uuid": "5a0a99a6-cb97-494e-9719-de2ec0dca65d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876676, "uuid": "8539f981-f016-42f5-9823-f49d945711a8", "value": "d0ca4c08f8ec82639b942a0a37a0d8f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85613fc3-0e57-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630852960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630852960, "uuid": "fce1e955-ba28-4f02-aad7-2fb7864114e2", "comment": "Malware payload (Mirai)", "value": "7a4ddb4969ee525b0b6f3c94d20a1fee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630852960, "uuid": "27ddd38d-a33d-4c94-8112-2809d04210f8", "comment": "Malware payload (Mirai)", "value": "8fc6d643639525d4be455f5bae6553b785f619d57951d16996a3483e915cb883", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630852960, "uuid": "e311f22b-330a-48d4-b695-6cca8821ea86", "comment": "Malware payload (Mirai)", "value": "27411f6481f13e199222422fade24099f7ff3512", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630852960, "uuid": "ffb60457-6568-4f6c-a8fc-4c34ba6f0f77", "comment": "Malware payload (Mirai)", "value": "cf5b0f5592a81ade579c9f8d39b40240c7f4ce87039f49dca8c2658b7f1f8899781398a8c682c7534a623559fe6bbfe8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630852960, "uuid": "4a58451a-6fdd-4aab-a25b-517c93ef0021", "value": "T17C53D6C1BC61663AC2D1137FE99F108E3311A7D9D1DA32538C250BA07E8690F2D9BF96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630852960, "uuid": "f7cafecb-4223-4e77-b4c2-79f164432a54", "value": "1536:tcnOcXIfT+RYNVYxV+zncEUTfW3YgGvvhWx5+7jK:tcnOO03zIfW3Y/BQ5iK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630852960, "uuid": "0bcc4341-fd70-4f9c-9471-91e6191bc392", "value": 64032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630852960, "uuid": "67e2222a-72d0-4e5e-a4e7-d5d758825f77", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630852960, "uuid": "735d6083-2441-4762-b895-77414dafeff8", "value": "7a4ddb4969ee525b0b6f3c94d20a1fee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "380a9b26-0e10-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TeamBot)", "timestamp": 1630822336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822336, "uuid": "be157362-2f9f-4129-8e28-e2fb6080c056", "comment": "Malware payload (TeamBot)", "value": "9a4b8c48f6f51f3c5a5b70fa7b69cc81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822336, "uuid": "c77b4959-1376-44fe-afa6-89489bc3c2c2", "comment": "Malware payload (TeamBot)", "value": "9062d6602b3648209d668862a1088209fa552d36df728d0232b1233f7d195de4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822336, "uuid": "60b835c2-3371-4d34-adfe-88e7502de215", "comment": "Malware payload (TeamBot)", "value": "c181603fc98ca12c6d56087a0fbe45891a688c7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822336, "uuid": "ead03cf4-edf4-44f6-9b36-69b8d323454b", "comment": "Malware payload (TeamBot)", "value": "44ee0d87981bc5f1d33abe63287e6e888471e1615fcb7223f859ec35f3651fdf50d3a3346129bc13b4624d905d730133", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822336, "uuid": "b1693099-d480-4fb2-ae18-8a6dd88918f0", "value": "T1B605120A7E50F4E3F5A5D6704424C3B4DE2DBCB26E60826B765CEB9E2E311C06A1E71D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822336, "uuid": "d25d2dd7-6687-4a71-846d-c47f55286717", "value": "f530acf7acd4a5c8880ba2a4704d4cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822336, "uuid": "c2a04c1d-73e4-4fea-b38a-3e4d30f3f48c", "value": "12288:G4+qobaND23KtpwKAtN+hbFmSCp30aNW1RMdFciDmlK4auZo1opUAVDkj1CKnf:8Sc0Ab+hbFm1u7OdFciClK4+6ZVm9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630822336, "uuid": "7f797c63-6b51-4d33-a835-a4c615e38bd5", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630822336, "uuid": "1c66c422-4a2a-4194-90ed-9da535e5ee02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822336, "uuid": "3db63c00-1b98-4735-a7d3-53ba7a4a6fea", "value": "9a4b8c48f6f51f3c5a5b70fa7b69cc81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e6e191-0dec-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630806889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630806889, "uuid": "135da200-41a4-4352-ba8f-ae2a275dedd5", "comment": "Malware payload (Mirai)", "value": "e8aee49ea8b8a6932e40af3345e46518", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630806889, "uuid": "8823dca5-5ab7-4045-8df9-8816e5bab6a5", "comment": "Malware payload (Mirai)", "value": "913ac664001ec37283f4bc78cb104d41a1739b9cae96adb612accd9ca8bde542", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630806889, "uuid": "f8b41b50-ca54-4d8f-864f-aec6178622bb", "comment": "Malware payload (Mirai)", "value": "d199de6df0480cb68431d6c1bbc450bc7de84c2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630806889, "uuid": "1e3ad27a-4eb5-4a64-bdba-a6fca6788f90", "comment": "Malware payload (Mirai)", "value": "2e4d0cff842e401b6fc58d589f2083b3b30753077736ebf8a523c9e33311f3e0041c64a44fdd2a0125cdd727805a037f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630806889, "uuid": "813c9282-464b-4f9d-9f66-94a21c960593", "value": "T1ADC2F8D6F802AD3CF81FEABE8412881DB970375551931B276377FD63AC322584A27E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630806889, "uuid": "d46498d9-be0e-45a2-9aaf-cb859fb7dbc6", "value": "384:2HoeXqFI95UrRfmadDQbdRG8pCYIj77E/rIn8V8HAoZeTZk:aoe8AUyIYu77E/kn8V8zA6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630806889, "uuid": "60538943-07d3-4c12-99af-6685f2d94f7b", "value": 26320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630806889, "uuid": "cc15a320-4580-4430-987e-f4ec435b305b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630806889, "uuid": "095aef2f-0a62-499b-9369-02ed63ba4cf7", "value": "e8aee49ea8b8a6932e40af3345e46518", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dac3245e-0e19-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630826474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826474, "uuid": "c7fc8285-7c98-4f0b-b735-61dfe0e53639", "comment": "Malware payload", "value": "41b8360224b1d4f6821de3f5b68e393e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826474, "uuid": "55ea9bf9-ff66-4cc9-a3ad-469f11552cfd", "comment": "Malware payload", "value": "914619f3229ad96c7c5c6b16afacb44fb2e7681e42a4ac226ed38461a33fb7d4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826474, "uuid": "b7b03cba-6674-4397-9ac7-f90aad0a2a0a", "comment": "Malware payload", "value": "7ed7a3eeb26375301611282c8aa1bddcaf781ba1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826474, "uuid": "6c01ca11-740b-43a4-b67a-6cc1cec1291a", "comment": "Malware payload", "value": "05ac1351ba489dc79e91d26e08739998e6638f0b6086b6ff61ae3c96538da8da6618be45a0b8f78458f70a986a6b0329", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826474, "uuid": "0b476b2e-62db-408c-9bc3-3d0c72fd48e6", "value": "T1C215CF90EA4411661EC3639B9C5352D2FA7CC11193402164D99E93AC6B879ECC3BFFBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826474, "uuid": "2d388e37-a3d7-4b44-ab46-7b9cd7840a2f", "value": "12288:UVuV+YlVwKKDLJBa8qFiTz9PXXt8Dx4hQrC9msM5nk7yGTUA9p:quVpKDLqF89fX2S8C9mnCFoAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826474, "uuid": "cad47a8c-d2fc-4bc4-b06a-65d792ff1ad9", "value": 957187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826474, "uuid": "00fc645e-fe23-4899-a752-07b9b764a5b7", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826474, "uuid": "e2e97b4c-db7f-4196-839e-8e28a88a2ab1", "value": "8198.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df03791-0def-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630808199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630808199, "uuid": "7372727a-6b81-4b1d-8317-4538e1dbe55b", "comment": "Malware payload", "value": "b4a17380f83d2a9faed44febc8052a0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630808199, "uuid": "6c79b4f2-755e-48e7-b85c-c8dc6418f28b", "comment": "Malware payload", "value": "914c42276ab980e6959f1118190205fb9ea63b7fde871664cd6fa70dc82f4c33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630808199, "uuid": "8ad2d61e-58bb-4905-a8cf-7fe21a5489b6", "comment": "Malware payload", "value": "82eaab8f67c2c0a9a6b59cc938d31107f20c3a42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630808199, "uuid": "925a516f-f387-4f7c-a34e-a45a404c83e3", "comment": "Malware payload", "value": "daa4ed2878a935ef7c9c92170ee1c4ab11874ab95aaa00ea48277e276217bd5fefd89a4c1c63adf9f199052bb48caea6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630808199, "uuid": "1306cc0f-896b-40f5-ac5d-452aa077aa7f", "value": "T120350E3E54BE2326D565D7B5CBE1C833B2909CAE3132A82857D67F572376A4234C312E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630808199, "uuid": "1feda499-90be-450e-8ef0-89fdd7a23990", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630808199, "uuid": "b9adee34-88fa-4b29-b398-5659fb4ef032", "value": "12288:goMqaEgrfbqyhMsAPe695WuxVJ321P7r9r/+pppppppppppppppppppppppppppv:pMqa1rfbqyhWPe6uuxS1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630808199, "uuid": "b9480ed5-c61e-4ff2-8eeb-375211aaced2", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630808199, "uuid": "9236b5cd-8c6e-4780-b52a-e98a67fdc95a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630808199, "uuid": "623a858e-79ae-402f-a2fd-b26d074d5261", "value": "Offer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe4b7904-0e32-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630837271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837271, "uuid": "03234283-e855-42e0-a832-a2f7b8c68a82", "comment": "Malware payload", "value": "de7a85d5a3d55f44b6052889dd63ce5b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837271, "uuid": "05f562b1-3d44-4ee6-8bd2-3c2ec68122ca", "comment": "Malware payload", "value": "91597b9dfe3eaa2d1654ddd138408731b0124fb3f85b5ba1be53c3b8dd327d82", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837271, "uuid": "164eba13-675e-44ba-a447-73630102410a", "comment": "Malware payload", "value": "368517da24f92445539e2c5a950143b56393cae1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837271, "uuid": "b207f952-b2a7-47dd-ad1e-317df27ea188", "comment": "Malware payload", "value": "6f6b08ea09cea17775c0777b6a06d3ff02f702de58be2b6d83775c1a58a173cfaf428a0f113cd00a9462bbd5b9ffb866", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837271, "uuid": "ba1457f7-0887-4552-8e21-922d4a63de99", "value": "T1A67423C366F08C16DB96A333448C968CF19ED82D54B04ABEAFF0AE065D0762D55ACF53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837271, "uuid": "5c486b27-161e-46c3-812f-afa2377f9be7", "value": "6144:PLt85579zmWwJo2Xv1CvvfVZUZR9EKHCjZFMr5/Uisb4+rhICKHiN+QsEAr:WheoavSF+R9EK5+Jh3KQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837271, "uuid": "bc69960f-a406-41fe-8cf4-f390251620e1", "value": 349035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837271, "uuid": "6d7cac8a-1294-4639-a90b-aaf7b9ff0df4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837271, "uuid": "9454adf4-e444-44a4-a73c-7a8ff42177e1", "value": "125.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c81868-0e2d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630834700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834700, "uuid": "a1b8b0f7-7ad1-4e59-bf42-f078a8cb1ea9", "comment": "Malware payload", "value": "1d661047cfcdcf043fc3d125fd0cfe68", "object_relation": "md5", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834700, "uuid": "14e10cf8-63cc-4715-b6c4-ca624450a2e6", "comment": "Malware payload", "value": "94a20d5e8c9dde7e3e449a9d96bbbca38e0f75208dd019d059d3628b0c4357e2", "object_relation": "sha256", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834700, "uuid": "1d1fc24b-6973-4803-9dde-65ec5ba83031", "comment": "Malware payload", "value": "a4784a15b34e1d8938fc2239fbff670954db6535", "object_relation": "sha1", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834700, "uuid": "76b53a07-5bfc-4605-92e6-7dc3bc5b0c2f", "comment": "Malware payload", "value": "4d48e4b2d7b16cacb8fb45af5e55a08c49d60fcdf8006d741e00083d9c34557cf220a3dc1427be06bd13026daf724718", "object_relation": "sha3-384", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834700, "uuid": "ba73bc67-3323-4c73-88b2-e9a7a202dab7", "value": "T10C86191277FA8939F1FB6B30ADB852A54A7FFDA15F30C18F1250568D1930AC09A74B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834700, "uuid": "22ff86bd-ec4b-4e70-8b70-43b0c1e6ccb6", "value": "e2d28022f7d79baf4229614e32d8540d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834700, "uuid": "a1ae9e39-c7c7-4245-bac6-02e6ab2a9756", "value": "98304:KsVXH2gbTfJi2plgyfsVXH2gbTfJi2plgy9sVXH2gbTfJi2plgy:KstH2g/JlbstH2g/Jl5stH2g/Jl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630834700, "uuid": "2dcbbaf8-d014-491c-98d9-eab2c15c1082", "value": 8538736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630834700, "uuid": "26c3e6a4-d4b8-481d-b3d4-34c40206948f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834700, "uuid": "f220c6bb-13e1-46b1-a7c9-aa51a7545de6", "value": "94a20d5e8c9dde7e3e449a9d96bbbca38e0f75208dd019d059d3628b0c4357e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ebb850-0e45-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DiamondFox)", "timestamp": 1630845076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845076, "uuid": "3a190f03-75ff-46d6-8e06-883e74c646ed", "comment": "Malware payload (DiamondFox)", "value": "500a3b64014de00b03f981299586fae6", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845076, "uuid": "c258c757-0c4d-4850-9028-a793daea8e41", "comment": "Malware payload (DiamondFox)", "value": "96b3a6f88bebb213230bd38f95804466296c238e0774861ceec6ad4424dcfb45", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845076, "uuid": "187799f9-ae57-4a1b-881b-a9145932dc47", "comment": "Malware payload (DiamondFox)", "value": "268186377c6306055e8c42c1a1bde48adcb735b2", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845076, "uuid": "c52fac11-584e-4f20-b967-0f29ee42f53e", "comment": "Malware payload (DiamondFox)", "value": "92ef3bf9a50908158dbe342a42a1f75fdaad0dd490c6e19076552761cdafe933eb607be5f1b70cb051362e3668a59153", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845076, "uuid": "79b91994-ba1d-4822-8cb2-a6dd4e5f2c20", "value": "T174463329BED0C6B7D8702DF4F60C5BA2E272877B173668D357057860FB2C3598075A8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845076, "uuid": "32b8ed7c-d70f-4ce5-8b07-7879e565fc80", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845076, "uuid": "d388020f-e5e2-4ae1-bfd2-8e4691eeab63", "value": "98304:xRrRBN2e1xmerMGHPGm3gfLagxJvzGj66eL1WyeLiUfETuDbb6bRWPDKQ7N5t:xRrR32yzHPGmwfzJGj6f0ye9Vnkkp5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630845076, "uuid": "29fa8e85-4234-4f54-a6bf-1fd7ee0e06da", "value": 5804570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630845076, "uuid": "63d389f2-2c87-4a3a-9d77-7c58aae2a1e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845076, "uuid": "4da28da2-023e-43f1-9bbe-6a27b61bbd7e", "value": "500A3B64014DE00B03F981299586FAE6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "373b76b0-0e19-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630826200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826200, "uuid": "1625913e-585f-4f8d-b29b-6af987a1d969", "comment": "Malware payload (Buran)", "value": "36f0980a5ea7d987ba2b67737d1496e6", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826200, "uuid": "d1d13177-2822-4a06-9c9c-9e1461f8fec0", "comment": "Malware payload (Buran)", "value": "98065a124ca95913864708eef4e02d15234097c32bbc7cc7764073feaf13c38b", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826200, "uuid": "95b79c06-6657-4afa-8255-53d232f05aaf", "comment": "Malware payload (Buran)", "value": "ed7600dfb414e0fe807b39c8741df1a5d414ff7d", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826200, "uuid": "d53119a0-ced6-4fbc-9ad7-e5823c2a0a7a", "comment": "Malware payload (Buran)", "value": "64c61317aa7c39fd7597ff3ef5b55aad009884cfb46ebd3f3618fb6ca44b2d82a0cb37f1a0ed5f151ddd6f2b7483383d", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826200, "uuid": "c493be8e-2b27-4fad-9a0f-5684a2e683e3", "value": "T1D454235FB927BDEAFA663017E034D11EE9B802E925CAC14B1C1E6E3F901575F22112E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826200, "uuid": "93485c58-3688-4ab5-925d-94aa0a580fc9", "value": "6144:2Ml9OJUJ3pynu4rHPHIYY17Vx87EPAREGarQM8XE5TCPsDboM7SBGOANXOAO:zlTJcXfIllTPAGGarMquMboMGBGOAxo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826200, "uuid": "a6d3f1c7-a53e-450a-9b0b-cf4d178be070", "value": 295099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826200, "uuid": "fe04739c-2300-4fb5-8134-da8d15fcd23b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826200, "uuid": "19cba807-c13d-4eba-84ab-330d56163d2e", "value": "1649.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b92e4aa-0ded-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630807256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630807256, "uuid": "f05d4869-6331-464b-96be-fcff0638c22f", "comment": "Malware payload (Mirai)", "value": "3b326f074b8e0379da22fcf99074309a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630807256, "uuid": "6188a272-63be-4cd3-bf96-09321fd4d040", "comment": "Malware payload (Mirai)", "value": "987e0ce4512d82c81e6200d73e3574bbc685894a3b36b2d09fd807e40e53e9d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630807256, "uuid": "1204a6a3-6ceb-4f5a-9173-5573eb5f69fb", "comment": "Malware payload (Mirai)", "value": "ae89d0752658aa71f7a85fece81629e6dac5555b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630807256, "uuid": "91dac3f2-e50a-45bd-ad83-5324d64405fa", "comment": "Malware payload (Mirai)", "value": "69f23521bffd4242aac9e8636e6b1868207fd789fae11590e5159d27559288b19a4d770a56e22ddbc9d91cbdb97b7c7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630807256, "uuid": "826bfff6-1091-4b33-b677-6d3dfc5bf870", "value": "T1D4F285592E728FECFBAC8A3147B39E20A758339626E1D644E25CD9401E7034D745FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630807256, "uuid": "b0831066-a54c-40fe-b6ef-1d7b2e608db0", "value": "384:rkbJXc9z3wyBdB0u0v07cPph6zJbDptegDVRHc3u+0CwzP4/80AUPf/ALP4n2cEr:q03wyZ0u0vY5vtegD/cnsGAUn/vPj/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630807256, "uuid": "fc05ed92-5a99-4ccb-8696-4c7fcd6bc7d7", "value": 34500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630807256, "uuid": "ab3357f5-79b0-4b4f-ba0c-c4b574784429", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630807256, "uuid": "994a0ea5-3cc7-439c-aca5-acd4ec7e0518", "value": "3b326f074b8e0379da22fcf99074309a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb70571-0e33-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630837675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837675, "uuid": "c1d0180e-0c77-44d6-bb9a-b7bd5fe2397d", "comment": "Malware payload", "value": "e8c6a470367015b885432bb37932c7d5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837675, "uuid": "10acdfe7-b5f6-455a-92d4-f2a97c8de397", "comment": "Malware payload", "value": "98c6367ce421984ecfe48775f9ac2635e6ade824dacac79400b77102a88e884c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837675, "uuid": "5d0c2de7-ead4-47f7-a494-3be459876822", "comment": "Malware payload", "value": "e5abbde1cd5e5dc1a8ca01038e042a85faee55af", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837675, "uuid": "a2025ad4-384c-414b-930e-395c0d34c08d", "comment": "Malware payload", "value": "411af1d3430b936e94f76bf45132f24e67c57aef2647693befe14b256ca109d501003cff18a4717d9a48abb1832a7655", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837675, "uuid": "8d3e6a84-d1d1-4297-924b-f16e8135179a", "value": "T1407423FD585E848780042867E1335D631FEA8963FEE20F58DF932A34CA2595D62CB8D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837675, "uuid": "e3b92ec4-e0b4-483f-8663-d1b26c9100b2", "value": "6144:o8dPv4UXyYHhkQJn5TmEfwr/ChlokjQZd0mzfJsyBq7i2o:vIjC6QJEEfwrahl9Doflq7ip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837675, "uuid": "d34f322d-49fc-4334-9f48-13f050193fbd", "value": 339395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837675, "uuid": "6f6b706c-8103-40c6-aaed-e4e519c43528", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837675, "uuid": "7ca1feec-1c07-407f-9542-42a0e42e90b0", "value": "8255.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc6ab02-0e34-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1630837859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837859, "uuid": "81455c39-a7b2-4e69-852f-5e02069ae123", "comment": "Malware payload (CoinMiner)", "value": "0198cd573ac4cb43db9ad5af0851f9fb", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837859, "uuid": "3a8a663d-f206-481f-bdb9-e0a5a7d7409f", "comment": "Malware payload (CoinMiner)", "value": "98f1b4346e9c72dce4a9450cb013857f338b52f7ceb39da0204b4c0df1425052", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837859, "uuid": "5c2de58c-7556-4633-ae85-276c5d20ac20", "comment": "Malware payload (CoinMiner)", "value": "38342f8fccedb5cb18b9699a4b0590f0ac7a1cb7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837859, "uuid": "bea75be3-cff3-46ac-bad2-686983bea8cd", "comment": "Malware payload (CoinMiner)", "value": "56514940cfaa6037dec4f501d1b6b523e803e6931ec28226ba62a8e979ee716711655bf346422633e9627ad5e9230abb", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837859, "uuid": "d4fbd86a-5251-470b-a5a6-297666b1634f", "value": "T12834AC1A7E80E833D596C63044A5CFF0DE3DBC761D64854B7358FB6F6E602809A2E366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837859, "uuid": "979ac688-9d1b-4733-ae87-5be692055fde", "value": "b2c249fef864036a8cc857592c5ce556", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837859, "uuid": "9e522f7d-5aab-4719-8b99-2a4db61fd497", "value": "3072:DIeuqcTZam1OTxJLdTvNQHNf5Nr683Tm7uySP3/sj93tSalppUhHHx4bBvHO3:0nqc7gfL1YDauBsj93k0ppmWBfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837859, "uuid": "224bacd8-08e6-4c72-bf1e-ddf50d125544", "value": 246784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837859, "uuid": "d9bfd5fe-d13a-43e3-b801-bc0a473ef517", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837859, "uuid": "db7b90dd-c85a-4c74-92d1-49f5a74bfaf1", "value": "0198cd573ac4cb43db9ad5af0851f9fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d781e0-0e19-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630826464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826464, "uuid": "03fd2c77-aa62-4e9a-b3f8-762e0d19050e", "comment": "Malware payload", "value": "14a8c9843701de3c7394c1df114aa4df", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826464, "uuid": "2736c6ea-78a6-4ce8-9309-5d6897b7cbf9", "comment": "Malware payload", "value": "9907a8bdc8717006db9c2c82660009601410ed51fa6ca7a9f90fb5322cb5371c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826464, "uuid": "21518329-79bf-416e-972a-206c2fe3ebb6", "comment": "Malware payload", "value": "8ee59c5e25bd9210866e2bd9af74efe363fc98ef", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826464, "uuid": "09a096d2-c3c3-4619-acee-2f304d9178b5", "comment": "Malware payload", "value": "d1b8d85c3fcce2fc0bba64c5c533a4f74c3d7575c014c5d65627db24e84d6a686030c5f5ca553701ce233524409d4699", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826464, "uuid": "c642d23f-10e0-4d39-a565-f9a6b5709f8e", "value": "T1A2C43328581139CCCDC876A5E946D6B3354F4CBB0808FE2B5ABE030F6A98575FDC9963", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826464, "uuid": "6079300f-73d1-4a72-be66-9eecd92dd0db", "value": "12288:1wre6Nf0cN4dEhmzWMh37+Vmm+Z3HpuOxkSpdweZ/5k5j0f:oe6Nf0WhmzLiqtpT7v/5kOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826464, "uuid": "d87f6f46-cc76-43fc-a2d0-b3eccd612914", "value": 584077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826464, "uuid": "5139fddd-96ad-48c8-b5b5-c090dc68c37d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826464, "uuid": "6790295c-5114-4572-b726-2bd494729617", "value": "8198.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee3a3d9-0e13-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630823582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823582, "uuid": "07d3ba29-bb38-4182-89a8-4c0f40a674f2", "comment": "Malware payload", "value": "813a013623bde6599e8897c590bcc700", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823582, "uuid": "5162f128-3c17-417b-9695-9267080e14bd", "comment": "Malware payload", "value": "992f3c93a3bfa17e250ac15a8d2857b8f3f8915fd3f1887c0176b86e99622128", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823582, "uuid": "7b38ab1f-fd75-4287-a3d6-554ae52cca6a", "comment": "Malware payload", "value": "7c1972869c2898a562abc9cc8f228f95336b6ecc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823582, "uuid": "a31076b7-13f4-4cc7-b5ee-0c0291c03abc", "comment": "Malware payload", "value": "a68436f16c0564d19240f1c35d94de0ff170acb2a800b5b55112af48dc7c9995aacebcc035de985b956eb2282cf32b30", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823582, "uuid": "0142185c-79b0-401d-9aee-ba304c35d011", "value": "T1B2249E50F78830DA0A8223A7EE9751C1F67DD041A2441125ED5FA3BC6B439BDC37AA7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823582, "uuid": "4228b6bc-7f5b-414e-b070-14501ae6f8e0", "value": "6144:Bux17gYyRdwULvG/TOkQl9sy4E0ZeXtYzHbxaXt/0D9:BuzjUMGyywp7AXt8D9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823582, "uuid": "54bd9148-853d-4fc4-be6a-f4a42a845759", "value": 220757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823582, "uuid": "1b07a428-2a88-47ea-9398-8a3f84affdad", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823582, "uuid": "219ce2a7-7672-4af9-8fe0-4d321d89c618", "value": "1855.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d40e200e-0e0a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630820021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820021, "uuid": "5662da47-a26d-4f16-b370-0b1dde128b6b", "comment": "Malware payload", "value": "724c400786d9fbfa54acc3346e8cdf18", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820021, "uuid": "056af8fa-d5c5-4b73-aee9-67e207acd37a", "comment": "Malware payload", "value": "9bda1c82ea1d3f164f18e24a61b96007b4c817b4f154d1205d2bb265776c52aa", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820021, "uuid": "ddaef5f1-b010-470c-ba1e-6cb4e62f8d97", "comment": "Malware payload", "value": "0f3e1cb803454bb8980a48a868e7cb5c0266419b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820021, "uuid": "df41ce27-1195-4e18-90b7-9cf77964ef5f", "comment": "Malware payload", "value": "546a52577ed57c99427fb31a515ad4069420b854cdc614bc9febb0ca0366ce5c94fc9fd90ffd1269610e4c4886e142f0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630820021, "uuid": "9641816f-0274-401d-9a6a-120a9e978bb6", "value": "T15DB2BF14E412B8A5C663F7B02359179FF27EE56352577722BE8276E500926BC1F83C0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630820021, "uuid": "779308d9-6d4b-443e-bb25-a46477782358", "value": "384:Z9vYbq8W58F/qte69DBDjNL8uS6gHdH9A66Y0PXv0g/x0nUdL1ZA9fo:Z9gbnF/qkKDB6/RHTB6Vnv/RdLX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630820021, "uuid": "6bf15cc1-f341-4154-a443-37dfe0c6d12b", "value": 24324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630820021, "uuid": "f169b8c7-f73a-4db4-81e8-45f9ebc34783", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630820021, "uuid": "4b90423a-04e9-4d0a-b27d-c769b402ac12", "value": "Vaccination.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d8db8d3-0df4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1630810319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810319, "uuid": "befe245e-06c0-4b38-b627-b655d9d989e5", "comment": "Malware payload (Gafgyt)", "value": "03ef2137dbdb5652ba90dc7ad1b0e715", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810319, "uuid": "640ab34b-2035-49ed-9f09-e1291cff9889", "comment": "Malware payload (Gafgyt)", "value": "9bf5184c355c9f660a7d2c306828da50d7b57428febb46a2654ff7fcd6fb2a28", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810319, "uuid": "83e25647-5063-42ee-9148-4d7472cc697f", "comment": "Malware payload (Gafgyt)", "value": "947024eb069453f0861dad316226a51ba6c7d3b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810319, "uuid": "9066221e-ddb3-4843-8b6b-024401d05b08", "comment": "Malware payload (Gafgyt)", "value": "9b4b655fb80d521de6436cacaac2a30cd41e5880a45c6c0b25e308a5e5c45b362bdbb469f83081583c63d5ce016513c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810319, "uuid": "1ebb0315-68df-49bf-bdeb-19654523ee9f", "value": "T11EB31931E703C6B2C8420AF112ABDA7B0D21BE7B496A5A89F3187CB0EF334C57555B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810319, "uuid": "1bd6493c-1de9-466c-803b-68b494be97e0", "value": "3072:sLgcX/zmB28EA6J7+sg67GyGmmRjcqn0GnDdT:sHX/yJq+Z67emmRjcqn0GnDdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630810319, "uuid": "d1f7b6eb-505f-4dcd-87b5-160b7dec0e99", "value": 109532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630810319, "uuid": "d7be53f1-80ad-49e5-af0e-fb86cb34d40d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810319, "uuid": "08a27e4e-ff4b-4816-b69e-4baff360952e", "value": "03ef2137dbdb5652ba90dc7ad1b0e715", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ed04ff5-0df4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1630810268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810268, "uuid": "bc8bac23-c1bc-4393-a62b-7b621653095c", "comment": "Malware payload (Gafgyt)", "value": "6a82cd24999f88127bae405ff7954d83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810268, "uuid": "e31f0d70-e7e1-45e2-a4d4-a589a1e19504", "comment": "Malware payload (Gafgyt)", "value": "9c1b1fc17a87a3f118252817350e6166e1711446f58fe6f183795862a78f04a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810268, "uuid": "cbb35b54-9ba7-4bcf-a580-3cf241685e49", "comment": "Malware payload (Gafgyt)", "value": "b73e3384270fbd8c1a66ff064240ae2e72fefd41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810268, "uuid": "d88c8d0b-3712-4120-a816-fd369b2b051a", "comment": "Malware payload (Gafgyt)", "value": "1783e3a1d36dbec29d6c59591b559b3a71f06d0fe724e7ad16a8a7c66712f3fe64ccc0b1c9a3031c44f7cd538df0f958", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810268, "uuid": "718cff6f-1628-4a2f-a4dd-25afe5d30102", "value": "T1A2E32930D4504B17C2D223FAE69E865E3F231F9B93DB33155A387AB41FE27991D29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810268, "uuid": "658ac83f-6819-4895-a591-a551828cd667", "value": "3072:9beZY/tcVA0aZcg3+bDzOAoWAqq1EZa/WpkmhDQwVVS4Nu:VeiwaZcgeoWAqqopkmhDQwVVS4Nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630810268, "uuid": "5b25a9be-84ce-4f58-974f-0a124cb389e5", "value": 151517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630810268, "uuid": "e8e5442f-8e18-49a9-b5de-d2634e5effa2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810268, "uuid": "7c54a742-fb61-46f6-9ab5-e792ebbc4e7e", "value": "6a82cd24999f88127bae405ff7954d83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da24cae1-0e12-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630823467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823467, "uuid": "b90a2200-b0d2-4a64-83ed-a612668e033a", "comment": "Malware payload", "value": "cce470648f5c1a9cc37f448b21a0757e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823467, "uuid": "ea8227f8-7ec7-4df6-87fb-6be7f38b4be4", "comment": "Malware payload", "value": "9c43cce932be13aaa3c904bfc63dd617e8f0836a6cca6487c16d70debdc3d840", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823467, "uuid": "1f35ce52-721b-4ad8-8346-d67c677a6f20", "comment": "Malware payload", "value": "1a9303163b5e65700b584e157e0bcd8d7a2d77b8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823467, "uuid": "18a6f656-a4b7-4bce-85a6-d9b8dc168e33", "comment": "Malware payload", "value": "d1e2c9d65109bf9cc1ec0afdf797c3407bd95c6d86f2f265e0e42bedf171e3006d6f625db643ac6e03bdd3b90aa79596", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823467, "uuid": "11607525-d9b5-42e9-a68b-dc135abc40dd", "value": "T12362C0B295FC1D13FB50173DB15EE54EE4978280AA0BC792292348B409E7768FAD2B49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823467, "uuid": "04eccd41-e219-4216-b53f-7ad6f2f68371", "value": "384:u4XYk7K5R9QC3tHekLM50uf65zvMfmnAbvMCynSk4psMhwMTE0:ue450qNVvM+nAbECvrpFSML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823467, "uuid": "46226193-d0d4-4dfc-bb25-7c3f40b9aa7e", "value": 14994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823467, "uuid": "e64eb8e3-055b-4e49-84ae-06835d54764c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823467, "uuid": "b7e41716-3beb-4312-b11a-0e0d384c1e22", "value": "PO41906332.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de62eebc-0e1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630826910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826910, "uuid": "d81b06f6-7047-4d63-b064-1a5e9b871f4d", "comment": "Malware payload (Buran)", "value": "75706aebbad73a4a046a469eee5bcdfd", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826910, "uuid": "ccef5d39-ceb2-483c-9246-ab037c176b30", "comment": "Malware payload (Buran)", "value": "9c4b8b8c3eba117d4be2e58349b25f49222e605812a203efee4ca1c0a065934d", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826910, "uuid": "8e35d6bf-5e38-45c6-889f-b6018296c817", "comment": "Malware payload (Buran)", "value": "616c3c1827e9cf859537d812bba9865efda9ecc4", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826910, "uuid": "1d8ca8af-099d-42e8-a324-73d8ffb56950", "comment": "Malware payload (Buran)", "value": "0111297d48708551f52bf022ca5fa0c0d37fd27d3fdff6d25963073259ce9758714bb422fc1137a4f9ce565651a1a1bc", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826910, "uuid": "b14bb16b-0c4e-4a15-943b-ee180c1f15c5", "value": "T1060412DA0218660DAF9267D58A1F801FB3C35673275F9A93AB5207A15693FE10F088E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826910, "uuid": "2d7768f4-c276-4349-b127-5b95152bdf03", "value": "3072:YOA01a44EAaPJKEpat1OzxZ2h5Uaz2f0AY/1WGw+VvaHdQnfiXRpWmPZJrhagQqh:W0w4Rzpat1LlzXtpa9QavWmTbQqYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826910, "uuid": "0d98753e-624a-49d1-b1c7-1f681ba45e60", "value": 189992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826910, "uuid": "e844a450-1c22-4b8f-978d-833a2c527f4a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826910, "uuid": "db1d67c9-4844-4681-9057-947840026971", "value": "9212.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b6400e-0e33-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630837445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837445, "uuid": "949bcc2c-eac2-4c4c-bbe2-240db9f25d10", "comment": "Malware payload", "value": "fcad05a103e910b098c1f607aa30a7f6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837445, "uuid": "3dee7d36-6c75-409c-98f6-04b23bd00a86", "comment": "Malware payload", "value": "9c76282154b1dc7bce8f542a5a4515299d4548dc045eea912a4b00f33bcdfb44", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837445, "uuid": "275567aa-db7a-4588-b63e-7a60045b8e66", "comment": "Malware payload", "value": "1148e1d94d400f1a471d64de411f81754d27c6c8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837445, "uuid": "3671920d-6861-4f0d-8d3a-c19dce20d42f", "comment": "Malware payload", "value": "15fa80059b5da70d136cf9f20f8a6145a4eacf3f122b9a4a8847483504bd011efcc628611f18f5e1da521544b0c34759", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837445, "uuid": "cc38e043-8f88-4dbf-96b6-4dcb53cfe9a9", "value": "T1061412B1D66E7E93B1B28114807344B99E58A2C39A97F873B005D612997CFCDE0DEB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837445, "uuid": "8ec11c9d-9c75-4870-8b88-94742b285b38", "value": "6144:eeD14QAI2RcU0yU/ryXpePQa+eHFnZ/VFg7R:eeDf2RPZeP7VaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837445, "uuid": "82ec9baa-71f2-4c5b-b20e-173a58186a6b", "value": 204009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837445, "uuid": "8c1f247d-15de-4f37-a229-200862234cff", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837445, "uuid": "c258427a-ef01-4718-875b-29d614fb7b99", "value": "3572.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d9609e2-0e19-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630826238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826238, "uuid": "1b951ca0-cc7c-4503-b4ef-1fa60290365c", "comment": "Malware payload (Buran)", "value": "84a332e2fb917feeb6c45478dced7333", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826238, "uuid": "57fec800-44a5-49dd-8d94-c21564cea884", "comment": "Malware payload (Buran)", "value": "9dce827d31cfb45a2ea2fe51fa9bb2988ee6a182e36493350136c1b175d4c884", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826238, "uuid": "517ae44e-a5f8-48fd-b045-1a218abae500", "comment": "Malware payload (Buran)", "value": "c377785567b6b121508892893281bdf25927823c", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826238, "uuid": "e699e32e-def6-437c-aa9b-d3562d250015", "comment": "Malware payload (Buran)", "value": "6650dee0f4c86ceffb2e9682fc02d14bac26c07548d747be0005165273733dcdcb0d0819c64518fff21cf387756427f5", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826238, "uuid": "06bc22d3-c948-4b0c-b9b3-1506aa40c2cd", "value": "T11AA4BF50FB4411960E8313ABAD5356C2EA3DD10193402168E99F93AC6B475ECD3BFBBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826238, "uuid": "4d93e782-4b0f-4e35-83ee-1e8cfb1868fa", "value": "12288:0Xt8D6Wvn3Uu3orR5LpuWxyeDmfYxf3Hyqe1h+7dzJ:0X22Pv/LoWCqe1h+7xJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826238, "uuid": "46d06100-76aa-45c7-ad74-b52a40e800cd", "value": 491284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826238, "uuid": "f2c8999e-9852-482a-830d-499d32f2165e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826238, "uuid": "e10053df-0db2-41c1-995e-06873e9d48fb", "value": "1649.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e341e1-0e82-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630871431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630871431, "uuid": "d6aba4bf-5524-4e3e-9ba9-8f7b62631df8", "comment": "Malware payload (Loki)", "value": "c97b869ae70c451062309ec51d5fa495", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630871431, "uuid": "03b03b0c-05aa-4f10-8707-5152e2a5eb60", "comment": "Malware payload (Loki)", "value": "9e4bebb1ed88f267134815e8de30d9900ffc353e1c19ac40ac441b620a553551", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630871431, "uuid": "dd005e47-8204-4b56-8edc-a3a64c600b31", "comment": "Malware payload (Loki)", "value": "941d4876a6ccc6033ae71a4957374f801fce951a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630871431, "uuid": "e6de8729-8e80-42e5-a7a5-445a17d5d7a1", "comment": "Malware payload (Loki)", "value": "7cac82bb21b09a0dc15f2804ff5130d9d2bbd74d2cfa7fe9b3ecb90441919d1760b4c68622bbee378c6862e6531ffa1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630871431, "uuid": "6a26a2a8-8dce-4ce9-9e78-a1fcff062093", "value": "T1D3E4B97F19BDA1279175C6F58BE38423F0018BAF31206925B6D647164323A7AB5F332E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630871431, "uuid": "e578819a-b456-42bd-a2cc-6a2a31f7a2b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630871431, "uuid": "964985b5-630f-4c39-aa91-08c40b223d14", "value": "12288:wR16OAwCYnfRUWpER4KRlh84+l7kP0W5ufOK:4hjCCShG+P0v1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630871431, "uuid": "19237ad5-8a07-4882-b9fb-814cd2fa94ca", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630871431, "uuid": "77c5325a-1385-4722-a6b8-85b6a155353a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630871431, "uuid": "9d968059-25dd-4d07-b992-457a03b58c1e", "value": "c97b869ae70c451062309ec51d5fa495.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a11eac2-0e19-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630826258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826258, "uuid": "263278a6-85c3-465d-8d3b-1a4e4fd9e01f", "comment": "Malware payload (Buran)", "value": "8460f6124276f6aeb086cf8ec3c3cb5e", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826258, "uuid": "14aaef92-c304-4af6-9d3a-f1e1b9d6830a", "comment": "Malware payload (Buran)", "value": "9e52f6043eb051f33601af2948f262a7a4bf47b6f861050fa26399554411efee", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826258, "uuid": "c34b5edf-c003-417f-bce9-d138ed13c184", "comment": "Malware payload (Buran)", "value": "981728066587eee0e68a04d5a5bbfb96c5f22933", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826258, "uuid": "3d491fe9-c3af-4bf9-811c-2c4d2ac29512", "comment": "Malware payload (Buran)", "value": "2bb7156234dfb749188496b473269228ff148f8a418b90d4df4fec938eca9f30b9e8f4f244499aaf563121a853ea07a3", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826258, "uuid": "c99c9a54-eb6e-4197-abd8-02b6d0ae4749", "value": "T18E74AF50EB8421961AC32397AD5352D2F67DD01093401168DD9FA3BC6B479ACC3BEBBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826258, "uuid": "a5b4704e-80d0-4dda-b1ca-373e247a8c59", "value": "6144:wsNF5lrBMfXt/0Du3arwwzQbCevgPbk0xWJQUM5t1GwZd3flbO:dlrBaXt8Du3aczCUWvrXF9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826258, "uuid": "8fafe21f-ea47-43a0-99b1-6a1dcb550a61", "value": 362262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826258, "uuid": "5c79cb72-6c2e-4895-9bcb-d4d7deee0665", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826258, "uuid": "0479709c-49c4-4589-8fef-1edc5c5f40d9", "value": "7074.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b5ccd7-0e30-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630836079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836079, "uuid": "71845a9d-b26f-4795-ad62-1023da1fc585", "comment": "Malware payload (Formbook)", "value": "f6cc0ee0fcfe28b2b4c920361321c6ac", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836079, "uuid": "0e374553-80a9-4c4e-91a6-bf0cd7b4317b", "comment": "Malware payload (Formbook)", "value": "9fa3182421aa65e06f270a297d2db929451d13e5a03c1bab8a18ba4742c17377", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836079, "uuid": "071c5015-e80d-45cd-86fe-f7ce6ee4a7ae", "comment": "Malware payload (Formbook)", "value": "3dfdebc0ada54861a1500413e76a0f7e7da3029d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836079, "uuid": "4abe434a-e747-4e20-9058-9cb23b890de2", "comment": "Malware payload (Formbook)", "value": "31a50c25c0d3a1088e771d69cc72b06dce83008cedbef3162c29583cc6dd584700515ce27a1a532d35b58a794541c96c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836079, "uuid": "7d317669-2521-4698-901f-4ee3e61deae1", "value": "T1909423D807A0A952EBD748026F6C51F8206536D4FA51372828E940054EFA5FF8F9E7EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836079, "uuid": "61d52c0f-9a21-42c5-8197-c4de80e4ed2e", "value": "12288:ns1sydOgnWGk/BjqdzELU/WkyeR21d988CKfwJu+K0:s1dgNoGh1nLfwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630836079, "uuid": "e9b96c91-5ef1-4d68-9353-6674a035443d", "value": 419616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630836079, "uuid": "9030d947-ccab-4f4d-8559-b9f750af7646", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836079, "uuid": "af8dc16a-4aa9-4821-842b-2307c9261480", "value": "RE,Re Re purchasing order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1321970-0e47-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630846269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630846269, "uuid": "3508655f-a9d8-4302-81c7-3bcbf2d30588", "comment": "Malware payload (RaccoonStealer)", "value": "b3b32950f4565ab2be4d0b48a716fa72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630846269, "uuid": "f1a72f85-b18f-479c-b148-3491dcdca596", "comment": "Malware payload (RaccoonStealer)", "value": "9fab210c530bf2475c94f693b0dce0f4b296c4a5a307187c6a7f6e50eded85dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630846269, "uuid": "d42eab95-e20c-40f4-aaa4-de9449976735", "comment": "Malware payload (RaccoonStealer)", "value": "733039f112e9c7cb9cbc7f4ccf53b23792d556e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630846269, "uuid": "6e48c66e-7b51-4765-852e-bb10cbcb9617", "comment": "Malware payload (RaccoonStealer)", "value": "f738426c772a3cb420a0e428cfa375b1670be638d60141b64701ec1e04bb308a468b2320af8759507f04994f9d6aed6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630846269, "uuid": "b2138bcd-c9de-4b62-b8eb-e29c3dfa346c", "value": "T189B4F12A7EA0E433D586C5701522F7B4EE2EFC761927C4073788E75E6E302D1862E75A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630846269, "uuid": "1cfd614e-c40e-425f-b5dd-c9ee2f595f08", "value": "5107fa4193c2849c77704d8870503de7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630846269, "uuid": "eb467e44-2a4f-46f4-9568-1d496dbae214", "value": "12288:7HlVQZ6GkJI2ocXJ/SGr4/RzVGrpayAOM7klc0RV82abfqPY7DkjfAb0f:TlKAGKIDcXJLr4/RhkIyAJ7Ec0z82c/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630846269, "uuid": "ba536eb4-179b-46ca-b462-84d247c465e1", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630846269, "uuid": "0058b886-7dfc-4d39-856d-94d14ab08bb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630846269, "uuid": "a0a399d1-745e-4e41-877f-1528588b0c56", "value": "9fab210c530bf2475c94f693b0dce0f4b296c4a5a3071.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d730623f-0e1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630826898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826898, "uuid": "f1ca7f6d-7345-437f-ad03-f0cd25617f07", "comment": "Malware payload", "value": "d461f40aaf46b3fcee1ccbabf8124f9f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826898, "uuid": "14c3eeff-a3c5-485a-88e6-af1038c893c8", "comment": "Malware payload", "value": "a18c9d0db63d2ce3a259fa77648c4ecfb4095201508d3680896900cbe83c863d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826898, "uuid": "2e5f32ca-c648-4dfd-a0d8-41288146a732", "comment": "Malware payload", "value": "f84780f50920bcd5720289e412e0d474bf72ff76", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826898, "uuid": "dba3ed17-f9c1-47ec-80b1-e38c0db90680", "comment": "Malware payload", "value": "80953478300f866a1c0ef5fca01f53320f74ec33d7ebfa26e80b14374411ea9bd35210b0c624a384389838066ce595a5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826898, "uuid": "47700773-707a-4288-b85e-221227648705", "value": "T17624BF50FB8430D90A821397FE5761D1F66ED14052801168ED9FA3BD7B538ACC3BAA7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826898, "uuid": "5b4f2f3e-3b0b-46b2-9d75-7b35387a76b4", "value": "6144:0Xt/0DdHsiPiZ5kRQFI9HMAtmOzB/gmoMD:0Xt8DdMnkRZ9HR5NdoMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826898, "uuid": "40e1e415-3610-4d0f-a924-d44e3a12d1ab", "value": 221313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826898, "uuid": "990cf11a-49df-414e-8e72-21cd06d2ed01", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826898, "uuid": "d2485c2b-8426-4f87-9447-f333a4d74b59", "value": "3259.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e3293ab-0e57-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630852975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630852975, "uuid": "4a54be6a-bd0d-4a8a-9228-ba8ada6beb26", "comment": "Malware payload (Mirai)", "value": "f0634551404e6f54ce7c9cf8e108c9e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630852975, "uuid": "e4518121-1aee-4b0d-9926-612fad6ec408", "comment": "Malware payload (Mirai)", "value": "a26d1009520d87d39aee53ff60d0cfa9582204534867ed6ebf3aad0f735a9a91", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630852975, "uuid": "04abaf20-1b98-4108-a2b6-c97f651c4bb3", "comment": "Malware payload (Mirai)", "value": "b7465b0736cc8948c504b7f45aeca0a378ba77be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630852975, "uuid": "c062b8e8-a7ec-40de-ab0c-cbe5d8211336", "comment": "Malware payload (Mirai)", "value": "60c308cd7a4c62a32af0d8d8bfbf92fab13f8cf8cd6c8511b3df1a2de4f009e58005871b3c7f6f6203dd44ec8d79eb11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630852975, "uuid": "1d2dec26-7645-45f7-ad76-83b28874409b", "value": "T1F66308917C51A627C2D113BBFA5F008F371457D9E1DA32128D361FF07A8A81F2C9BA5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630852975, "uuid": "cee07fe7-9d02-4dfc-bce3-018650049299", "value": "1536:Nyz1BLuX3DSYq+wzs3pbjD/k+8fhWhh5zQSP:Nyz1JzMjD/kxpSh5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630852975, "uuid": "e93de322-67fb-4e24-bb00-b49e0e82a1cc", "value": 73184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630852975, "uuid": "36c79309-4f22-41e9-a174-5cd62c36723f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630852975, "uuid": "3cff7cc7-ab4f-457a-82bf-8d8275eb9ed7", "value": "f0634551404e6f54ce7c9cf8e108c9e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "208872cd-0ded-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630807264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630807264, "uuid": "080bbd48-04ff-4df8-9fc9-93db7560d283", "comment": "Malware payload (Mirai)", "value": "c21d46bcf2b3fb123a3e113577b245c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630807264, "uuid": "d4968b49-a51f-4988-89c6-7d302ce70c48", "comment": "Malware payload (Mirai)", "value": "a272c0bf5db83a95e115dfc29b201104d2597e4d8d5379958a515b771095393c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630807264, "uuid": "8ca43b23-faa5-4b4e-95ba-14f04be42c97", "comment": "Malware payload (Mirai)", "value": "57ec69daa353375a064f336090875a575a33715c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630807264, "uuid": "76f61e43-8383-4425-bf12-6a2412267451", "comment": "Malware payload (Mirai)", "value": "072761d963ec35400835a98754c537c3f3ebe3fd2a14fcffc70fb6dd4c871dbc92c094a4e994e39bec268b53726fc051", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630807264, "uuid": "e8794513-c672-4cba-b1d5-058f6cacaedd", "value": "T16DA32B46EB814B13C0D61775BADF82053323DB15A3DB63065A18AFF43F86BAE4E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630807264, "uuid": "08d9c058-8e94-40bc-9893-49de57c87703", "value": "1536:k9nRL3N3tQ2WKAH7JZGtJ5k3SBW9Q9lLMiImLjMGTYEQDXZzw/96MsOEUm:Id3trBbtzk3SBVamLwGTLQDpM/96vOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630807264, "uuid": "5f66e5e4-c49b-45f2-a312-44b7724117d6", "value": 98354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630807264, "uuid": "f3de83ab-fbbd-4439-85a8-7f5cc00c5913", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630807264, "uuid": "424452a9-9652-4545-9697-0e3bb2efee52", "value": "c21d46bcf2b3fb123a3e113577b245c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7847b90a-0e19-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630826309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826309, "uuid": "c8efa240-b933-4011-8f3e-0faa6217b4b7", "comment": "Malware payload", "value": "46225ffb3b3da46e6a8ccd853a5f4456", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826309, "uuid": "abcef8b9-12cb-4f1d-9129-0a133c62ba4a", "comment": "Malware payload", "value": "a307e0f5371b74f395f4ddf48d65ce2256c274c2889d770d2d159e1691541bf4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826309, "uuid": "7b385a08-d8d1-43f1-91cf-de947b1d621b", "comment": "Malware payload", "value": "6dd1e904dd61d92c9af27e45ffbfac2f814dec57", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826309, "uuid": "8df23fd3-0db3-496a-8468-e74127ca7f92", "comment": "Malware payload", "value": "e5c2f90efcf833bc64ec7621977b0bc8b774add1766aa89349558569d30c1f09ba47d7bc34aefd1ccffbc7865a0e0ff0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826309, "uuid": "2e6e9188-c239-4340-afad-c0c946fa21e0", "value": "T1B9A4BE50FB4820AA4A832357ED5322D2F93DD10152402168D99F93AD6B479ECD37FBBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826309, "uuid": "50228b32-b090-4b45-abfa-5641a41bf5ff", "value": "6144:0Xt/0DI31RPEopMDj7CsRL5y0fpWMAgzIu+ccx53MtwKEXogEZHrtmyX5Z0FKtaJ:0Xt8DI7VYDpLFzIrhAUQbFUuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826309, "uuid": "8215e288-cf48-41d1-87c6-c842591b26b8", "value": 452416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826309, "uuid": "a55fdb71-9fd9-4485-9cef-015562ed9b48", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826309, "uuid": "22521538-d8e0-4ae3-88ed-bf924fc828d2", "value": "553.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e563b55-0e14-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630824226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630824226, "uuid": "cbf721a5-e324-40b7-af10-ab3ca2a845e2", "comment": "Malware payload (Mirai)", "value": "8fba262bd97c645efc856141c67f77b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630824226, "uuid": "92c474ee-6689-4c44-ad5d-cbb75f4b92cb", "comment": "Malware payload (Mirai)", "value": "a351ef1a7b855ee764086ba4a9a22dea2de75b5ee860da2e4d8565fc91d1df6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630824226, "uuid": "4dd5b90e-d708-4df8-b922-295397b811b4", "comment": "Malware payload (Mirai)", "value": "dc328516771b44c360f37f7977e06fa134fb3995", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630824226, "uuid": "b56bd207-9262-43c5-ac4e-6748479da76f", "comment": "Malware payload (Mirai)", "value": "6ac96f0f2f81b5614aa3d0b995e6ba85affe26b48a459d3d5ca6a5d6d9c0a6bf35f2cb8742cc4f4fca51cf902a97f07a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630824226, "uuid": "46bbba71-8157-4b9c-a660-0622a068e79e", "value": "T15B73D815FF651FB7D89BCC3309A81B0628CC665A22B93B367E34C918B54B15F19E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630824226, "uuid": "a5698a5b-cf6e-46a0-a162-37f08f215e37", "value": "768:lqwATxpQ5e+y4rWC5YOZDSfqGcOee2etJeG67t/kWDrXilvo2KXZY10Upn:lCTxq55OEDSfqX/74JVyt/HJ26a10m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630824226, "uuid": "7af34f59-dbde-4512-bb29-1ba37c539579", "value": 73596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630824226, "uuid": "f03cacf2-32cc-45d0-9038-f5fcd281ffe0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630824226, "uuid": "f01ec249-a659-4872-9bfc-22800fee67d6", "value": "8fba262bd97c645efc856141c67f77b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b2a5d3-0e1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630826942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826942, "uuid": "878b41c9-e990-4181-9413-7fe44eed6261", "comment": "Malware payload (Buran)", "value": "96d6d7e39561ad6e5cdfbacdd0b98ee8", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826942, "uuid": "95c3fa58-9144-4640-8649-9959d6e79328", "comment": "Malware payload (Buran)", "value": "a3de70209a080a861f377311f17f445f6e7b6f979ee56e9d126b17db4ff9aa40", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826942, "uuid": "a3833426-3c5e-478f-bb10-a2e4edc251be", "comment": "Malware payload (Buran)", "value": "9fdea54a783a140707ac78ce0281af28b22b0cdf", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826942, "uuid": "979bd807-465c-46b6-bff1-7dfe0f60c93b", "comment": "Malware payload (Buran)", "value": "397539195506e6ac9ad6843b69ba15301d0f1a1c2febe8e122ae316d3f01e5f9360a744aff18b5313b375926ee52331d", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826942, "uuid": "b07e6068-4dd4-4456-b453-86cdccbd7b78", "value": "T144C4BF50FA4421961E83239BAC5352D2EA7DC11053412264D99F93AC6B479ECC3BFFBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826942, "uuid": "927ddb80-569d-4772-892a-ee3797d16432", "value": "12288:0Xt8D8yW5z09vamTyrl8pwkn38xcUgHUuF8IbIh:0X2Qy4z8vamT0gw28xcUgHU88IbIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826942, "uuid": "a926b56a-7ee8-4ba2-9d15-a863fd7cfba7", "value": 560908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826942, "uuid": "8c5411ca-e2a2-4b4e-86cc-fb438e8d2928", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826942, "uuid": "e7a8c75f-e060-4404-86cb-e4c6138e660e", "value": "8291.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a0a0050-0e5b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630854471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630854471, "uuid": "81edd9cb-3edb-4f11-8189-3b6295af0e3a", "comment": "Malware payload", "value": "f0371cb1db173007d46189649c6f7a4f", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630854471, "uuid": "b4952a6f-8bc0-4a0c-98fd-6fd0a66f3f12", "comment": "Malware payload", "value": "a4330d67eeeb86ce3a2d75908ffba7ab96127ba9af09ea09ff1cb30e1491a5f6", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630854471, "uuid": "4010cf23-4195-4d13-b4d3-0b08304b957d", "comment": "Malware payload", "value": "0286b4dec7542fe2d5e45814356f41d9b171e1fa", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630854471, "uuid": "5f27118a-f80c-49e0-8feb-caa173a73a0c", "comment": "Malware payload", "value": "f84c212858347f718ab14930f5afb863790ef1a712d80e3e5b7022fbe0cb234110d9aa1558c6fb905e4fed44b2310b92", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630854471, "uuid": "cec60c8f-97ff-4fbb-8bd6-5dc28039f80e", "value": "T17351971AFD47D15C9BB9236BED978962FF1B801B9DA2110C71DCC2491F20809966CF8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630854471, "uuid": "e97d992d-1891-4235-8f82-7f17b3501653", "value": "48:Ax7V1Vk48iLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQp:SV1VaGhrffvIypvK0elkEYZ85ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630854471, "uuid": "751adc21-c682-4115-8781-e62c1ee5e37f", "value": 3138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630854471, "uuid": "672f74b9-1ccd-4d98-b5b9-1bbf7662a046", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630854471, "uuid": "6cc4bd47-f02a-4e08-a575-0df44f7d967e", "value": "LVKMFbTu.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a0aa998-0e0f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630821937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821937, "uuid": "0299f5e5-b051-42ae-a106-abe14e8d3a16", "comment": "Malware payload (RaccoonStealer)", "value": "db69f87a10131928152fb9e23b73142d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821937, "uuid": "8a490633-dc57-4662-94b8-1964fe1d1137", "comment": "Malware payload (RaccoonStealer)", "value": "a4a2a6d7b0b443f586660eaa8f71e78f207a97c2d1854b52ed2ec9516c2f97cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821937, "uuid": "f61d2fd5-bdd2-4fc1-8684-ca660629fd0f", "comment": "Malware payload (RaccoonStealer)", "value": "2e4d313ec8220995f629015bfd34a637560bea3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821937, "uuid": "8f5c141d-2de5-451f-b883-196e6ef344fd", "comment": "Malware payload (RaccoonStealer)", "value": "38b5fdc4ba636cfdf572ef04a561ef172da02ceb47da1a903dd53fbfa46dbb730f25293db9d2cebdc064a753e0f6d0cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821937, "uuid": "b8c19a51-f04e-48eb-a315-b6321a2744e0", "value": "T19AB4F1E93E50E433D1A8D6754824DBB4DE3EBCA38AA045573364FB6E3D302D0652E356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821937, "uuid": "d9e66751-d07c-4964-8536-98d840af8cff", "value": "f530acf7acd4a5c8880ba2a4704d4cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821937, "uuid": "710e995f-f880-4082-af0b-0d16a72be527", "value": "12288:t6xbUg1lKg6SIeAH7itBpmgWLDgC27CjDkji2onf:MUslKg6eAH7c/mg+Dd27+mZon", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630821937, "uuid": "af954d85-6477-4ba0-8663-1f32a93f016a", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630821937, "uuid": "48ef67f3-c5de-4c01-a57e-26e3ebbc7e87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821937, "uuid": "f4f4c06f-74dc-4806-b3cc-ccb675e2af20", "value": "db69f87a10131928152fb9e23b73142d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6053de75-0e1b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630827128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827128, "uuid": "8a7f15af-bc69-426c-b502-1bfe9a3f9b82", "comment": "Malware payload (Buran)", "value": "239cd0336ec61cc35d85c67da91cf403", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827128, "uuid": "a9de5fb9-3257-4fd9-920c-101fc77e5a5a", "comment": "Malware payload (Buran)", "value": "a5459a62acf4387240297326992efe6e5ad207b393fbe18b6e4a5d5378b1f760", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827128, "uuid": "0888282f-2f35-4b4f-b5ff-3ebdec8846bf", "comment": "Malware payload (Buran)", "value": "2658fbe0245dc0997d006956da98aa8d32df11ce", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827128, "uuid": "e6dae769-6373-4ab3-9a7b-ae869d8b8d5c", "comment": "Malware payload (Buran)", "value": "35366444df326a06e61a8c2114a421db335a8c23dac97b890d6964a9c78e1f82078f26ccd91e52e2816b6e211086ec56", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630827128, "uuid": "260bfccf-13bb-43d6-83b4-674f3f0dbf10", "value": "T18B74BF50F68420961A82239BED5352D1FA7DD10193801168DD9F93AC6B439ECD3BEFBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630827128, "uuid": "8c9d603d-1e40-44ed-bc72-02fd6b932dac", "value": "6144:0Xt/0DzqgyP9JCrxDeYe42iEZpkfpgX1igDspTmCpHWHIC3KCgqbLEYVAbfb:0Xt8Dzdc9qIpkfaFiMB/Cz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630827128, "uuid": "74f3d461-f923-41be-9ccb-b0d39a6bd8b4", "value": 351522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630827128, "uuid": "e93fe8ea-bba9-4141-9e21-6367a2d1ccf5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630827128, "uuid": "3e9ef120-489b-4d52-b380-6bee9212ad5d", "value": "7637.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4cbcee4-0e0f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630822089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822089, "uuid": "b1ff5055-ce14-48ba-88f1-26c679fab857", "comment": "Malware payload", "value": "58a017e61acceb06208d68a41f17658a", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822089, "uuid": "b3bcdad4-bb59-427d-891c-1bd7081eba45", "comment": "Malware payload", "value": "a56a07917d3a2444fc0e87cab7fb6f85829d533d0cf12e61856dd076592b993d", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822089, "uuid": "7a2f206f-104e-4d62-ab64-cdad3c9a1301", "comment": "Malware payload", "value": "973155e685dada8da86658e5739612e7d73f89b3", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822089, "uuid": "65c6d166-8f65-47ae-849a-564164e91d7d", "comment": "Malware payload", "value": "e9b605093d51e9d57b3315151252839ec585fa8a90f97c751247a6c19d2eb23f5e31cdead54ea9456293d01f323613d8", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822089, "uuid": "63980fc5-a5bc-4e87-8bc9-f576dffa2c75", "value": "T1C5E4331FA6C7D6C99257C879758A35F189D260D6F6B40B40EA0F7A247A3F0E482F0C4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822089, "uuid": "fbefb053-251e-498f-8121-582ec2e7e8e0", "value": "12288:TnK897G19m4LbNGlcbjsqNkxXdh+9mtV7ECOvz41hfqlHMgJYZsf:TnKE7G19mEGlc3s+AaI7ECSsTfqBTYZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630822089, "uuid": "97e5820e-ddc3-45b0-b935-7d25194b24a7", "value": 677207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630822089, "uuid": "08257214-adb7-4674-96a5-5d7159ba9f6f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822089, "uuid": "c1a091bd-cb03-489e-8029-e3f13a774681", "value": "INV 54903826.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12766fe5-0e2d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630834728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834728, "uuid": "2ea3ed67-03a6-4b6e-8a9e-75c088d55637", "comment": "Malware payload", "value": "24be6274aa4ba081def10a8a6ff7ecd8", "object_relation": "md5", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834728, "uuid": "2c0126b5-2f72-4d7f-a350-184f98a07a42", "comment": "Malware payload", "value": "a5f93ada2134caf0e05d607ad899d57bb7782495120824b075fcad1fcad099b0", "object_relation": "sha256", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834728, "uuid": "8e43505f-8e90-496a-ad77-4adc31834a0a", "comment": "Malware payload", "value": "1721265c0f20ee5be37150229b8a01b45e41d592", "object_relation": "sha1", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834728, "uuid": "50f7c963-32c7-47ef-ad02-110fc1f04608", "comment": "Malware payload", "value": "b509c34ab3cf613fa972bfa00cd9bc61889f22e7d77460e9346b0f9767b4353829cf146bc78a983ce2139a5add386844", "object_relation": "sha3-384", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834728, "uuid": "9effd394-0c3b-4cfc-8cc7-c44acfefd3da", "value": "T15C86191277FA8939F1FB6B70ADB852A54ABFFD615F30C08F1250568D1930AC09A74B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834728, "uuid": "2a3cb47e-d92a-48a9-9335-cbe9c2e214aa", "value": "e2d28022f7d79baf4229614e32d8540d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834728, "uuid": "6375d725-df79-49a7-a1b0-3355008eb752", "value": "98304:KsVXH2gbTfJi2plgydsVXH2gbTfJi2plgyfsVXH2gbTfJi2plgy:KstH2g/JlBstH2g/JlzstH2g/Jl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630834728, "uuid": "1515290a-1911-4fb7-b96d-9beeb45767b3", "value": 8425644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630834728, "uuid": "6f8ca19d-ce9c-47d7-a8ea-519b4f83593b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834728, "uuid": "99cc4cbd-e263-4f54-9f25-a90b451b5d2d", "value": "a5f93ada2134caf0e05d607ad899d57bb7782495120824b075fcad1fcad099b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b070bf3f-0e13-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630823826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823826, "uuid": "3b2f2138-0db4-4a6e-98fc-2146f7623271", "comment": "Malware payload", "value": "ab0bc0ddab99fd245c8808d2984541fb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823826, "uuid": "84e7f1ff-746d-40fd-8d16-0c1c5995fa5c", "comment": "Malware payload", "value": "a6dce465f76a3f03230278185eb543595aa0dc44aabc5fdd711889bffee00cb7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823826, "uuid": "2fb034cb-c9c5-4524-b99d-815abf2b955f", "comment": "Malware payload", "value": "504c9c50ff8825bc457e27e897502f723efaa4ab", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823826, "uuid": "68e68488-1ab3-4939-b392-36ff03c4210a", "comment": "Malware payload", "value": "bd5faac500afb2576d95288af94ba7913a0db63a065b0f6e3be4c3376a82294476b0de755a58123b0476054f9ae3fddd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823826, "uuid": "da33319a-8983-419b-81a6-92ce459a36d2", "value": "T11494BF50EB8420961A836397EC5752D2EA7DC10153402168D99FD3AC6B479ECC3BFBBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823826, "uuid": "c7ec02d8-9140-4251-ae90-d1a64e459cdd", "value": "6144:bZSWz0M1G54UfHOhyV/jAnXt/0DDVliU0ZhTdnuvAG/gpJzhLUfbbBXfBbq9Swjx:p0M3ZY/KXt8DDVb0ZPHphL2bnq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823826, "uuid": "6b2699fe-f203-407d-aaef-40230f296447", "value": 441634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823826, "uuid": "423fe7f6-aa93-48d7-a850-2f2c95a3a2d4", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823826, "uuid": "73e57f3e-1d5d-49d8-8156-fffbf1a5fdd8", "value": "4821.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "981236ff-0e32-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630837100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837100, "uuid": "198bab00-2c9f-48ce-8df8-196c954e6050", "comment": "Malware payload (AgentTesla)", "value": "4f93f452b75404610a5775904dc77ca3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837100, "uuid": "6bf66d7d-2f96-4f94-bd2f-01dd5514552f", "comment": "Malware payload (AgentTesla)", "value": "a73d604248662a0e4c9f4042432a533945bf7e63b77cd5a1ffbb10e75e507f74", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837100, "uuid": "a19c3519-47e9-4afb-bf9d-c83f79b2ca22", "comment": "Malware payload (AgentTesla)", "value": "ce012d0e9973fc985afc5e5dc27e2af60e4e64ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837100, "uuid": "1bf3baaa-4a13-4b4e-849d-4693c5b301b0", "comment": "Malware payload (AgentTesla)", "value": "a38f8f72edde00abe1a7c902ce7e3f596b34b8378e1290c3f7cf49435bd72747fa11223327340cb664ccb27a7ff89fa9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837100, "uuid": "bb043f5e-36c1-4d5a-8cbb-44e1768cd095", "value": "T1D655413DAD261633DBA9B67CD4E6190EE39418EB12718EEDD1E1B38C2117513B2DA31C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837100, "uuid": "eaa6bb7a-87a6-476b-9412-38e7b8d0e149", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837100, "uuid": "bf1747d8-273e-404f-8264-c76248e826d2", "value": "12288:v6vF84DtPASSVdYiO5GpS4u6C5oWpf0y3k0Vb/AElj8iDxLBYR1p2Z3+Xf6Mei0p:mmgGjZ8sxsNRpv+Bfbh/W0u3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837100, "uuid": "a1ed7d9d-14fa-4e02-ba62-7fc8088f889e", "value": 1296896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837100, "uuid": "e7279a3d-50d7-4d6e-a013-ec686125f578", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837100, "uuid": "83b640cc-3328-4493-94b7-8bf0f3f55667", "value": "PO-I20100309.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab801151-0e13-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630823818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823818, "uuid": "2869d730-7caf-4391-9d4c-a1e3c26c9903", "comment": "Malware payload", "value": "0451225f80138800587f85ae40f14e73", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823818, "uuid": "4c6c9346-9988-479c-ad04-155d135c5118", "comment": "Malware payload", "value": "a7fe60232599654272aa06a14ab541b1bbeff42bba16f0d7178343073a150bb7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823818, "uuid": "e1ec74bd-ed84-4a4a-a299-7c74ede1d073", "comment": "Malware payload", "value": "e0d67b081f5b4de74f5552f27a4f5b7d849c35d3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823818, "uuid": "43d59305-2315-42f4-a897-2b3695f30732", "comment": "Malware payload", "value": "a1dd9be69597456b04617d18d89201a4b48eef251af8071f92eecf165fd63f26df1163a9bcdd5caa8ed2e8ea84a21610", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823818, "uuid": "405728d4-1fba-4eaa-97d8-5f1a43577524", "value": "T1F34423C846EEFB678CCE1D6D7047CB82C5053BA5B4398A16120CD064AE95FEFC396A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823818, "uuid": "c7b1b41b-cf14-45f0-9f89-e73d957fb254", "value": "6144:G7Z61pN5aa98cOui2ox+P8UzsKqdWnAyi0mFxyoIkRc6srZajtlO0x:GFUpNUzcfi2owEUgJomGMnH580x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823818, "uuid": "c1eccdaf-891c-4a98-8038-0ed76d17fa1f", "value": 265865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823818, "uuid": "cc925474-1748-400d-8832-173102ca0652", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823818, "uuid": "b0c06d03-4b48-4db4-ba72-749a65d70457", "value": "4821.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a373636-0e5b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630854498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630854498, "uuid": "9f9f72ed-aa60-45d1-aff8-c491066ca781", "comment": "Malware payload", "value": "e28a0ebf4161568521134c624adf9355", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630854498, "uuid": "23dcdcaa-e9a3-49d3-bdcb-7166536017e5", "comment": "Malware payload", "value": "a8f287e480bbd47a1458959d86963367c7b8e2e0f22153a1331e60fff9e62d11", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630854498, "uuid": "77ec1070-3964-49f7-92d6-366a1623e803", "comment": "Malware payload", "value": "7aed8502dc315a684dffeb45f097f8a5c01dd36a", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630854498, "uuid": "6c710143-8dbf-4f3c-b634-8a377b7a3af7", "comment": "Malware payload", "value": "de33e22b9a1d90bedecdaa447ec62a9b9b01aa7f48c03e71d1a14c97defbbfbdd7d01e5e3102fc8e186e45777850b96b", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630854498, "uuid": "57e7f510-a4dc-4b1e-9a4c-7b61a3675d03", "value": "T1F051A70AFC47D14C9BB9232BED978922FF1B401B9DA2104C71DCC2495F30809A6ACF9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630854498, "uuid": "868d8e27-6d6a-4f36-8385-15927a690701", "value": "48:Axv48iLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBozlC:OGhrffvIypvK0elkEYZ85zk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630854498, "uuid": "5579146c-b4a6-4112-9c4a-259582dff068", "value": 3127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630854498, "uuid": "a0130107-0d2f-446c-8249-61d959266f1a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630854498, "uuid": "a70da702-9491-4b5f-9d8d-6bc6cce66b21", "value": "xxJcr1F2.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "272ccd70-0e27-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630832186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630832186, "uuid": "4fb0070c-e122-487d-86e4-fa6f4ca7310d", "comment": "Malware payload (AgentTesla)", "value": "9cd3c6248efcc4f63f0ff491b4b6b28a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630832186, "uuid": "83d28f79-50f5-4f2e-96d8-9ad765b4959c", "comment": "Malware payload (AgentTesla)", "value": "a945686d58f6b93f8a7b08aee60170b71fbcfda6d93e896685791e7b32ee449e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630832186, "uuid": "d4eba842-3614-476f-a94e-a7d73ef41b21", "comment": "Malware payload (AgentTesla)", "value": "ce0bcd3e5a9622a897239684bc652fbf65cb9a07", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630832186, "uuid": "5e0053c2-88ab-478e-907d-54b6bad4cfd1", "comment": "Malware payload (AgentTesla)", "value": "ce4535b2fd010a5586c704112a1f3580c3007719ed87d3fb3c50851da52f1dc42150c9955eaee041edce5f08e52fb4f2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630832186, "uuid": "6043cddd-5bea-4505-82ad-ed12c99da7fa", "value": "T14F9423D2A58F4D728ADF050F767F2C7A91848F63A2550126153DCF3A94EBC8869C0F9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630832186, "uuid": "4607c002-1f76-4b2f-895c-7e11a2144fc5", "value": "12288:a54eLpm6uVZgToRyXh+yauUitSyexa8yxLuCcI:mlOVZgToRI2itSys4LLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630832186, "uuid": "5dd35195-704e-4cc5-8d1e-1231c1b0f84c", "value": 428105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630832186, "uuid": "6babed04-3c8c-4540-9ba6-31364f3cb213", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630832186, "uuid": "3a160cc8-77f2-4131-bb20-5aabdc1d404d", "value": "Signed Contract.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ecec81-0e09-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1630819616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630819616, "uuid": "317d6e59-ed64-4763-9123-f6b3ff7db47e", "comment": "Malware payload (Glupteba)", "value": "2edfe2c1a5a005d157954b6155bd05f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630819616, "uuid": "c58f4605-56ed-4251-bb3e-3233b34c1421", "comment": "Malware payload (Glupteba)", "value": "a986c2ad5e8f80a7e828f999ddb2be105e59e958ba6b59eeb8ee2d5a4762f7db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630819616, "uuid": "dd092640-4a24-491e-a632-d3ae8d55a454", "comment": "Malware payload (Glupteba)", "value": "1a40995722dd0628a7b5ef5357f87fc4733d7315", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630819616, "uuid": "e20c7ca7-5252-41a7-ad90-73ca16471020", "comment": "Malware payload (Glupteba)", "value": "a66d7b6ad62f31af12230ef7b39cd868b34eb76694ef0150b66f914f1192f3d65e7fa6dc54941f2be34cfd3c3f7e9219", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630819616, "uuid": "e807852d-e8dd-4c8e-afc9-f1e1c55096e5", "value": "T1F126330A6E90E4BFC021DAB045A9EBA0DD3E7C992C14641F3715FF6F9A13285932D3E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630819616, "uuid": "9b00e513-2251-48fb-a9a8-6ed03dca0380", "value": "f530acf7acd4a5c8880ba2a4704d4cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630819616, "uuid": "1cfc1141-0358-4919-9959-de6a65796600", "value": "98304:o4+8FLHnk2DwvU7/rcnub10nXmLzcYWoKZiwzR0e:o4DLE2DWUPcuh0nXmvlszRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630819616, "uuid": "d2407b2c-ce1c-473b-8f5a-332ff863b953", "value": 4650024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630819616, "uuid": "f0d34a71-2a2a-448a-b19a-f7e0e2858fac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630819616, "uuid": "3994b158-10e4-48be-b081-7cfc711ac08e", "value": "2edfe2c1a5a005d157954b6155bd05f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01d122e-0e30-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630836389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836389, "uuid": "2fe91d2d-5e09-4026-9c0d-86e271609256", "comment": "Malware payload (Formbook)", "value": "34f738c63212987281b87c9d753baf3b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836389, "uuid": "7b2e6ccf-7c97-4d73-bf4b-737c22152fc3", "comment": "Malware payload (Formbook)", "value": "aa09b6048356495f508f8f13cf80406de45a96adfe70192dde92c7f7fe08ecb7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836389, "uuid": "421a6759-c649-48bc-9115-b826d16c19cb", "comment": "Malware payload (Formbook)", "value": "cbf3396db6b06218206bd5d002a317f7c6b1bb4c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836389, "uuid": "34fb632d-61b3-44c7-8c97-ab903e9012cf", "comment": "Malware payload (Formbook)", "value": "0fec888cdb84b5ad25fb3d0c69310fc4c0288acc5144313f7345bb2de1ba48a5d22220c196eb475120b62d72e8a5365a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836389, "uuid": "d7b2666b-6edb-4d66-94a6-b78efe723af9", "value": "T17FA3126B3CA0A14C3BDD271F3C36329162C7A6165D4EEABF7895A104A7DE644B17F203", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836389, "uuid": "cab104c5-6364-466d-87d3-45228dfd4917", "value": "1536:1CUCNDvsKnEGGsklePuRwJARNpopRetVF6oPfArrpewUXYjIQsYS9Q:10NbsKEGGsklePu2JQXtVFmDtjIQsD9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630836389, "uuid": "aef409d0-922b-458b-b157-f5a9a1bbe825", "value": 102475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630836389, "uuid": "b5d13b93-6509-475d-9c30-8e3d7549fb78", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836389, "uuid": "b58a4713-3913-468f-9c0f-69f720875763", "value": "REQUEST_FOR_QUOTE_00989_RFQ.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd082733-0e29-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630833350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630833350, "uuid": "a095aa45-55ea-4987-8454-c82cda29e0aa", "comment": "Malware payload (RaccoonStealer)", "value": "430088549a3efff0257551729353deeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630833350, "uuid": "b6283b8a-24de-457e-b3b6-fad3fdb3a909", "comment": "Malware payload (RaccoonStealer)", "value": "aa0e55ffefa1ff8605cba0b5b6594229dfd5cd54f6354a436199a64dfc2965f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630833350, "uuid": "803d70b4-5747-4085-96fb-686bd5f779fb", "comment": "Malware payload (RaccoonStealer)", "value": "b93d533f7bc51b9e32fb3ded5058ec3f46f2622f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630833350, "uuid": "9541d2d5-50d7-4c59-a718-4f8768d5b037", "comment": "Malware payload (RaccoonStealer)", "value": "604d08d3068ad10c8e9d4ad73ccc7cec603162b1c8c2f782252d35165e01499c887b23bcd209167a1e4a3bab0ca9ee27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630833350, "uuid": "ee3f5d67-aa08-40f1-b8e0-fc5814ca8a3f", "value": "T1AF65F02873DA78E3E810957F6101B75E1CBBF31BB06395A968740C8A7CC05E96846BFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630833350, "uuid": "9144a938-6b4b-424e-8b91-2624412986c0", "value": "67260fb2ac11e8fa504fec7af97d8fe1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630833350, "uuid": "06b30005-9f7e-4c6b-b45c-25d4f34c9962", "value": "24576:V/DnvEvOW9Kcr4HkZQqIK+kqny41hq57tkiZOVxtoJ+399xcEBA:tDvEv19Kcr4HkZQqb+kN5Rki9MPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630833350, "uuid": "620af960-0219-42f3-8bfc-7e7590e976f0", "value": 1514496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630833350, "uuid": "6ba9d24a-2188-42f2-a943-7e929ab77735", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630833350, "uuid": "7bf8da61-6f0f-435f-a81c-5218f3e5f562", "value": "430088549A3EFFF0257551729353DEEB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8cbb285-0e14-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630824243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630824243, "uuid": "0ac7cee2-cc0a-4cbd-b1e3-bb90031e3a13", "comment": "Malware payload (Mirai)", "value": "ae01b27be73c3c04c444768dbf484b95", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630824243, "uuid": "afbae880-bc2d-4d27-bff8-cfe0fd472805", "comment": "Malware payload (Mirai)", "value": "aa502bb6e29c12cdcb797c9e4c871d4747e9ab4a37d2197f24552a312b7956dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630824243, "uuid": "9c5ab513-3848-45d5-b623-a80a2f0c1cbd", "comment": "Malware payload (Mirai)", "value": "74cc534382ca8cdadfd9a8ef604dbc6a422e4700", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630824243, "uuid": "40583020-4c43-41de-ab75-694c8a358a57", "comment": "Malware payload (Mirai)", "value": "525886d9e32020834cc0272aa553e5e3a15928c97302a2fb406e19e8ec20cd2cf15dfafb6645a1387080b20b19879490", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630824243, "uuid": "6e47d501-259b-48c9-9aec-194176a0c24f", "value": "T10FC34B46F7404F13C4D61776BAEF42453322EB91A3DB730699285FB43F8666B4E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630824243, "uuid": "1fb0196d-9e3a-4d2e-93cd-94af8cdb4722", "value": "3072:Km7w4PYRm9eWGb1QgSljPCW096LfCM/9j02mWXpAsV:Km7w4PEBWGb1QTlu6LKM/9o2mWXpAsV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630824243, "uuid": "b1022326-3191-4963-a2eb-c49ad98be362", "value": 129396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630824243, "uuid": "119da38b-75fb-411e-af9f-ee28621a67cc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630824243, "uuid": "e825ca90-5bef-4fb0-8fed-549635e4eede", "value": "ae01b27be73c3c04c444768dbf484b95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a91cda63-0e1e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Adware.FileTour)", "timestamp": 1630828539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630828539, "uuid": "6e44da78-ed16-40d3-9d08-7d8bb03261c9", "comment": "Malware payload (Adware.FileTour)", "value": "146d5e3ba35287954f1b61bf2ef52e24", "object_relation": "md5", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630828539, "uuid": "de127cae-0b98-4026-a368-a6a63bc27996", "comment": "Malware payload (Adware.FileTour)", "value": "ab5e597bf7316bd8fcaeca8cddeec38a9585704a7929d50ea92ba603b038d7f3", "object_relation": "sha256", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630828539, "uuid": "54e758c3-cf39-4b61-a0dd-8faa84739a9a", "comment": "Malware payload (Adware.FileTour)", "value": "7950760a45972465207bd60062dab04449fa88ba", "object_relation": "sha1", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630828539, "uuid": "2ae4df71-7b7b-4ace-9c45-9b282651477a", "comment": "Malware payload (Adware.FileTour)", "value": "b26416928a37ba3894463cab6e643493be6abb8e3b1278c51909c2aeae9cbc9cb57831600015609eb8e007e274a81a40", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630828539, "uuid": "45a1f191-0664-406f-a4f0-283cfcced99e", "value": "T11DD53365A381853AE0720678984BC6327836B2044FEC549FB7FE1E1DDD7724952BE387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630828539, "uuid": "48020b9c-5073-4cb2-8ceb-5222d7886834", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630828539, "uuid": "63b35776-7a05-40a1-be2e-5c3467a6d6f0", "value": "49152:pAI+DgOabshj2kKeiN2VBJvMrslCAZCxJO19b0FzvbcKwPCGKXyi1BqbSYo2e9U8:pAI+Dnab02DslCA2JLvb5waFXLmTo2I/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630828539, "uuid": "434ec1eb-b38e-411c-a455-c882887b5f09", "value": 2913951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630828539, "uuid": "dee07383-0d40-4598-af1d-1419623c4adb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630828539, "uuid": "02ab75d1-c4e3-4467-a311-8a803a748d39", "value": "146D5E3BA35287954F1B61BF2EF52E24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24701910-0e3e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Tofsee)", "timestamp": 1630842060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630842060, "uuid": "e807fa7f-d66b-46fe-8d90-313493459b71", "comment": "Malware payload (Tofsee)", "value": "06e4f291180ef2ec62e85e7566c3634a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630842060, "uuid": "8321573c-5d89-4f62-b49a-b15b8cd4cdc7", "comment": "Malware payload (Tofsee)", "value": "ac492e6a204784df07ef3841b3ae1f8a68b349db90a34d820ba5ea889a0825c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630842060, "uuid": "e4a51fc4-5c0a-457b-ad57-24371a27d346", "comment": "Malware payload (Tofsee)", "value": "7a8a044095a925ce0cd2676f97e4263ea10112ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630842060, "uuid": "423e4c6e-9845-4b3e-9ecd-a09c96993514", "comment": "Malware payload (Tofsee)", "value": "44bf02dfdb3f3d6a48e20abed49dadee4a2e046fa9ac920c91be29daef3511b639b5e1d80cdc5ce2c44b15b872c1ccbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630842060, "uuid": "06aa0c2f-0cbe-4ecd-80a0-98fd1481e686", "value": "T12B34AD19FE90EC33D591C27C4425CBB4EE3DFCB51A64458B7748EB6B2E3028056AE366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630842060, "uuid": "319c6b6b-312f-44f6-8b9d-89ff43a5d2be", "value": "f530acf7acd4a5c8880ba2a4704d4cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630842060, "uuid": "63654c76-3395-44a9-94a8-3cfb25cc011e", "value": "3072:tMoL3vb7EGwH5qEiU+Tk5fJl683Tm7uySP3/sj91ledm4uHHx4bBvHO3:tTLDoN5qED+4DauBsj91cdm4yWBfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630842060, "uuid": "7621261c-aeaa-436d-a365-3ddc92f5c118", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630842060, "uuid": "e7d7b3dc-aa1f-46bf-b378-3ff2ce637f76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630842060, "uuid": "e00ba1d3-03f5-427b-a516-ac42c85d9936", "value": "ac492e6a204784df07ef3841b3ae1f8a68b349db90a34.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f38e1a34-0e8d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630876338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876338, "uuid": "2bf21ec1-8e3b-4196-a80e-06c94b55b9e9", "comment": "Malware payload", "value": "bd915031e49b856abb6187e060950fa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876338, "uuid": "c14660ec-0674-4a4f-bb00-cecde564bada", "comment": "Malware payload", "value": "ac994af31d2fd2c1393d25c7841b4197510f206110d50509961615e4b8ad3fef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876338, "uuid": "9ca53e8e-b15b-49d2-8f77-8909822fa600", "comment": "Malware payload", "value": "f52bacb69e935f4a7f489d0bb1aa4d9f4d536f7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876338, "uuid": "ddf16334-e230-4c5b-a6d1-b5a5850b9581", "comment": "Malware payload", "value": "8be50478463c2e5b66b6596fe010db370d58fd88fdd6a64a72f207a222df977d3a2ff1335a7fffdb1ef8f76e9f01f35d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876338, "uuid": "7e534b4e-3ede-4ae4-b47a-040304c08fa0", "value": "T13BC633A182025073FDBB5D36506977B6815A3FF7ADC4686E9D5BF2D80830FE192C680B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876338, "uuid": "e8ae6961-841a-474e-b306-1723c752569f", "value": "1e853b274dc60b64bc15b593a7669f7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876338, "uuid": "b989769e-a1e4-45bf-8bf8-70c948a81d2d", "value": "196608:Du8fBft5zmFZ73VmkHDootUVF1oFxp2CsceSQaLdIREK84RvAtvbBh92Xg4HKZ9p:68fpC33VHDoo0Fi12JcFiEKzQvbBBIA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630876338, "uuid": "ce218688-ed76-4a26-af7f-6788d4f1cb0a", "value": 11777888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630876338, "uuid": "050ace2d-863e-4e6d-b91c-3ddb340d6cf8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876338, "uuid": "16b8fb07-ef18-45bd-a261-5a128d3d57a0", "value": "bd915031e49b856abb6187e060950fa8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "709d7237-0e13-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630823719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823719, "uuid": "14b441b3-65f5-4c23-aff1-7153c32d5a10", "comment": "Malware payload (Buran)", "value": "78ad87f1f7dd3c8db93be574e8a3cd49", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823719, "uuid": "0a177d09-04f5-4389-9689-08fea563ea3f", "comment": "Malware payload (Buran)", "value": "addfe22ffa5a8210ea8f927f80ec6e9c237b6673ec36a06e505221cc87bcdbb9", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823719, "uuid": "3fe47e39-7de1-4cf3-a9e6-928d5a4d03d4", "comment": "Malware payload (Buran)", "value": "0bb79e7c7c096f807d993648b68fb97f962d5b42", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823719, "uuid": "48d21874-bdf7-410a-a778-dd63001dafca", "comment": "Malware payload (Buran)", "value": "fb1f083e009c19a1e199296217f00ae713f2f268f86a02360d777af0ecd46909674a5db0dba8ed4dc96c56577bdf4ee6", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823719, "uuid": "a26d65f2-b45d-46c2-ba1a-ca182792a2f4", "value": "T149C4BF90FA4421561EC3639BAD5312D2EA3DC10153412168E99F93AC6B479ECC37FBBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823719, "uuid": "8fcaa6c0-662e-477c-b282-046a55110a03", "value": "12288:3UFFSQY3BrSbgeY8Ojibg10XncXt8D61m70KdofGjpFX:ySQYsbT8jibg10XncX2+1m72G1FX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823719, "uuid": "815cd20f-69ff-4371-b4b3-8f68697e321e", "value": 572700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823719, "uuid": "339c4b8c-143e-445c-a02f-74b862aa7c2e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823719, "uuid": "4bfa6441-caec-4394-93ee-9cca34f67c9f", "value": "3113.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3ca408-0e34-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630837749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837749, "uuid": "84976d79-35f5-4846-872d-dddd3ba00efa", "comment": "Malware payload", "value": "e3428a72197a3b45a6255a56be15e90b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837749, "uuid": "124d086e-a82e-4899-a478-de303278877b", "comment": "Malware payload", "value": "ae6b121d73619307532eb9e084963bf466d4c95a13fc1f2c050bff7c77e1b518", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837749, "uuid": "cbb2523d-fbec-4c55-9122-498d85ebdc5d", "comment": "Malware payload", "value": "0267393dc02a0fda6f46d0dd498c9aa20077fe7f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837749, "uuid": "f63fc3ac-5746-4950-8a9f-a81721e04100", "comment": "Malware payload", "value": "1246a987a149026e98654691a8c2e1ee5f8557135ee8d07cee9f50149b5e56ef85041035a54f6dfec5701a5d422f4a80", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837749, "uuid": "a6424087-600c-4923-aa19-47511cee84dc", "value": "T17A94BF50FB8021624ED3539B9C02A2E2FE3DC411935011A5E99DA29C6B475ECD3BEB7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837749, "uuid": "276e20a9-4b18-4c2a-9884-ec840415247d", "value": "6144:qrqTgHkbeJAXdHKW+Z57a2jNp3qHSh8didE/mMJ1Wb+tQrNxbGotGpBkOBFat5zD:qrRH/JAwHfhcSedZrlyJxUkOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837749, "uuid": "b06e89c5-0439-4e40-aecb-a200907e5eb6", "value": 411191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837749, "uuid": "ab9d36cd-8426-4077-9e22-53af238d8668", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837749, "uuid": "c7dad3d5-f12a-4860-be3f-631796bddd89", "value": "9072.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d09968a2-0e2c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630834618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834618, "uuid": "50f1dde0-2e32-4a2d-920f-0dfa58f054dd", "comment": "Malware payload", "value": "bf0b2c001452669173c7cec980ad365b", "object_relation": "md5", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834618, "uuid": "ff66b7e2-58c1-40e7-b422-d3e25a0f967b", "comment": "Malware payload", "value": "af317ce588608fab46d15dd2f5e20d29d874e9933bc70e42931db903a08e4764", "object_relation": "sha256", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834618, "uuid": "47886f03-d702-41a0-bb0d-2f96fad5c694", "comment": "Malware payload", "value": "5edec0b33fd4e0ebd0306d743e170005811f6217", "object_relation": "sha1", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834618, "uuid": "43da10e0-a528-4bcf-a750-773eaa162f7a", "comment": "Malware payload", "value": "ba07e45c186cdbe05c81c748f0b0d2f6e61acca721123466da13b30ae0f6aab5489b1f7870c4b456d702756757471fb2", "object_relation": "sha3-384", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834618, "uuid": "19981563-43a4-4857-a894-b82ea3c3ea9b", "value": "T11546191277FA8939F1FB6B30ADB852954ABFFDA15F30C18F1250568D1930AC09A74B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834618, "uuid": "d27d7e7a-bf7b-4b96-958e-65a0f8f06598", "value": "e2d28022f7d79baf4229614e32d8540d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834618, "uuid": "1a58b356-5990-4076-93c0-3e8aea253629", "value": "98304:KsVXH2gbTfJi2plgyRsVXH2gbTfJi2plgy:KstH2g/JlVstH2g/Jl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630834618, "uuid": "1ffbc27f-5589-450e-968d-1c1b61f3c7e5", "value": 5645371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630834618, "uuid": "57fb5e56-7f4e-4459-82d1-ef0ab1b84228", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834618, "uuid": "9df39251-4d46-4ab6-84e5-5204743dd9ca", "value": "af317ce588608fab46d15dd2f5e20d29d874e9933bc70e42931db903a08e4764", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f51764-0e34-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1630837788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837788, "uuid": "617fea01-d365-4cbc-883d-3099596e7192", "comment": "Malware payload (Vjw0rm)", "value": "bc8827784fd40343853c431583ce356c", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837788, "uuid": "2e7562aa-b427-4821-9dd3-09c337773225", "comment": "Malware payload (Vjw0rm)", "value": "b1d7f328f02090c7524ec638e8f89efdd405a4821dd9e28cb7dac125b2615179", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837788, "uuid": "12e94777-9ca0-4aa7-91b7-dbdcd7bc0055", "comment": "Malware payload (Vjw0rm)", "value": "d5754b78ac23e511170aecf565ee32d4eb7b33d0", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837788, "uuid": "484666c3-c2d4-4d69-850c-b1239fee4f8b", "comment": "Malware payload (Vjw0rm)", "value": "c9c8aa5a0b051ec52b975b1524e51d9edf87bb89749a635393155e88250cb4de80a295703249971db7a1feb13fbc823b", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837788, "uuid": "9c3e36d7-e59a-46b8-8a3b-c820efcc9e96", "value": "T1A2C312F5311102BEB69B692E23CE3DE245540DC4E187A39CF61E135A1A726D82788C7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837788, "uuid": "a4af4818-ae37-4588-84ee-61d741a38e0a", "value": "1536:S7tTUv3quhBL5LF4uNHWLI0WSs4rXBM17gJ594xhb4su2A7ch/KtqYEBnLpY5AKn:EkquhLiuoLI0lTO17TxZ4/QZKULm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837788, "uuid": "42d8dd07-70e7-4b17-94f4-535b21ada2f8", "value": 129662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837788, "uuid": "f062476c-e9d9-4795-b117-e0bb1b680326", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837788, "uuid": "417b2572-50ef-47fc-b2bf-aa5afd64b3ea", "value": "MT103 PAYMENT_ANCHORS_4263782872.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd2ca2e7-0e0b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630820519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820519, "uuid": "30ab48fa-0819-4505-89ab-a34a181cd245", "comment": "Malware payload (AgentTesla)", "value": "cc81bcad83cc4b4232499dd12d12db8e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820519, "uuid": "df8fd802-8da4-4800-8b3a-df3ac609ce63", "comment": "Malware payload (AgentTesla)", "value": "b27900e41e16c71bf96bfe679e97fe0d76dc8eefab1305ed829f3af5759cce44", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820519, "uuid": "595f3ee4-05d4-4cc4-b545-39fed3ef709c", "comment": "Malware payload (AgentTesla)", "value": "5c4676d331b4ddde2b3a9bbccdaedd8038adbf23", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820519, "uuid": "9bfb2c69-38fb-40a6-a95e-3a15d96e2f33", "comment": "Malware payload (AgentTesla)", "value": "d8a9b84483f72b4d0e4d2a1b7284226caf6d991362c5df7c7ad5ffd14e17d7a1fd7c26b9664266a0642b813a41e518f1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630820519, "uuid": "11915404-ad76-4eb8-8a7a-89cbf4ad43d1", "value": "T117A4232D0DDD3E952857FD332615970AE211E24CCD7B2D8FC1AAFE0A59D7C0D03698AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630820519, "uuid": "47d2164e-0a41-4a07-88eb-828c8ad5a945", "value": "6144:Pft2TtCbpr/bctNMIJae1CIHlRT6U8zzEyCFO3t9PHnsPvNU6awDPksOk5ApXAgF:PsoeXBjCklFJ0z3HnsPvNbDMAXgQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630820519, "uuid": "17d0b841-914e-4f86-8e10-624ac53ed3e5", "value": 470933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630820519, "uuid": "b65f567b-34fa-4298-8bc0-83b3ead0563a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630820519, "uuid": "596981cb-275e-48ca-b55a-b128930ae31e", "value": "proforma.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7f19edf-0e4f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1630849689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630849689, "uuid": "4f59a53a-4360-4639-89a9-22e1092dc85c", "comment": "Malware payload (CoinMiner)", "value": "8b7286786c1f017e5002e0ba66bfae58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630849689, "uuid": "4cf92fb8-7f12-43ab-a84c-2ac713a26354", "comment": "Malware payload (CoinMiner)", "value": "b29336af96fb97eae18de7b3655762c9cbcd5c2f0257a43cd4c66cbb864ac79b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630849689, "uuid": "0b17ef7a-23eb-4f14-ba91-d81ccfb1e2a1", "comment": "Malware payload (CoinMiner)", "value": "1b1ab73d9e8bae1f39a897805af00df1d52b3847", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630849689, "uuid": "c0847d6c-99ed-497e-a65d-fe8b6fbf86de", "comment": "Malware payload (CoinMiner)", "value": "cb62090c6497b7a91a6ed9abcbebfaecc148c5a03e5ac5f60f8fd31b83a926e7c9b28faefc1282aaec7d102db55035ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630849689, "uuid": "84daff74-a163-4d1c-85db-581d73efc371", "value": "T17044BE3E7E50F473D596C6314424D7B0DE3EBC761A61815B7398FB6B2E30280AA2E356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630849689, "uuid": "7ddb855c-1f29-4795-81bf-4ec60422a711", "value": "5107fa4193c2849c77704d8870503de7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630849689, "uuid": "551352aa-fc6b-43ba-b42d-bc8bbca7e008", "value": "3072:sf7ySH25L73lunXwre9EiO5O683Tm7uySP3/sj94daettHY/zHHx4bBvHO6:sf7ySH2VVyXxEYDauBsj9Eae6LWBfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630849689, "uuid": "5279da00-4d2d-4c49-9656-6648981294e6", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630849689, "uuid": "fa3ac6a6-07b7-4d4b-8bcf-9887d9d00b6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630849689, "uuid": "cc7ef137-5388-457e-9475-e8476ffc777d", "value": "8b7286786c1f017e5002e0ba66bfae58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "772d7f3f-0e1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630826737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826737, "uuid": "1c56a241-1d4d-4e24-aa60-2d831ccea56e", "comment": "Malware payload (Buran)", "value": "e47e6339ff77385777355d705b68911f", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826737, "uuid": "fefd89ee-1570-4bf6-a1c4-148e799b46b7", "comment": "Malware payload (Buran)", "value": "b32bb75f5b78894a00db020ac4346a2391d5394aa25af489d6c3fbbbf67333d2", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826737, "uuid": "c088d729-5c84-4bbf-a70b-4a192105885f", "comment": "Malware payload (Buran)", "value": "9acceb009eab4aab9336723ed51b903b83d82900", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826737, "uuid": "fdf850a3-ec06-4ee8-ad90-9399901c14ed", "comment": "Malware payload (Buran)", "value": "8765fc69d2579bec4e47611d05dfb7d713f033f5b6acb362f63f56c7ab3ad9cf755f1c145ca1708813ef68e5d3d5d517", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826737, "uuid": "af5c041d-ee2b-43e4-9a1b-8b68a5fe32cf", "value": "T11244235343E1843374A42289B972CD80870DD63BFCD57E768927CC6CAE6AA11FA780D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826737, "uuid": "a10ada09-8390-4e96-bc90-c57e9dd52901", "value": "6144:HgFPB7JD5IVJxDqE0AyR3zjAU2mYO6LvwWNHLow:AlaVJx/yVJFYd8WNUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826737, "uuid": "a1f2669d-cb8c-48b9-8d0c-0dbe0c054cf8", "value": 264853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826737, "uuid": "7079ebd3-88bb-44ff-9406-91c3ce2ebe11", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826737, "uuid": "f653fbb1-286b-410d-8a8f-3bffdd0993bc", "value": "7012.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3916815-0e2e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630835428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835428, "uuid": "62566ce9-cd4a-43ca-aa24-f7bd4e631879", "comment": "Malware payload", "value": "5422b1c75b1fa257c5056824a413208d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835428, "uuid": "8eb98349-b06e-4186-acdd-48273078c998", "comment": "Malware payload", "value": "b52c2e65ab3f40b50f6857337cbba2bead58dfa2d458aa81255d5f693de5e17a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835428, "uuid": "4944bc41-f32a-4e86-9515-660b8bd58299", "comment": "Malware payload", "value": "eba4475f5ae79b8738064ca04d825e03f4533fce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835428, "uuid": "1deb8cc4-05e4-4e86-a393-67be853e7795", "comment": "Malware payload", "value": "fe5e979ba065f495486feccd39890b3e0754a083fc95b8d37fe2e74f835d1795408424f897f0be43a7dbfd56d02b2490", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835428, "uuid": "5b05ff21-2ef1-4a97-ad96-3a8da2588996", "value": "T17E045A5517A9ED79CAAD017CD5160E14ABF1BC962212E70B6ECB14FF0D02398EA913F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835428, "uuid": "b80bd5bc-bd63-4e3d-bc65-b36988ffbf94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835428, "uuid": "b37f96c6-26c2-48d2-8d24-363742efc33d", "value": "3072:MozmbwalHeHdYYNQRJEMRPgqnV+xnEdv1wJkel4kttWKVCuY8uVyE1hbU1tv3ji:MBVl+9YjDhgqnV+xnEdNwyyR9Yfbwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630835428, "uuid": "9fbd43ea-c208-4e73-80ae-9d8b1c52d730", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630835428, "uuid": "bb6b2a7a-0a91-4de5-b764-c2e1d060dc1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835428, "uuid": "e5e4dc59-c443-4070-867d-3eb670065bdc", "value": "5422b1c75b1fa257c5056824a413208d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b5658fc-0ded-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630807229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630807229, "uuid": "2839cbb9-aa54-469a-9b62-ee830c684226", "comment": "Malware payload (Mirai)", "value": "6f18257b891d9e75626c5da691237e1d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630807229, "uuid": "9d6e1cba-f373-4f0f-a1f3-d1e9a1523f11", "comment": "Malware payload (Mirai)", "value": "b612cdeac80d2d438dfc321f28fed977410f3c13ee296f215831cbbf0a59fb90", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630807229, "uuid": "25568448-a985-4d7d-8943-8864b41d73c7", "comment": "Malware payload (Mirai)", "value": "7e3fd12d240017d0f456cba60595668eaa4a745d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630807229, "uuid": "f3626bcb-a6b2-419f-a7bb-cfb7043868bc", "comment": "Malware payload (Mirai)", "value": "d447574d09cd37c69091a4e9cc3b048dc8f3c265e2dc40db350b1d679d130760789de5be170ae442b9ba67eb295fcfcf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630807229, "uuid": "1654b242-8f00-4872-b9b4-69f2ab4fe596", "value": "T19CB23AA3C8AD5E48C2588338A4B55F392B63E009D7571FFA164AC691C047EECF2193F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630807229, "uuid": "4502219f-6a12-4e00-8aa6-c111bf76803b", "value": "384:cahRggsc+Fh4xq2mutMaKFNxi/qWCbg7BxMTx9BooK/EqB1cMu:ca8BfEq5cMTb8/qWCgoCEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630807229, "uuid": "79ea04b9-9f2d-4fe0-9875-7b2eb406d474", "value": 23392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630807229, "uuid": "232297f9-06cb-488b-b756-3e3bda89610e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630807229, "uuid": "af6d3ff1-b0ac-44e1-9b4e-3f79129ba26f", "value": "6f18257b891d9e75626c5da691237e1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c179b00-0e1b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630827094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827094, "uuid": "329afb44-768d-4f9a-a30d-236fdb89e7af", "comment": "Malware payload (Buran)", "value": "0bca3e2a4b9911497e95039b0e94fe2a", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827094, "uuid": "e41efb47-986d-4849-ba29-b161e5f6f200", "comment": "Malware payload (Buran)", "value": "b6db03e7b6ae345c59dfe7c50d6d66b87a6c5cd6de7dc26ff085d73acd6fc9cd", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827094, "uuid": "01be2fb9-e348-4a09-9758-51111b7feddd", "comment": "Malware payload (Buran)", "value": "c290bef58c20bf74a780c25eed41b258c441ab92", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827094, "uuid": "15eacbba-c7ed-4670-8a39-2ad34f9a0276", "comment": "Malware payload (Buran)", "value": "611556cd611285fdd9fbbd9d89330d9ea36662dd66383675ea1776102248fc87bbc55dfeb4fe56c9254950dbe5024709", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630827094, "uuid": "9e90bcdd-96f6-462e-ab17-9209f28b235e", "value": "T15F242348363476135CA2D54A2468FDB184AEA72C8D1B8886D727C7E680075FCDCE77ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630827094, "uuid": "2b76e98f-2754-4b2a-9913-6f639e5d035c", "value": "6144:1LyCudIIuZPA8ErSzaVQodFPgnm1W6EjcRe:1Lxi048Ee2SUFYm3l8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630827094, "uuid": "191886f2-d943-4662-b175-65fceccd377e", "value": 216223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630827094, "uuid": "db962573-0d8d-4363-9971-ffeb811e9212", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630827094, "uuid": "955bca4c-ef5b-42b1-931c-d32e0b0c08da", "value": "4014.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17a7a00b-0e81-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1630870815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630870815, "uuid": "e4c12f7e-1f8c-450b-8f61-a693507daf8e", "comment": "Malware payload (CoinMiner.XMRig)", "value": "ecffdcfa4e448ddc58c02ee85170bcc9", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630870815, "uuid": "8c4e5c6b-44db-4e50-b1e5-e33012c9f126", "comment": "Malware payload (CoinMiner.XMRig)", "value": "b7413f528510f6f00fe90877e39b3cb1b94fbfb4974febc1dce58ae82f88bdbc", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630870815, "uuid": "ac61c05f-324f-47eb-8964-026308bc783c", "comment": "Malware payload (CoinMiner.XMRig)", "value": "f7256bc687970736642bc99df811fcadf0912fe9", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630870815, "uuid": "fb0e7979-c96c-4032-8b79-839f3994329c", "comment": "Malware payload (CoinMiner.XMRig)", "value": "d13b7c0a53b8e158db8e596e77cf2d71657611fcc64961509de6ae9760be41d4ed27d3e6789a5f8ed32938ba4f7dc391", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630870815, "uuid": "1709c99e-fb0f-4505-b60b-3f591ac60c2b", "value": "T1A204AE2276A0C433E5E206344578CAF12A7EF8725965858B779CFB6F2F313D19A62313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630870815, "uuid": "f6b96cbb-c322-4678-b1dc-5305c3cb987b", "value": "85e30e3a646861d465db5cbcac3b7178", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630870815, "uuid": "b8ba2a8d-2841-4c48-8d9a-f0f1008033a2", "value": "3072:FUnUmcPZo6lQgZUC+HVE/0fjsFi5S683Tm7uMevHOV:FUUmctqguG/0fUDau5fO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630870815, "uuid": "56f89233-2407-4abb-a598-e6ccfeb60c33", "value": 182784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630870815, "uuid": "c9dbeefc-17fd-43f1-af62-6c2a9d75d052", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630870815, "uuid": "055be289-3a66-4f31-9a65-8e7db7d8de10", "value": "b7413f528510f6f00fe90877e39b3cb1b94fbfb4974fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e421487d-0e1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630826920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826920, "uuid": "f89f2dfa-f09f-45c4-b15b-2442d8416bda", "comment": "Malware payload (Buran)", "value": "1ab892bd2338d7c4ff1ccbac7b3b2789", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826920, "uuid": "976902c6-db23-426f-bd48-2bcf3feb71dd", "comment": "Malware payload (Buran)", "value": "b7c6188d36b439b3981273f2a2f2b461ef6f812d424db351b9d1821c223d827f", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826920, "uuid": "c22bc8ad-c012-4628-8f45-117ad5b1704c", "comment": "Malware payload (Buran)", "value": "08067aed411b7a0ba3d2e5d5959569777b45d128", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826920, "uuid": "d321edff-031e-4e83-a548-22f728f98610", "comment": "Malware payload (Buran)", "value": "7ddcc9c9effd2c24f20a031ea21139b1fa6874486a6619968c6b518e53f1d1dddbc7d20e5c256515950925016a9c2a5b", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826920, "uuid": "2771e8d2-5b50-4076-aa00-2bf27cb1e57e", "value": "T1F864AF90FB4420D60A82239BED5752C1E67DD50192401268ED9FA3AC6B475ECC37FBBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826920, "uuid": "cf532d16-e68c-4366-aa65-2acc1e9bc8bd", "value": "6144:0Xt/0DQDGvDVnWzr5yvZtIz2d2N4ZuilViTzdw4O4USSoVf+/MkP:0Xt8DprdkrymiQSoVf2P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826920, "uuid": "79353bda-7395-485f-9382-e47e9bc60009", "value": 320947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826920, "uuid": "b247c30a-d0a9-4a27-a8fb-f9b62cb34ffb", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826920, "uuid": "f7fac811-4f47-480e-915d-8f7e01a3d452", "value": "9212.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f271390-0e1b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630827180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827180, "uuid": "f37af36d-2876-447e-8750-01a951025f99", "comment": "Malware payload", "value": "b4f0d571b581d96119e740c74ef6b74f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827180, "uuid": "16fe8878-031f-45ab-9154-0cd5c30882c5", "comment": "Malware payload", "value": "b8ceca4b11fb4406089849878913410dbfc96820071ed7255b260c5213004119", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827180, "uuid": "209aa7fa-6861-4909-b8a8-fbeabd712052", "comment": "Malware payload", "value": "00b8466ce87c2440ce2ccb7d1848de349457b2a2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827180, "uuid": "7613a136-4c82-4c97-a4d9-536395ccc44e", "comment": "Malware payload", "value": "84b78ad87c4b1c27daac8393a0fb0c80b7a080116ec5aa2acfbde2bfe7c0118743e05e5e2404fb180949558effe2c6ec", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630827180, "uuid": "2128e5d3-4900-4791-828a-984fef8956fd", "value": "T11F9412ED8B3A84C258147D302E4E8A5957FDA978D194DE8CD3F5F8CAF0072E172A2D91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630827180, "uuid": "e9324fe2-6e6f-4574-bf55-43cd2dc3bfb3", "value": "12288:kQ8hVBen2gf/zRb50dltIKDYqwg5wWJgOAJ+:J8hVZg1b+Dtls/g5/JvAJ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630827180, "uuid": "2db194a2-7a5a-4512-8456-703dacbb8c31", "value": 427448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630827180, "uuid": "171c130f-a212-4d5d-84de-c35388b985a6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630827180, "uuid": "79b633c9-a5da-4c5b-abe7-40c02f73b481", "value": "Approval August Orders.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f22a893-0e10-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1630822348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822348, "uuid": "5f583667-a4a1-450b-a078-58a00a937c0c", "comment": "Malware payload (ArkeiStealer)", "value": "4a52c81513f74a21d7b012de997f2445", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822348, "uuid": "3e812496-0fdc-49c0-868d-07b95a5ba2ed", "comment": "Malware payload (ArkeiStealer)", "value": "b98ce97a468d7e69e2d9344268d2c68085cf95f6386b4d5c89a772671b95468d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822348, "uuid": "49ccc463-2ccb-4efe-b009-13ffa79b76dd", "comment": "Malware payload (ArkeiStealer)", "value": "eced3001b0d0f3a98fd9046d1b55685b1a4ff275", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822348, "uuid": "8390ea8b-d1dc-4ee6-bb77-867426c8e525", "comment": "Malware payload (ArkeiStealer)", "value": "f186e5dc7b0d0b2bb8b37b6e49b4e25b33bb27c618a24fa4126e8f6ea8a2ce45a9d7e5ee40578231cd9939fb44c70862", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822348, "uuid": "5b0bed4d-0c5c-4d31-b2de-6d517b40d9bf", "value": "T18DE4121A3E50F433D4A6C5B5D836C7B0DF3EFC625A30418A3358FB6A6D342919A2D726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822348, "uuid": "5658c438-d84b-4fa2-95f1-94b8ddfdb358", "value": "f530acf7acd4a5c8880ba2a4704d4cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822348, "uuid": "8ec1b87b-8b62-4580-9bbd-ccc9bf6dea13", "value": "12288:Mq3Vuf8U282ml+/lb9js7q7dBDs+gE1iDuoSp2j2bz/9OI3r98DkjCSrDnf:vwHGlC2By02Uj8m3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630822348, "uuid": "08044fc2-2459-4dec-ae90-36d5b823eade", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630822348, "uuid": "174341e9-0e34-4420-9e54-28804f73c743", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822348, "uuid": "5c2ced52-2425-4c6c-a7d1-59cda463d9de", "value": "4a52c81513f74a21d7b012de997f2445.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb7d190-0e2a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630833752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630833752, "uuid": "7fdcb26a-9253-4abf-ac73-8d59d71f8d0f", "comment": "Malware payload", "value": "152d5284b9ed6503b01a61ad6df78204", "object_relation": "md5", "Tag": [ { "name": "CLFS", "colour": "#F50809", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PRIVATELOG", "colour": "#EDDDAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630833752, "uuid": "40fb48ed-b1ef-4a8b-994a-fcd188e8aaa5", "comment": "Malware payload", "value": "b9d4ec771a79f53a330b29ed17f719dac81a4bfe11caf0eac0efacd19d14d090", "object_relation": "sha256", "Tag": [ { "name": "CLFS", "colour": "#F50809", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PRIVATELOG", "colour": "#EDDDAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630833752, "uuid": "7bd4cf3b-3f92-4dc9-9215-0ff729b0a6b9", "comment": "Malware payload", "value": "1316f715d228ae6cc1fba913c6cc309861f82e14", "object_relation": "sha1", "Tag": [ { "name": "CLFS", "colour": "#F50809", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PRIVATELOG", "colour": "#EDDDAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630833752, "uuid": "eac91d27-9944-448f-a979-60c7da918d98", "comment": "Malware payload", "value": "aefc27346a67508c611f8e1daab8128da7c2983be3e6811c268325320838e257720575c6d33e27124de647344faa76e7", "object_relation": "sha3-384", "Tag": [ { "name": "CLFS", "colour": "#F50809", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PRIVATELOG", "colour": "#EDDDAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630833752, "uuid": "b63550e3-6858-4f66-a6d2-f477f931c60c", "value": "T172E3170BB3A140B7E57681B68A239A06B7B2F41107209B9F0769066D1F537B19E3DF72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630833752, "uuid": "c4975cd8-bb49-470e-8a13-678f3a3fdef6", "value": "207e4c5010e9cb8c1e3d7cd6712ce362", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630833752, "uuid": "bcf868de-73e6-4623-a129-ee721ac2f625", "value": "3072:fUGSLoZ6HyD0B8TXUGcMHPT2HLMsmFBZupaxr2UYs9uLbr:fUzL20MXUGVLYMsmFBZu1Lbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630833752, "uuid": "8d0afcc3-7827-4a4b-b111-19f2922eb471", "value": 155712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630833752, "uuid": "5afcfdbf-956e-4ba5-821c-f634b2b25a86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630833752, "uuid": "031b6d8b-2de2-48c4-88a2-d85e6a1a5a80", "value": "b9d4ec771a79f53a330b29ed17f719dac81a4bfe11caf0eac0efacd19d14d090", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af21a1a-0e13-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630823710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823710, "uuid": "aeeeb9c3-a03b-4d68-ab13-beed356f1b3c", "comment": "Malware payload (Buran)", "value": "2c9b05269fb6038c6c7f93d4652e40ae", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823710, "uuid": "f3a87e5e-8305-4e7f-8d3e-401ccd6d8690", "comment": "Malware payload (Buran)", "value": "bb1a8f921a87f5467f4c70f900775ae8835554f45595de4ba784f2ba569ab43b", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823710, "uuid": "aaaa6d67-25e4-4fed-b443-a4591be8e9eb", "comment": "Malware payload (Buran)", "value": "ff453875dd49cdf4d34d658bfb30e623cb4077b1", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823710, "uuid": "e6103ed2-3ce5-4b6a-8ebb-30b33960db17", "comment": "Malware payload (Buran)", "value": "2dc9f75876ac101b6c8986c5d9c78613529d7cac04f31adea196a6471d22cfdde8eff9c4829dcd3324190dae311394dc", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823710, "uuid": "c6f6d842-2f91-4667-b475-c4909c21d0b4", "value": "T15E7423F7263E68097833DD5225A9891658BD987BB7F08C917AB009C235DDE2DC1D382E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823710, "uuid": "0415577d-4600-446c-b585-d4e865ac0885", "value": "6144:oCp1Oosc9SesiPUr3zCw5mU0U4c+XqBg2tcholXiP1PqPE/90V0pc6Mq3jTjpdy1:Lp1Uaaim3L0nc+XJIcT1xuapNMwjXtU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823710, "uuid": "930da1b7-89e5-4eb1-b3b3-d337f1e950e9", "value": 346999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823710, "uuid": "837a65a3-61ea-42fa-b21f-cdaa86db1b96", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823710, "uuid": "8d0c442e-9880-4c4c-86b5-e4db8ea71fac", "value": "3113.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a419ea-0e2f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630835888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835888, "uuid": "cec201f5-40dd-4e88-8368-d877932d4f9b", "comment": "Malware payload", "value": "cdf07f19eb3422ed2a12e1dcf7be1a2b", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835888, "uuid": "6508d19c-c9c6-470e-b355-05d2cdebc6eb", "comment": "Malware payload", "value": "bb3b3d4ac36d8ff6c07f2cc25966522fcbc0dd24d48cc66bf3f2d239a5deb6d4", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835888, "uuid": "eff8ff7a-f455-4815-9e66-862802aef077", "comment": "Malware payload", "value": "9e22d44841ac1a0bcf3848480944efe3955778c3", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835888, "uuid": "132f2de9-1c7f-4431-9c88-4224fc626fc0", "comment": "Malware payload", "value": "f0c48e2975235eda63c21f9bc02bfe5a34fa5b22279c291a46ffacd7df04675d52239130c06fb927d1bfb00ef29bc6d2", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835888, "uuid": "6bea8bfe-7dc2-4b7e-9bb2-957bed2d4eac", "value": "T169A43977FB80E859F6E188397559DB610010393028A5C9B7B7C97F2B3A711CAA617F0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835888, "uuid": "ceb55ea5-a3de-4ccd-b58d-65d9684bb907", "value": "6144:QwEfD/i1lkemVTtOASZNaEz2RL1enFSCt/HL582Yxz1Ti1DkHihbo:umetOfNq1otDm/xz10YHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630835888, "uuid": "bdf4ceaa-ac56-40e8-95ba-c4a26b4abf69", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630835888, "uuid": "997f4fbe-ca53-4a88-b6cb-feb1f10c1800", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835888, "uuid": "5bae3d29-5b25-4b3a-a6b9-271ab91c4ea6", "value": "RFQ for MRF 3275_________pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7fbccd8-0e2c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630834657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834657, "uuid": "7b4ce46d-6b0b-4c2c-809c-c30f5e375ad4", "comment": "Malware payload", "value": "713c1ca73bc43bfe49ef0cb6c5ed14b0", "object_relation": "md5", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834657, "uuid": "1864dd94-0cc7-49fe-8498-d4628589ec9c", "comment": "Malware payload", "value": "bd0b6e6828ab9430cca71f84ffac72c1556740850a413d9b445055789f97d040", "object_relation": "sha256", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834657, "uuid": "8256fae6-b3b9-459c-8769-8f42a9bca4c7", "comment": "Malware payload", "value": "872ca5052ab3ab0b5e30f5db5c6cd42d12299e87", "object_relation": "sha1", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834657, "uuid": "d64b038e-154d-4e42-a954-8a1f309244f5", "comment": "Malware payload", "value": "9f78c9295c8d148005fb5179a63633302318e0190d8b94ce8c61b63c1c7eb924b1ce31224ed2ff4ca3d5e5932cec5bcc", "object_relation": "sha3-384", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834657, "uuid": "15d532c4-662a-465a-8ec6-3efb20f4a164", "value": "T10D86191277FA8939F1FB6B30ADB853A54A7EFDA15F30C18F1250568D1930AC09A74B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834657, "uuid": "8c24dcae-724c-4630-8906-e2b155afa847", "value": "e2d28022f7d79baf4229614e32d8540d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834657, "uuid": "83785d26-563a-4b79-97a2-53a3af795f67", "value": "98304:KsVXH2gbTfJi2plgyWsVXH2gbTfJi2plgy2sVXH2gbTfJi2plgy:KstH2g/Jl6stH2g/JlqstH2g/Jl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630834657, "uuid": "3223777e-d14c-4408-8f40-5ccd9058ba04", "value": 8482190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630834657, "uuid": "6a96daec-b4e1-4f69-a3df-9caa6c729eb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834657, "uuid": "40cb3bad-e1a3-441d-8fb9-0735b11344e2", "value": "bd0b6e6828ab9430cca71f84ffac72c1556740850a413d9b445055789f97d040", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "120fb6c9-0e2f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (a310Logger)", "timestamp": 1630835587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835587, "uuid": "4d4b12ed-0a74-4cf8-b3fb-b5a8b57c6eb5", "comment": "Malware payload (a310Logger)", "value": "1a6b2681aa6b7b22892812db44c40650", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835587, "uuid": "aca4a5f6-9185-4cac-a836-cab4efc6ecf1", "comment": "Malware payload (a310Logger)", "value": "bea7fc2e0fd9a1a0eb1382285dcbff3db76a372c18249673bf331257bac602af", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835587, "uuid": "2aaa7926-f25a-4dc8-be96-c49aac0b75cc", "comment": "Malware payload (a310Logger)", "value": "5db040af639744958921bfde663df0d8ff1454e3", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835587, "uuid": "334b3b23-d734-450f-a39b-a08ea1739f3d", "comment": "Malware payload (a310Logger)", "value": "c58ca6fbe0e3da52872c8d9ff3dc633b3727f5dd7648c4d51a86aa9eafaa3b1ae4d5f47c390dd9cbc2cdc69862779bcc", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835587, "uuid": "8d3f89bb-a2a6-4b2b-9459-d50ae7e0f35b", "value": "T16FA312CA915382E467FDE99F24841086B1A43762B6D2FA649CBE51304F3E93341376EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835587, "uuid": "82590e4e-ee5a-48ae-98d5-ef7d4375fbc5", "value": "3072:lrZkhwSq+hbKYCn12kSoyfj7beWPs1Izwc0l:lrmh3q+IT12kSR7qHaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630835587, "uuid": "6a4ac551-e3da-40c6-b144-ca89127ba3b2", "value": 104020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630835587, "uuid": "6b21e0cc-7b5c-4c62-a049-eb7220052dd9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835587, "uuid": "a5b258c1-29cc-4239-8933-e1d48fb12156", "value": "090009000N.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cb66661-0df4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630810237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810237, "uuid": "7c0bb9c2-69d2-46ad-8fe9-fe5c2b07d450", "comment": "Malware payload (RedLineStealer)", "value": "7c81058bf4838d0d570044981a0c4de5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810237, "uuid": "4e1a3cff-b7e2-4045-9cf6-3cab7d2cf9db", "comment": "Malware payload (RedLineStealer)", "value": "bf90ed75f44fab1eb49a9bc8ee12c56923a9766bf03794b9a293024be4b0369b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810237, "uuid": "57d87d21-e7d8-4819-9120-b18ec9986882", "comment": "Malware payload (RedLineStealer)", "value": "a78ddad92b2cb1a9ba9c1d840d26803420976935", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810237, "uuid": "d24f7d48-cf38-4fd1-bfd1-5fe30b756238", "comment": "Malware payload (RedLineStealer)", "value": "0f8bfa4bb2658348784af88dd162c55e1cc93d30a1a820983268467cfcccbbbc450f0a3b8dccfb70e6cfeec85a5d02bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810237, "uuid": "dbb421e9-b217-4dc1-a4e5-8c05e0dca6e9", "value": "T116D4FC28657FC019C4E7EEB12DDCA4BAD99A94E3640D723310B4633B8B51B84DE4F4B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810237, "uuid": "a19d3b8a-001e-4086-aff5-f15661410c62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810237, "uuid": "b0a6e222-f66e-403f-a86c-14bfdc482d5b", "value": "12288:FONXCUklT97igXmy/BRjhq/jL98lua4dR1HKWqf8hGt3hFmg7s3K4olA:8QL5jhoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630810237, "uuid": "ba43242e-6666-4b8e-bd47-8853b608f42b", "value": 635904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630810237, "uuid": "9ac691ae-45ea-4ff6-9b4a-560317d40c66", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810237, "uuid": "683d489c-e58a-4ebd-8f31-f3ad37c1529f", "value": "7c81058bf4838d0d570044981a0c4de5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca1500c6-0e2f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630835895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835895, "uuid": "607a5c12-4b81-4258-a5d0-4ab3b02742e6", "comment": "Malware payload", "value": "67bd55895651f1885a71d9f00ce313e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835895, "uuid": "0982b30f-c8cc-4c1a-bf5c-172d4b3f079c", "comment": "Malware payload", "value": "c01a11fe55ca0a9ab00521c418f900d4da2bd1af6e2f030ad8d837bc153ca7b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835895, "uuid": "438e9536-32eb-4ca3-804b-bb5a9ecaa8dd", "comment": "Malware payload", "value": "feefb4c2434c5bf4ad7b393d414c4fcc93429e0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835895, "uuid": "f48da153-635a-4812-87f7-d436de3836cf", "comment": "Malware payload", "value": "0caa18e349e0e890daf13d71a7f469906186fc4897e845820037f4a62b2fce3f99782253f4d667f0ef13ed1744d3386a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835895, "uuid": "6d83137e-fdb1-4a8e-888b-5774156defc7", "value": "T190942977FB80F859F6E188397659DB611120393028A5C9B7B7C17B2B38711CAA617F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835895, "uuid": "b1a92821-61ae-4780-9587-ad37268e30e8", "value": "d746df0c6d243e11e2680c79fdf70b3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835895, "uuid": "91d1e8c2-b8e8-48f1-969c-acd634c70d9a", "value": "6144:vwEfD/i1lkemVTtOASZNaEz2RL1enFSCt/HL582Yxz1Ti1DkHihbo:NmetOfNq1otDm/xz10YHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630835895, "uuid": "a13eedad-e143-4b45-9d93-5f06d96d1bea", "value": 420352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630835895, "uuid": "3e4793b4-da18-4995-bfc9-38563e39c567", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835895, "uuid": "8c6edbb7-b0e6-4caa-be84-2678e4d01652", "value": "KASH101.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a413a621-0e12-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1630823376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823376, "uuid": "b52f230a-14bf-4e23-92ed-98feeb43384b", "comment": "Malware payload (AveMariaRAT)", "value": "374e2f808ed36f7229b715f3cf336246", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823376, "uuid": "45a76d34-e707-4e47-a2b0-569ff1348d94", "comment": "Malware payload (AveMariaRAT)", "value": "c0f8ced3b810c8156bac01fd24a8a01c12d63ea2e3001a091def496ae388b691", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823376, "uuid": "6853616c-c248-442f-82d6-e14a4227529d", "comment": "Malware payload (AveMariaRAT)", "value": "7dc5ca07b493c44f9cfe1a9aaf6e50ec0e121a4b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823376, "uuid": "8e87e8f5-bb4d-48c6-9e0d-2435ccd2014a", "comment": "Malware payload (AveMariaRAT)", "value": "954595ec5f9416bf772d7fb8f71dad6015e56944c950e93149c1942ef96e703ab72a617c8f72535e4f49dcbb48882449", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823376, "uuid": "1635c50d-6c58-48d3-924e-8a427148d7ce", "value": "T111842311D53B6C64B8F8D4E846BB355B2C980E2FF31C925C0B581916BEBD0D2F4FA986", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823376, "uuid": "a96e1454-bb88-44f3-948d-5864467ef19c", "value": "6144:DjM1Ut87Y2MdFFw6rO0WOW47g2aQT66zm822FDDVM4fydqkY0xOas11/H7Afao9+:DQq9Vhs0LW0g3ebzm8dX61Q1tDowiTfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823376, "uuid": "3a34c1d6-2c58-4a86-917c-3a8f02a3538a", "value": 388919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823376, "uuid": "4a47764e-799e-4d5e-8f1c-ebd07a225ab2", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823376, "uuid": "baecfb7b-018b-400f-94bf-03054b9b52aa", "value": "ORDER INQUIRY.Z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebdb2941-0e1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630826933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826933, "uuid": "f24c86dd-2740-41e0-894f-410042f82ca9", "comment": "Malware payload (Buran)", "value": "71d337588c92826cc80ba75a1e19b92d", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826933, "uuid": "8c5a8e99-e14e-469a-9d0f-e9bc4307b2e0", "comment": "Malware payload (Buran)", "value": "c165d0bf3769f50d2291edd3df283d33816a4973203c9eed2a68fbf463d3b99a", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826933, "uuid": "d53938a0-ca67-45fc-a17d-65d2adc185fb", "comment": "Malware payload (Buran)", "value": "0bee3241f6147489dd3b034523bc839ab38ca722", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826933, "uuid": "d0d89ad9-3afd-4615-9f51-3f88130bd2ab", "comment": "Malware payload (Buran)", "value": "308d5d890665a9d5cfbdb631e5cd14d7e6564d237449938b834fdef36f985b32232d8b06381976014329a960da48f675", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826933, "uuid": "b7b76e49-e4e7-4290-b855-d720cffdf7b7", "value": "T12974235D15472CBBAEA454FFB63D7DB4380DCC04B128351A3DD3E1CCA63DAE69942186", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826933, "uuid": "a0fd574b-2bd9-4e08-8d69-954034a871f1", "value": "6144:0FCrJu5tBwHYOkAtqNvBCnTAwVUVMHeHG8UxZuJzGTI154ndwNW:fu5a3LqhBCTAwAXZqC4ndSW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826933, "uuid": "1e352936-ef8e-4bcb-b777-983970f9be30", "value": 337917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826933, "uuid": "fed473e4-a7e1-425a-84f1-137d26d0f520", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826933, "uuid": "c6ade413-1fd7-4e38-b08c-903945c674d4", "value": "8291.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc70a80-0e13-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630823664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823664, "uuid": "c031c769-a7c4-4950-89ee-51dc4a957ae2", "comment": "Malware payload (Buran)", "value": "b465eff25b67256c48cfd7040a639a92", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823664, "uuid": "c0cfcb32-f31a-4749-92d6-4a677913ed19", "comment": "Malware payload (Buran)", "value": "c171db74565fe68888b97017c544687225440d2ee80573cdfcf9ce5dcb7bf2ae", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823664, "uuid": "8766bdc7-d996-47d0-b50b-fc303c792449", "comment": "Malware payload (Buran)", "value": "089b9e8016be24d79083aef5477549a07008a18d", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823664, "uuid": "a60f6add-b5eb-4729-a97e-10aba2faa2ad", "comment": "Malware payload (Buran)", "value": "65783b416040ce26e0f2afea95a156aa1f2a0f650aca49b1797d0cee1b58ea6fa7d150127da943ba45c6e8fa0c778ae2", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823664, "uuid": "b384012a-65b7-4f32-ac06-bae4d31f4dee", "value": "T152149E80F7C830C90B8213ABFE5791D1E66ED40192411128DD5FA3BC6A539ADC77AB7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823664, "uuid": "a43ed245-e7f2-402a-8b48-c8711577e231", "value": "6144:0Xt/0D8+Qxo5lMdxu7y48tjvE+6ZRT+4e:0Xt8DSx8gxAiREe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823664, "uuid": "67a226bd-d8d1-4f95-9401-c85607417b4d", "value": 204458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823664, "uuid": "6825bfcf-e8cc-4b65-a15c-c7fbb8528823", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823664, "uuid": "9bbbf72f-24d3-456a-8a01-5c94db6a1a69", "value": "7681.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc445741-0e59-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630853911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630853911, "uuid": "5150e97f-bf47-4237-b849-da31b067ea93", "comment": "Malware payload (Mirai)", "value": "1c84ee91236776d3168c141f210b5d9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630853911, "uuid": "4b868977-b16f-430c-aa8c-eeec16017ca3", "comment": "Malware payload (Mirai)", "value": "c24486796dc22513717643a2ead7cc5a94b02c0b74c185cbd225b5f4667a3516", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630853911, "uuid": "225d6a14-d922-4267-b3b6-52e4e74510ef", "comment": "Malware payload (Mirai)", "value": "26cfdbc77a67111ba28b74f6ba18c49547768c82", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630853911, "uuid": "31629f7f-01df-4687-96a5-3d0f2e5264cd", "comment": "Malware payload (Mirai)", "value": "9b12387ef518d605b65365933d5af1044132574d757b9dd7d79ec16ad56b75e3a39572c1f778e6e34cd0a077e424a435", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630853911, "uuid": "33fef908-f386-44b7-a393-5bd59c9dc52e", "value": "T1796339D9BC229E3DF48FD67D80150E06BD20228295D30F266AABFCE37D32095BC96D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630853911, "uuid": "9878dc0a-b9a5-405d-9395-006f80415f54", "value": "768:I0ehLGWOBZq+b4LkLDDZLbBQjWDgFHvrUu7878vCe37kdEfXgTe4o6Ew3W:I0Nq+bYkD12hFvr97872/kdEfwTeGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630853911, "uuid": "86ff7df4-ab2a-4ef1-b073-bb912d2e3a33", "value": 67520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630853911, "uuid": "873dda96-7a47-42a2-ad87-e600f071c09d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630853911, "uuid": "b0f5301a-6ed6-45c9-b04c-30eaa4be7494", "value": "1c84ee91236776d3168c141f210b5d9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e89d7dc-0e13-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630823743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823743, "uuid": "b72e65f0-26aa-4756-a29b-b360a1e1dd5b", "comment": "Malware payload", "value": "d4e5c482ce18253f162293c354af881b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823743, "uuid": "d86fca2e-b551-4447-ac2b-1ece9c55db58", "comment": "Malware payload", "value": "c26d0d90b618b9c2ba5a17bf52925ac4b82d47df79813440811ef87363a47849", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823743, "uuid": "7c14849e-b531-4e38-8285-f0170947154a", "comment": "Malware payload", "value": "7ce759139bc5be80937b2d7465982e9a6dcf4bf7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823743, "uuid": "f9332fb0-3eed-473b-bf3c-f845f256ab8e", "comment": "Malware payload", "value": "85cd277d2ff57e575c51bb418f5c577ebd9eef2ee0003f4c242578d282bbe7ea7eb9bcc427e384b72b15125ef1b81779", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823743, "uuid": "5ece6d5c-b39d-4a6e-9dd4-a3264ef20a07", "value": "T13D84C090EB44109A0E836397ED5351C2FA7DD10192411168D9AFE3AC6B478ECD37EBBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823743, "uuid": "a74872d7-7751-4405-8988-20bb9f99adce", "value": "6144:0Xt/0DBZ00gCqYX2VoCC7Jrk7g5ZW7HiJu2kL7XdJzvvat59fURboQwuWt4vweOz:0Xt8DBZjR+bC7x9kL7P2IRNWjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823743, "uuid": "8cdad569-cf42-4342-b16d-52b426afc3cc", "value": 404283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823743, "uuid": "c654fe29-c130-4063-b3b5-956c68b1736f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823743, "uuid": "3da28ff5-b17a-4290-9289-5ac57e7a0f62", "value": "2851.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15dd1e58-0e68-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1630860074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630860074, "uuid": "3fb22239-dff3-4811-bbb6-209d293b866c", "comment": "Malware payload (Gh0stRAT)", "value": "b51f17be01243934bd9b507bb3082498", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630860074, "uuid": "975f203f-6781-4a08-95a1-a88333a19105", "comment": "Malware payload (Gh0stRAT)", "value": "c286536081ae21b1210e9b2d44cad98ba7849dcfcc1e3c864e9e60216682bd27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630860074, "uuid": "15f3f015-19fb-4aee-8b21-f4a21e4545a1", "comment": "Malware payload (Gh0stRAT)", "value": "9cd50f951518c4ab68d6140663c80d4688849823", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630860074, "uuid": "93158394-9993-4e43-9c34-4ee19ff47829", "comment": "Malware payload (Gh0stRAT)", "value": "ccb298d721a6488ca5133845f569dd66aa74d657d4f335fa739b5c9b76e352ffaf79d8321279c185995bac9a965b358e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630860074, "uuid": "cd38c875-dfde-490d-a900-dca79d6c1ae6", "value": "T14FC46B113ABE8177C6A605320EBD6FAEA2E8DD504B61EDC367D93B5D98358C1073213B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630860074, "uuid": "de642bf9-481f-4ab2-a008-2faba2123df3", "value": "4cb73e88ed0bfde77426852a4b6d08d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630860074, "uuid": "6e091dfd-db63-490b-b4e6-db61fe838e4f", "value": "6144:zRK2IIXtxecGD13Z+09dAklAbHc0geJWTo+hI//GWlUEJeaZSAET:zRKl8xiDVdAkybHc0jWTo+inGWlde62T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630860074, "uuid": "d1d7d466-6d0d-42a7-bf52-31b42c1d0a79", "value": 587342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630860074, "uuid": "d1f4c302-6164-4d78-bbca-a1c7879d73be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630860074, "uuid": "882ce39d-68da-43b4-a4c9-699af3b38979", "value": "c286536081ae21b1210e9b2d44cad98ba7849dcfcc1e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f5fd5cf-0e0d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630821221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821221, "uuid": "903077c6-4332-4a37-822c-4d198db1f651", "comment": "Malware payload (RedLineStealer)", "value": "e7d517b6f819de982259688f527086e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821221, "uuid": "00bc09e6-5d8e-42a9-9ec0-96e9c772c8a4", "comment": "Malware payload (RedLineStealer)", "value": "c370a10ff643e3c1eee6b00be7f9ef17135888bdb579708e2e62f1460195c7eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821221, "uuid": "5a17d45a-7ddb-4a78-97cf-c5fc414f7443", "comment": "Malware payload (RedLineStealer)", "value": "f494477878bf145e84c2e066e9a18917fe77931d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821221, "uuid": "f541402b-fc5c-499f-907f-3c00a4b4ba3d", "comment": "Malware payload (RedLineStealer)", "value": "132eccc6236fd3165cfc629a5413d7d54bdffb9963e08175cf6a96ce45249c73db0cfe6b0ac83550f1254a50fe730593", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821221, "uuid": "d1c32a6f-6caf-4a5b-9726-cd928edb7342", "value": "T1310453B27DE2C102E6764E3451D1660B36BE53B00766B64B5EF63F09C93FA331A2905E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821221, "uuid": "2d4d6c44-3906-47bc-84d3-ec40848cce81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821221, "uuid": "f1b3dd11-9e36-4768-920d-95beba770daf", "value": "3072:pJ6cJ8E9XGzTNwqhxsg9AcRbTxiInziin+dKqgG4OVRah43lHJTTcCLAFOPsYBHv:P72EBqNwqIQZnz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630821221, "uuid": "23ed7325-ac68-4ac4-b7bc-d97a128c9ba9", "value": 177152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630821221, "uuid": "2c365160-8bf2-48a3-92b4-570ba41c3306", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821221, "uuid": "eefd8ff6-4637-4b6b-9c52-8ee4889db2e0", "value": "e7d517b6f819de982259688f527086e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf1ea97-0e33-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1630837482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837482, "uuid": "a6aab408-f963-4a57-9e22-c37dd929d1e9", "comment": "Malware payload (Gozi)", "value": "16541b4a2e073b98d792b038185a8309", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837482, "uuid": "6972a199-2a89-4497-8514-233afa1158d5", "comment": "Malware payload (Gozi)", "value": "c4a207c9bb4509ce25798ee4f1eb32fcc264919a446c41d935df0b664ff59c9c", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837482, "uuid": "a3d484ea-8f77-42e6-8a4d-dd65342783b1", "comment": "Malware payload (Gozi)", "value": "e11e2f2a25b139f18072cac24eefcc8ce751fc60", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837482, "uuid": "b7b6c434-b25a-45cd-a9a2-7b1f7e2f28cd", "comment": "Malware payload (Gozi)", "value": "7137829d00f54feeaf7f71d0ed76793be280d41c34932b06ff76f5aed0154cb3f334c0feddb67eae68691e0830c17cdb", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837482, "uuid": "de31607a-78be-42ad-9b37-2c53240cc41f", "value": "T10EC4BF51FA4411560E83639BAC1266D2FE3CC401534111A5E99E939C6B87AECC3BFFBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837482, "uuid": "6a2981ca-0639-4899-9667-a1c096741eef", "value": "6144:0kOBFat5z367hG9F4h9vvD/YVfIK8o6d3MD1mmODWATkLo0xfX4j/PAjM/6OpjR1:0kOdwYpbRlPnKU0BqnIYOJdeZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837482, "uuid": "ff6b392a-ee4a-492c-90cc-58b8bc943daa", "value": 555034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837482, "uuid": "aba47149-8376-48cc-a44c-872653ef2ab2", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837482, "uuid": "1af204de-048e-489c-a0af-561d8155ae9d", "value": "9993.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4083eb-0e8e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1630876486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876486, "uuid": "f896acc3-9425-4dd0-82c9-6c27f3fe4a20", "comment": "Malware payload (njrat)", "value": "d1105a626de00b3a3d248febfe9d2eab", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876486, "uuid": "9d5660b5-f391-4ce8-8786-53b8edc5f3e0", "comment": "Malware payload (njrat)", "value": "c61844d30e92c490359ae221d04620767e303247345e12de34f8ae43eb1cf26b", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876486, "uuid": "58fb7fa3-afcf-4726-9f6d-f19774f74ec0", "comment": "Malware payload (njrat)", "value": "f088bdfa3f5d251f325ff4b11b5e680425c25ba2", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876486, "uuid": "fe704838-eabb-4412-8fd0-ee80a1a6d020", "comment": "Malware payload (njrat)", "value": "e2347877c2b6fc55b16dd9db2633e5c051530c043d085a13c90621e988a65409e9e67cc7b13e5e3cf001b941b136092c", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876486, "uuid": "cf996a54-b5b3-4c46-ad94-5d63c80cf99d", "value": "T15631C087794A41B50656E6F0D6DEB263A1434BDA79FE3D730DA3410CD510AA82B432FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876486, "uuid": "1c96655c-ea87-4d50-a142-04c5d0099ad9", "value": "24:1SuifdyYegAY2bWGYtxu5WY5OYWsKYBYjY37Q/GzoXaYgYfY55TB857Pn2bZZRnm:SfRb92gjuv3BDukLZzoXTdwHT07wm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630876486, "uuid": "73e426b0-c13d-4b64-82f9-9b1496f4d262", "value": 1581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630876486, "uuid": "8ea28c0a-c363-4407-acf2-aa4502190c66", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876486, "uuid": "d69211eb-7598-46a1-b0e9-9031c42e9ceb", "value": "Reservation.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0cb8fb8-0e33-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630837678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837678, "uuid": "aa7663b3-fab6-4656-b293-d55674efefc5", "comment": "Malware payload", "value": "5853913addfcbb56ab626e29cfbbe726", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837678, "uuid": "b1c84a3f-51ae-48be-9c19-7b16a4ccb5bd", "comment": "Malware payload", "value": "c675e505c9ce8e0e0de50ad2e23247a8eab196b13b85ef560f67bba5080b8df7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837678, "uuid": "2ae2612f-1ab3-41e8-a05e-aa26055c951c", "comment": "Malware payload", "value": "1413ab08df523a447798ad03405d39cb54e7eaa0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837678, "uuid": "46c4767e-c74e-4a0f-8e91-7a32f76f7f25", "comment": "Malware payload", "value": "e6ffe4d0185e37e55368c2a806a6f13221209f3b80c8f09b64b00e86ae63ff6f53eb612bd3b1425bfd5d007217100606", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837678, "uuid": "00118756-badb-4da3-8a5f-1ebfe082f6ee", "value": "T15DF6330EEE614629F1DA22727875C2B25C3DE4DB0F78116A6F8529F528DD7CCF6B8420", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837678, "uuid": "929b183d-a138-4f2b-a973-24081f1d7316", "value": "7235131d58a25a8130aac9df516d4024", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837678, "uuid": "6df97944-e432-422d-b113-9dfa363713a8", "value": "393216:QXSYmqSjPHAs26yZznmMkJQlFTyo79NH:N5LPgsKnU00o7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837678, "uuid": "36a50045-bb91-4e4a-8331-69c1cf9bd1cf", "value": 16746727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837678, "uuid": "7e9ff307-073d-44b1-905c-548a26a8579d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837678, "uuid": "21527130-c0b4-48b4-a615-e6e982669f08", "value": "SecuriteInfo.com.PyInstaller.29419.16944", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2452f042-0e63-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630857951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630857951, "uuid": "8b486353-a867-417e-a676-2ac4a07523b9", "comment": "Malware payload (RaccoonStealer)", "value": "1727be388fb12087284c331b1c3a3df9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630857951, "uuid": "7480fe4a-ccb0-4d60-8c48-16c757d47acd", "comment": "Malware payload (RaccoonStealer)", "value": "c683bc3da4966110b419ac54d09a54ce798efdb51be398331d9ce011e2636fa9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630857951, "uuid": "6a7c77b7-c943-46f0-b16f-3d3d5cd90b60", "comment": "Malware payload (RaccoonStealer)", "value": "9f5df97d248a486c79068d359abde9c843732394", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630857951, "uuid": "e52fdbc3-7bff-45f9-8f61-cb4d5ad54032", "comment": "Malware payload (RaccoonStealer)", "value": "1bbb00ffe51978df7ec8234726d3b31bc648c3fc03985c2e3cc2cbc502408d6c72d826a47d1715291c0a4fe945a925ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630857951, "uuid": "32dd0fa7-0f2e-4fca-924e-965259e179fb", "value": "T103A41211B2E0D433E1D60A714938D7A46AFFBC726621858F7368E76A3F703D18936366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630857951, "uuid": "bdf8f3dd-f0c1-4a68-bd6a-27c292ff0598", "value": "85e30e3a646861d465db5cbcac3b7178", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630857951, "uuid": "1bf0bcff-925c-4d73-8753-ffa369ff9d6f", "value": "6144:xSHOjA1MOLJ/QycpWJT4b4UvTTDRuaABeFRBkMSlTnsXR7xVyUoRwDau+fO:8HOjAFOeUbrvduaAwFTgTwR1Vzo6Dwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630857951, "uuid": "bbae5ed9-2e96-4681-8ee5-29d6a947b0ed", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630857951, "uuid": "1d677f0a-aa45-4bf3-826e-84661f475557", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630857951, "uuid": "df362c42-3843-485b-a9c5-ac00d01e332d", "value": "1727be388fb12087284c331b1c3a3df9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f10c9696-0e2c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630834672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834672, "uuid": "f675f795-62ea-458d-bb54-0c772b48a457", "comment": "Malware payload", "value": "e12a36785718204cd0da865452c9388c", "object_relation": "md5", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834672, "uuid": "f805f665-3e82-446d-8868-05c8e0272438", "comment": "Malware payload", "value": "c694d39fac6e8b1bc308a1d5dd4456d44ffb8d5d1d7a19008363116acdd07594", "object_relation": "sha256", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834672, "uuid": "d2f21828-d065-4a56-909e-3756fa99efbc", "comment": "Malware payload", "value": "823a807a721ae677fb99b68fcad5969631edc0f4", "object_relation": "sha1", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630834672, "uuid": "b56f8994-58bf-40a7-ab69-7ae97fc83fc0", "comment": "Malware payload", "value": "47e8830ab1ba1ba25ecfea0648d056904c4ca6d55d6002f45ba31013ea1cecc05859a409a17c2f40d810b86ed56a2cfa", "object_relation": "sha3-384", "Tag": [ { "name": "Agent.SNX", "colour": "#E30D32", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834672, "uuid": "35d9f303-3d34-4281-9d28-af3deaac3898", "value": "T1E286181277FA8939F1FB6B70ADB852A54ABFFD615F30C08F1250568D1930AC09A74B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834672, "uuid": "0a388fdf-d301-4037-82d2-5ac6522ba896", "value": "e2d28022f7d79baf4229614e32d8540d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834672, "uuid": "88be3a70-5b31-49e4-a257-62c98b97145d", "value": "98304:KsVXH2gbTfJi2plgyRsVXH2gbTfJi2plgyHsVXH2gbTfJi2plgy:KstH2g/Jl1stH2g/Jl7stH2g/Jl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630834672, "uuid": "5da27167-facc-498b-a02c-340fb2042d17", "value": 8425644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630834672, "uuid": "cf958125-2186-44e8-9087-b5066b89eea6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630834672, "uuid": "96a3def5-81bb-49c7-8bc7-915c05ef3930", "value": "c694d39fac6e8b1bc308a1d5dd4456d44ffb8d5d1d7a19008363116acdd07594", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1604e900-0e34-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630837741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837741, "uuid": "a706ca30-bdb5-41d5-b735-442876d3de72", "comment": "Malware payload", "value": "e4ef1e824eb6142f5c1110a1b7de91a5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837741, "uuid": "ed9d8b20-ce5f-43d4-9230-b813b7930c6b", "comment": "Malware payload", "value": "c71e94b6748c29d2505dadb619437387841f9a6a8324eb6326b3afe03d84a1f3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837741, "uuid": "adcc9237-9817-4a3e-ac4e-6c7d1adc45c2", "comment": "Malware payload", "value": "f1b5c680f8ceedfd651725ceb8edbd3515aaf75f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837741, "uuid": "6520aeff-eaf4-4b06-9cdb-f7907ab786c9", "comment": "Malware payload", "value": "cb50bc06a67c831b9b2734fdd372b0420752518f7c13faee1fc481b8d0b00a1d029f1b80c33032a9ce4c8c49ee4af383", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837741, "uuid": "cb77a803-4737-4950-8552-39f0c2548a03", "value": "T129342318D8187E7447897AEC7D0ADE61BC16B34E862040BFE94D9CD52D6B8C1C60CF9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837741, "uuid": "a884cadd-b8f4-4931-9844-f04018e5aec4", "value": "6144:5q8qho2+irrN8AvtWiO8O882rvBmsnRLgCDeEqbA4XigPW:bqhHLNnvweRZmsnRLgQe7ksiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837741, "uuid": "b4ae9863-2d13-4afa-a035-59409738c85b", "value": 246113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837741, "uuid": "2d490cee-a170-4329-9432-1f4587683003", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837741, "uuid": "7900574d-1ca1-4758-8124-0f4800ed8f71", "value": "9072.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9459e1c-0e0f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630822231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822231, "uuid": "835b1657-fb65-4085-b3ff-188d88d44ef3", "comment": "Malware payload (RaccoonStealer)", "value": "a401f24857df180c045d19d8448de177", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822231, "uuid": "780b5d4f-6b5d-47a2-8abe-9840817d3959", "comment": "Malware payload (RaccoonStealer)", "value": "c7ab3fedd7fe8c76b55e799489445d63d48e11ba05eabc8be5436de4daeedad5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822231, "uuid": "48853d98-5dbb-4443-a8c7-a3289a62cebe", "comment": "Malware payload (RaccoonStealer)", "value": "e550c4715d46b51a67d00ec3935e96603c42a3b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822231, "uuid": "26c9e07d-2850-46dc-9423-21dc70214502", "comment": "Malware payload (RaccoonStealer)", "value": "70f972ab7ee74afaf0d7c55ab80d91a9c3e4b3da91da99302566da4dde5ed037ec1f114c453ffaa549c19159ef9e51d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822231, "uuid": "5642d9fe-58c8-4c6a-9ac6-eda040fa3133", "value": "T155B401297E41E423D696C7700814CBF4DE3DBC66396804573395EB9FBE7128C8A2E396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822231, "uuid": "0c8c2ece-7107-44f1-b97e-4ecca673fa4d", "value": "f530acf7acd4a5c8880ba2a4704d4cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822231, "uuid": "211fdb0c-640f-4319-99c9-94de6b38e9b6", "value": "12288:e6xbz6gxZqHUwK2F0gTfmDn7+LBoswOn5iXSDkjVjnf:p5OJdFD+Dn7oosJn5iimhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630822231, "uuid": "b22b4c69-2fad-4210-aa59-8e0af00347ba", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630822231, "uuid": "3a9e7cc7-94e4-4d73-8966-23a9de831bdd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822231, "uuid": "747ba940-46f3-438c-8522-c15153f830fc", "value": "a401f24857df180c045d19d8448de177.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1899b88d-0e46-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1630845476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845476, "uuid": "8a975456-d064-43b1-84af-7f23b40f5a00", "comment": "Malware payload (SnakeKeylogger)", "value": "b5339e90581410d8a9d9c6442f6cfff6", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845476, "uuid": "73bbaf7e-3542-4b01-af0d-2d7e48d5883e", "comment": "Malware payload (SnakeKeylogger)", "value": "c818c5a4c2c5783353a84add3f07cff39002e657d2da342dc2a59b4c486d7f93", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845476, "uuid": "bf19e6a4-8c5e-4d54-a0c4-7dc132431d56", "comment": "Malware payload (SnakeKeylogger)", "value": "35a767dc1f64ece547df92c5aacb83c516ba6120", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845476, "uuid": "1e928f39-362e-479c-a40f-d69223ee3dd4", "comment": "Malware payload (SnakeKeylogger)", "value": "bf677ae803a8389c619569e7f47a0a697903df23d021d2ddad20fa4328fec35b8de932aa3af431afd44a63979b7c3c30", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845476, "uuid": "016f60d6-d614-4f06-a769-d9241801b695", "value": "T11AC42367B1201AEBB01EF1899297B570CC1F253B6FB9ED8B98B477DF095203117193A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845476, "uuid": "f9d5521e-f187-406c-be3d-1e1a3ec0fda7", "value": "12288:qBnSI+jSr5fFhncxHoitG6aoOj4sAPgGbrI:sS9SNYHy6aoMdYgSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630845476, "uuid": "c95e1e15-8959-4996-a8bf-fba247b49ef2", "value": 576331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630845476, "uuid": "d95287b3-2fa1-4fc1-8721-68544f0b9428", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845476, "uuid": "75042c0d-545f-46ba-a76f-14ddbbf1f0cf", "value": "Transfer.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "140f22d5-0e13-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630823564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823564, "uuid": "9ed6ae0e-8118-42b0-919c-c651fb55cb61", "comment": "Malware payload", "value": "3b71e166590cd12d6254f7f8bb497f5a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823564, "uuid": "df093a56-08e6-4704-9f35-c37d5851ce57", "comment": "Malware payload", "value": "c899fb912095a9245273253677d70d274e02800fe4ecf6f0a01ec13e09b21084", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823564, "uuid": "d3f25564-2a85-47fc-a606-cc33daca750f", "comment": "Malware payload", "value": "66c4b570a249d65d042746fb6f9724db1988ffb8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823564, "uuid": "9d6c976f-206d-402b-a634-6a0b09e56074", "comment": "Malware payload", "value": "ed050ba3d924670779afb48f7a531f03d0944b23c75346b8e9f1c6c734ab163a74c1a4b3de029f0cc4159d5815d94f1a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823564, "uuid": "52330c20-b999-4aca-9bcd-06314ac16184", "value": "T18EA4BF50FB4421960E82535BED5352C2EA3DC11193402164E99F93AC6B479ECD3BFBBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823564, "uuid": "19cfcb5b-54d7-4e9c-bb73-f8e20e6b455b", "value": "6144:0Xt/0DpvW/TJqE2vWclVecVxt2D9tGhIQQeUo+lQuw6ZpqfXpQye6L5whppU4cbg:0Xt8D5WOWclVT92fc+ltwwpqp61pUfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823564, "uuid": "3603f591-30ea-460c-a7bb-90737469f753", "value": 479558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823564, "uuid": "8fec1960-d3d4-43a9-8bbf-f32141800020", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823564, "uuid": "bb81d423-3d4c-4482-9544-ac28eb5738b8", "value": "7770.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf152d9a-0e17-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630825569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630825569, "uuid": "bbdf8e80-bc04-4270-b5a5-5b0ae7395b56", "comment": "Malware payload (RedLineStealer)", "value": "2dbec4adc920592652f560852c828c4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630825569, "uuid": "6f45acba-70eb-4e44-b231-f2c06c9650e3", "comment": "Malware payload (RedLineStealer)", "value": "c8fbfd6e24e2033f4800e6bf1e5afae23ef6ffb7e36f88853052a02162902e95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630825569, "uuid": "eb9cc87e-3096-48d1-b8cb-bfb07a233bbb", "comment": "Malware payload (RedLineStealer)", "value": "2345d49d10c6e401d2c2bdc82a869c3f696ee1a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630825569, "uuid": "cde5904b-19a4-4ca1-b3a9-c73071d1d10a", "comment": "Malware payload (RedLineStealer)", "value": "c32a875323026c8e013d9d3e4d709848a359d6c57a159ca292f51de86af4a682462ef1c912b7433e79c1ebee732d0bef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630825569, "uuid": "4f16f3f6-46c9-4fec-8f2b-56ce6e797956", "value": "T177E5A1925525C46ED4CF2F78EA4A6EFFD0929E20D7404A0F10833C197DFA6295B2F52B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630825569, "uuid": "059f9ec7-64e0-4823-8c83-766b9f1137b3", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630825569, "uuid": "c4ed84cd-2b32-4b5c-9305-9ec192ac6bba", "value": "24576:YKbjD0gURCbBCovpskKxyvlUnX6WK+RZk+P6kS8Oz9T+39AD4Fy+6aq0JlntJ0XE:fb37vKntq26+4Xz9T++c5I0JPHlkkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630825569, "uuid": "b51dc8cc-279c-4e78-a162-dc7b86d66d03", "value": 3134168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630825569, "uuid": "f4e68098-d3a3-42ba-afe4-629a25d282c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630825569, "uuid": "a6f90375-4733-4d9f-95fc-df04af4a20c0", "value": "2dbec4adc920592652f560852c828c4a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c224b88-0e95-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630879520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630879520, "uuid": "ef16eef4-9a34-47e8-801e-f34a8425aa42", "comment": "Malware payload", "value": "62599714704819263c9eb56fb5ee7963", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630879520, "uuid": "3db39cca-f5a3-4874-be64-ec8731e1c7ed", "comment": "Malware payload", "value": "c9f3809e03b16e882045d60098de50368ec918f1ebf62ef620269b847cc05bcf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630879520, "uuid": "f8e3ee79-51ba-440e-9304-88d412ece235", "comment": "Malware payload", "value": "7ec38fcc6807f09b428e6ea1fcd6fb6b5d6e61eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630879520, "uuid": "1fce95d1-a0f8-4e39-866b-92fd54da3af2", "comment": "Malware payload", "value": "4c2d66a9321ee1afb3c9a61d59a3f2321bc0be21b2563de728ca9b2fe8fa2d2bbd1686ef71cfc3e12331cd4fcb172a49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630879520, "uuid": "e254bc6b-952c-4915-8c0b-bb8f42676c5e", "value": "T1C8B4129705D0CEBFD02363F1E2CED612D6A4361042E3627A98F2449A528DCE7F5D49BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630879520, "uuid": "6212e459-355b-434f-b6ca-3bf7ae373fd2", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630879520, "uuid": "4f96f2d2-ac3f-431b-8810-0c34977bdb87", "value": "12288:cXsdUqoYAg+Ts4X+Fyge7BWNAwxTUW6vWmz4:eKUqiX4Q+FZ3pK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630879520, "uuid": "35c920f3-f8af-42ad-9bd5-02774f0cc96b", "value": 525312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630879520, "uuid": "2e7185d5-74e6-458c-80de-56a28693fe54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630879520, "uuid": "17ec8ed0-8261-4fc9-9214-6193bd217dda", "value": "62599714704819263c9eb56fb5ee7963", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd74df8-0e26-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630832061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630832061, "uuid": "21ad061d-4057-4d29-8339-0be203ae7ce0", "comment": "Malware payload (Formbook)", "value": "73256d4ea1d945f21478369fa4e8db84", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630832061, "uuid": "5483a479-f2bc-43a6-9d82-5306a29a891e", "comment": "Malware payload (Formbook)", "value": "ca937cc387173ba7f8455d06b1b6aa245c899be412324af26cf762473944c5e7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630832061, "uuid": "f746334c-5423-406b-b5be-086889e15ad2", "comment": "Malware payload (Formbook)", "value": "8864e9479cc1bc90fdb30d564f1b8d1fce889c11", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630832061, "uuid": "0c25d080-cdc8-4d9a-a905-e47523f7888c", "comment": "Malware payload (Formbook)", "value": "694556bd55c6d359fe047cd511ec3bfb30dba100e25595abca43c6b6b9cc4ef171d457fb5faea0b93289697f72742372", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630832061, "uuid": "47aed16a-6386-4c58-b885-4c162d6cfc8d", "value": "T14EB4231BB699831FC51DFAF839C333A0CA9559EF09A98E24CD1D740AD3F42419E7C651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630832061, "uuid": "3faddd5b-72de-4fa8-9579-c36d5e104221", "value": "12288:aNxy+w1hcDsf93thLGMJy0uVehLo527JX2gfYYrPaBoHAJB5j:u8+ChcDsNthly0uVQG21rPcoHAb5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630832061, "uuid": "2748b8a8-bda4-48c8-a69e-da0f865f9039", "value": 496332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630832061, "uuid": "280efbfe-4508-4c41-b576-6a564e3791d3", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630832061, "uuid": "ea6bf1a7-2fc9-41ac-8702-0f007c1c738f", "value": "revised quotation.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34a3b2f-0e8e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630876686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876686, "uuid": "70a4833f-0dc6-4bc4-9795-6ce9d95ae76b", "comment": "Malware payload", "value": "5f996671a4265bf0aa8862d8d77df5cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876686, "uuid": "2c2cec07-d526-4386-95ef-91dc0da2c7d0", "comment": "Malware payload", "value": "cab75b043623fe8596e53030f9a9539993109a7014e5b3a1d5f723a54000fcbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876686, "uuid": "40be44d9-15ee-4c59-b329-a5166c36658a", "comment": "Malware payload", "value": "636cc3bd72cbc0200ef452d752eeff25740d9905", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876686, "uuid": "52d93f0b-1208-4b6d-852e-3ecf80d86555", "comment": "Malware payload", "value": "c701631aade158b1e575b94c0beb718241869b04dc26e5cf1c4bd815da06c208420ca74951634ca2a259325b4baaec23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876686, "uuid": "6707f0dc-f16c-416f-85ab-26d36d9f2bb8", "value": "T18F0434968CE60B2ACF7F4E399EE0465B51D53C262304998F9FA40F535A1E3CF4E4D1A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876686, "uuid": "23e8af3f-1f07-4a1c-9ec9-51af33579163", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876686, "uuid": "0d272b1e-ed26-43a6-a7dc-78076a16d8ad", "value": "3072:umohC8Vmc/JhyvqUlpfkTGqHKsswTaBBCVMNTbP8+Dyn:g4WJdM+LHhzOBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630876686, "uuid": "ae3f5dc2-17ba-4064-be7b-a5d1cbbaa689", "value": 177664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630876686, "uuid": "fa22d757-afe0-4aff-be36-bfd8ad31fac6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876686, "uuid": "5ed96c87-bc31-43d8-8ac8-24e2d585ea6b", "value": "5f996671a4265bf0aa8862d8d77df5cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf5d1768-0e1d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1630828146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630828146, "uuid": "ed57c489-0dfe-4fc1-aaf5-5d63f839816d", "comment": "Malware payload (AveMariaRAT)", "value": "82d4533084fcd9a38f0b3b3c2653f59f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630828146, "uuid": "4ca5c186-e798-4850-8ba4-794e42223d0d", "comment": "Malware payload (AveMariaRAT)", "value": "cb3dc5671c6bdc82ad160acace44e9a430857407bf16b0e52e61e8adc027af16", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630828146, "uuid": "7b5b61b7-43ff-4f1a-ac33-839f5484fe20", "comment": "Malware payload (AveMariaRAT)", "value": "5369cfe94427c6a9803f6e122add3462ae91d878", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630828146, "uuid": "664e9538-c040-4cc0-8096-771d175027d2", "comment": "Malware payload (AveMariaRAT)", "value": "45800cd034a7af38e0553d3e70f2576b23baa615a261ccad7d6646bbbb3863f56a411e821220aedf25c19758affdf654", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630828146, "uuid": "4f6dcde6-ec62-4c78-a25a-b5bffce0c355", "value": "T114C423A41027826E09540D19B671FA10A93ABF52046D8BF9E93E5FE9203D4DD7BFFD10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630828146, "uuid": "121d1483-901d-4ed5-a307-455566fe7661", "value": "12288:rnQUMnC52c8cWr88QvodBEcCnuK9jI9TGIuXxUAkQlNBIY5ABC:72pcZQYcCRjuaXxjjBBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630828146, "uuid": "69d2125c-2ac0-4f64-aca7-2acdb0b1a7c0", "value": 580356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630828146, "uuid": "c6002192-731d-4219-a439-7571fcd90c98", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630828146, "uuid": "08eab9ee-7d1b-44ea-8cfb-701de0f5742d", "value": "INV.Order0021.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b01d94e1-0e2e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630835422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835422, "uuid": "107bb1b7-320f-45b6-8eb9-862c201dd171", "comment": "Malware payload", "value": "7814d10ccac316da7b3616a9f4334590", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835422, "uuid": "1294cb6a-da78-4568-a038-3a497ed16152", "comment": "Malware payload", "value": "ccfa8b97f8273be6e7fee1beb2330cc45ab8f152c5d1bfa8b04f7b3b0b603433", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835422, "uuid": "45f368e3-9367-441c-a1d0-84b0ba05fb2e", "comment": "Malware payload", "value": "fc22d595a95d1f72772fff26e7b2659a131a491d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835422, "uuid": "d6211ad7-83b5-4e4b-830f-d17405d5a9f4", "comment": "Malware payload", "value": "1598b5f7cf7af29635c94c8632e8c2b57be32f2404c9ffb55015e3370ad33fa2d39958695565af1ace783c84408eb6f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835422, "uuid": "6ae92d57-2c01-4315-86f0-efa68a054c37", "value": "T194D49EC723251711FB3C0A30E69D15E93F214DEE9C59C8E670F8BA1ABDC51212A5BAF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835422, "uuid": "5a36948d-42f7-4888-be2c-a8ce60493b7a", "value": "caa5e6a2892587c2324418efee31c648", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835422, "uuid": "d7c2fdf8-622c-4bb9-afb3-70662fe1e9f5", "value": "12288:r7iuUvUF2JIU2VbPwiBlCOkkAU5WJk8d9:r7iuUvDTiBlCAvUjd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630835422, "uuid": "2475be51-4b2e-461e-9f2b-dc1ecd5b4e84", "value": 611232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630835422, "uuid": "727c87cf-5ecd-4b9c-bab3-dc66402588f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835422, "uuid": "2407a29a-7bb7-46f9-8dd9-1f382638475b", "value": "7814d10ccac316da7b3616a9f4334590", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "373a0645-0dec-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630806873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630806873, "uuid": "5b3de434-c0bf-4536-b079-07e0a09604d3", "comment": "Malware payload (Mirai)", "value": "1361c24b6f1e1b388dc4be0eafaf28e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630806873, "uuid": "13425779-b167-412e-b57c-d12a211a2687", "comment": "Malware payload (Mirai)", "value": "ce6626184e8877eec008c32f9b57dda706dd52a5dab51f24702f95e1438866cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630806873, "uuid": "fe80d13e-7de3-4c2a-98ce-d2c9e74c3d1d", "comment": "Malware payload (Mirai)", "value": "a1782b34d6966879f407bbbc31da06f3eaabdf01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630806873, "uuid": "9defa0ae-429f-436c-8826-134207def42f", "comment": "Malware payload (Mirai)", "value": "dd1fe807c9c055a4a2f2c92b0c5a2db682b04305716130ecb63d1c3f94920a2108ea457d823f4f0ff14bbfcb0aa81587", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630806873, "uuid": "65efbe07-1efa-4919-b4d1-e1213f8f3e65", "value": "T149D23A31BA761D17C0D4A8B962F74B69B2F6065F65E8CB1F3D230E9AFF10944A5032B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630806873, "uuid": "fdbb5ce6-2842-4549-9a28-27306592cb39", "value": "384:Yzo4SryOYTKN3YgRVJDoG8+lrBUmTkd/gSQnWtT5KL6qdyRdn4BFU+pfHL/w:Yzo1okVRzovBd/9QnWtTIoWO+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630806873, "uuid": "78f34452-678b-4436-a7dd-3ae50b21d13f", "value": 31004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630806873, "uuid": "b1affe56-e391-4722-8e64-775cfe041f48", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630806873, "uuid": "3f5b09a6-c4f3-4544-9eb1-36f14bd66907", "value": "1361c24b6f1e1b388dc4be0eafaf28e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d81d876-0e1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630826640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826640, "uuid": "bff5f0ea-5a02-45b3-98e4-99b20f28f700", "comment": "Malware payload", "value": "f160337ee7c848691bed6c72dbae4732", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826640, "uuid": "b8a9bb68-793c-49e5-8f00-aa53702c7da1", "comment": "Malware payload", "value": "ceecb018a175054a37606c812be45eff76b6e1c67095a315887705d614e755ed", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826640, "uuid": "78ce0b7e-ce99-472c-8e48-a01d785ff01d", "comment": "Malware payload", "value": "da68c12cb3b457d410268e4548c90860120c6c6b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826640, "uuid": "d3a307a5-ed26-429b-95e3-5be839af98ff", "comment": "Malware payload", "value": "23a1fce1041a000587a818d2264ef2f7377c816eb31d98aa2c4838b1104644c49533e1892b1e316c04c866bbe5c55cc5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826640, "uuid": "def41cc2-f90d-4a82-beb4-a460054ffea9", "value": "T191842390B2BED75274133F32F56489D30340E967CA82765D6FCF98638AB193EC454B28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826640, "uuid": "6088e107-f642-44fe-94cb-8ec45ada6f3a", "value": "6144:AEIuDGJnQqTnFmuSK4uY8NqYjapmeP5uawwNRh0b3w30VDZ4Wh+cmHX0PZJrCmk0:AE0Qio2YTq6m259waaLw30VRgr0bmmk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826640, "uuid": "5f559cbf-a673-4dff-8765-036fd3f212c0", "value": 382274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826640, "uuid": "90a57d01-6e1e-4faa-a9dd-adce1c021d3e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826640, "uuid": "80819887-5642-401a-b26f-95a211ce1ee6", "value": "6728.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99a3331f-0e0e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630821641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821641, "uuid": "6de306ab-913b-4dc9-9c96-a0f58a6df94d", "comment": "Malware payload (RaccoonStealer)", "value": "2b37ddff0fef97b25be34583989bec4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821641, "uuid": "a3b66a2f-1621-47c0-8b24-316c3d274f21", "comment": "Malware payload (RaccoonStealer)", "value": "cfa6b6f011518b09676b544189184ab180f77cee281ca7728255fe05077bb2c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821641, "uuid": "0ded8f9e-691b-43ae-ab2d-a9f4cd766998", "comment": "Malware payload (RaccoonStealer)", "value": "bff2e41e01b44414fd0617aa4abe3cfabebbab1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821641, "uuid": "21455bc8-409d-460a-be24-771b619e10cb", "comment": "Malware payload (RaccoonStealer)", "value": "8c916c0a1eaf37aea1594e02e157ba07b9ab81459b257479b4e8e91afa0791f09576aa817c06d69c0043eaca733cd210", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821641, "uuid": "c307c8f6-aff3-407c-8e4d-d8baec34613a", "value": "T1CEB4F12A7E90E437E8D5C2B44B66C7A5DE3EBC321A14474B7654FB9B2F301803A2D356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821641, "uuid": "ef61e1ba-1a84-4b8b-84c5-7d3811ba9034", "value": "f530acf7acd4a5c8880ba2a4704d4cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821641, "uuid": "e2bc3eb8-a228-40b6-94d5-219aee739214", "value": "12288:86xbhizG223NVVFHDB8T01gZS8CINgFDkjvhnf:HqGHbTDB8TbZpCkgFmvhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630821641, "uuid": "a6641cd6-e9fb-417b-9c82-bc4e64c1d328", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630821641, "uuid": "b38273ca-b4f3-4189-84c9-3d3fde7f9392", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821641, "uuid": "b2d8feef-de2f-4749-914b-ee3e212e5eb2", "value": "2b37ddff0fef97b25be34583989bec4a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f4218e-0e19-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630826386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826386, "uuid": "d0a6958f-2279-4191-adcb-7941106aa9a0", "comment": "Malware payload", "value": "6001b768d1ef74f172f41406b5855015", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826386, "uuid": "8e9f3da5-9498-4589-ae5f-1ff6c3b435d0", "comment": "Malware payload", "value": "d097a47ac2ecb91556a78ad409ed7447bd71f687589046d23b8ec867e65cc1b2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826386, "uuid": "c2d97f83-c02d-4226-9428-c154d2edc603", "comment": "Malware payload", "value": "7b47b446e18f87313642a99def1e630d9103abbf", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826386, "uuid": "527eab8b-68fa-4466-bf1c-3747ea04d1fc", "comment": "Malware payload", "value": "667b234e73ea555b771ac010ac7af69a7789eb2ca88ab48f02941a743a28914e9ec1fe29285d6e87989bbced3f444470", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826386, "uuid": "5da994f5-6398-4c42-b208-8bb26b15b789", "value": "T165E3121BFE483BA47CE76D197E86F0C924DCC9B494E980E729E72E5D4BB57032290178", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826386, "uuid": "600374a2-ad62-48fc-9882-068f7c61d9bb", "value": "3072:9OAYKKakj/XXo51h75k7iY5dambusaqTA5lKc+k5y3WsoRttEWAsW02:BYKKXj/M1siYcm6sfABU3YtaW0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826386, "uuid": "9c5c3e08-2869-46ca-b2a1-a1226585ce20", "value": 156162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826386, "uuid": "c597c0ff-ded0-423c-ae8d-ec3d16dffa3b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826386, "uuid": "f7a1aacd-69ed-4175-bd04-5ec9f32af021", "value": "2747.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4cfbd38-0e32-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1630837229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837229, "uuid": "947e5f98-39ca-4c1b-a0c5-9034320bd040", "comment": "Malware payload (Gozi)", "value": "ccc24a6b3622c818bc682a9081c96bfd", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837229, "uuid": "f5188a8d-57cd-4b0f-8e30-3471b3ab846f", "comment": "Malware payload (Gozi)", "value": "d22a56d1833c7184f52dce7d00a40b1369eb128c6f48abba3878248e8c0fa97f", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837229, "uuid": "49217a9f-5ff1-4fb4-b876-4f287529fb62", "comment": "Malware payload (Gozi)", "value": "f5895032a9d738e3d6c77e3cd4aca46743f4f581", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837229, "uuid": "17e26ad9-d95a-424e-8d7a-3bc06bf5edf4", "comment": "Malware payload (Gozi)", "value": "332b957782831bb312a8015eb8b93f12603eb268698f5462c4685743ff705dee3f78842aef283ccab587a9d1039a5900", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837229, "uuid": "2f804fa9-8e7b-4271-a2fc-86fd7aef5b3b", "value": "T1E724233FABE11D7F2758280E3DAC82B6F5C092768EC1092249D86175DE4E0D82E67E65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837229, "uuid": "50d0e980-b089-4954-b20b-de40d5e816f7", "value": "6144:e8dHTwJult2hEEjjjRtQBrpIjB81qKcroQ7FcRtTesz:dqulq/sBCj+nbQ7FcRtTe4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837229, "uuid": "b3e5513f-5c20-49e8-94de-239cea003832", "value": 212250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837229, "uuid": "2722fa79-b343-437e-8c2d-7dc577755eb4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837229, "uuid": "60f41660-dc50-42b9-ad58-4c00e4a65daa", "value": "4618.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8190be50-0e13-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630823748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823748, "uuid": "62440288-013d-4fb2-a4d6-c42ceb0a9386", "comment": "Malware payload (RaccoonStealer)", "value": "416cc8541190d052e91cfc7af5c9c70d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823748, "uuid": "019117c8-a80a-4459-9e9f-ded2cf9dac72", "comment": "Malware payload (RaccoonStealer)", "value": "d4fa264846d76739bf55519f7fe15f233fcd233d2b04fbeff11fff0459cec60b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823748, "uuid": "801310c4-fb62-4984-8bf8-2fb3c2b71fe3", "comment": "Malware payload (RaccoonStealer)", "value": "d71b9dd71898dbc9548dbb20629ae301df8d7942", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823748, "uuid": "40746f6d-1201-4ce9-a902-687fb05554e4", "comment": "Malware payload (RaccoonStealer)", "value": "4db7f2c7139411c594d23a2da1c267460b1c8ba1d6cf00870101b6943998af03307f0e5aa6b4520492b4229da4aba9c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823748, "uuid": "48b0d669-2045-40ba-b457-e0870ca59a3d", "value": "T16EB4F11A7E50E863C2E2C2744425CBF4DE6EBC631E60C5577788FAAA3EF02D0552D366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823748, "uuid": "032a55e6-89f6-48d5-81d4-9fa3465ed763", "value": "f530acf7acd4a5c8880ba2a4704d4cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823748, "uuid": "e4434417-1b13-4a95-8e12-b8292766a107", "value": "12288:t6xbvmGNnAwgUuPPSF4njT1voMuzJDkjhnf:M1NAQt4nlQMuzJmhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823748, "uuid": "b13ae310-a01e-449a-b6af-b05ccd0b3a64", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823748, "uuid": "40517f84-a8c5-4772-8a9b-660365eb5437", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823748, "uuid": "dbc6a13f-54a3-469e-8af0-bc294444e3d5", "value": "d4fa264846d76739bf55519f7fe15f233fcd233d2b04f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ccecb0-0e13-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630823777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823777, "uuid": "11be42f0-a81e-4913-9746-1da9df272558", "comment": "Malware payload (Buran)", "value": "db3de2360f715b8ce1bbc40c1a0c9a8f", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823777, "uuid": "419a6205-3d25-4967-9448-b34d44275893", "comment": "Malware payload (Buran)", "value": "d598e19765c92770ae84f72a475de6653fd9e7fa1fad25f11bf54bf2a3bc041f", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823777, "uuid": "5e40ee94-ee36-40b9-a3c6-6fd88ba93e42", "comment": "Malware payload (Buran)", "value": "fba58e4321bcb1cbbb8c0a0b965b57aa96e1c3c4", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823777, "uuid": "547eb043-f0c5-4cde-a6e8-645856befee0", "comment": "Malware payload (Buran)", "value": "2feef42362682e1913493ae1f1e7f9face1a3ae56c2706d3913e5e7795e88caf4cd311c9922281fba333ec3a45fc4889", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823777, "uuid": "5e69e2df-6a28-4165-8b73-1c945fad3b5a", "value": "T12AF4BF50EA4411661EC3539BAD0312D2FA7DC11153412168E99F93AC6B879ECC3BFBBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823777, "uuid": "72bf6cb2-e4f4-4877-9ed7-1850253f2755", "value": "12288:033xz91ljYtNdWcDXiMXt8DjTlVQsW1gXQofhSKqsg:Cxz91WtGWNX2LEMQ63Tg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823777, "uuid": "2007ee67-390f-4772-bf76-e8513744574c", "value": 775062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823777, "uuid": "e7cd6301-abb3-4bf5-9cc1-95d4524011e5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823777, "uuid": "5629cbcf-88a1-4a3c-abcd-cf7f3149bbfb", "value": "1332.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90406c1a-0e92-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630878318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630878318, "uuid": "9f8e6672-f336-4c50-be2a-0a847979ea9f", "comment": "Malware payload (RedLineStealer)", "value": "ab1c6833b90b375f1b485391bf0b8281", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630878318, "uuid": "e21230cf-3ee2-4cf5-9c9b-291b893bd0ef", "comment": "Malware payload (RedLineStealer)", "value": "d61f15c13e28e1500c890617781f34753c3b61c603e5f12f8d90abed2390a910", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630878318, "uuid": "73e79d43-4f47-4bda-b320-2ceb637e086d", "comment": "Malware payload (RedLineStealer)", "value": "e9c6235c58dcf381bb25f1ed63b5b25f58c03da4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630878318, "uuid": "75977d0e-179d-4c80-805a-18a5e6601f42", "comment": "Malware payload (RedLineStealer)", "value": "93a0932d5cfef3418e1b49b6f4c79a7117cb0d33f5d3d6525216e5352b5244aaee3059804b885f7b7d66068e5795f4e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630878318, "uuid": "1c6209b2-b643-48fb-b8ce-3877a16a48d4", "value": "T1CF44C019B3AE5575DEDE43B4E861065063B0F60A70CF671B6A3C3EE72F12389E808257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630878318, "uuid": "fab8cf57-58f5-4aa0-83b4-c7b79aac0bb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630878318, "uuid": "ca74ea22-4657-4449-b6f2-8cd7d9e2a97e", "value": "6144:4HMDmv/S0I4WC8Y2mhknefDpA/STf/87FfLvyxy1+:4HMSnfIXC8Y2M+e7a/5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630878318, "uuid": "9201995e-ea40-4b6f-996e-409a2f96ed8d", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630878318, "uuid": "5ea5a36f-84fc-45ee-bb6e-11ed4d337499", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630878318, "uuid": "d7a5484f-47cf-499a-b8ea-e326bf44fe30", "value": "ab1c6833b90b375f1b485391bf0b8281.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "903f5897-0e19-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630826349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826349, "uuid": "17ffbb47-8147-4c41-8fd9-8182546f3290", "comment": "Malware payload", "value": "5b606a5495a55f2bd8559778a620f21b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826349, "uuid": "1361bb6d-70df-43b2-aed9-75f24c338865", "comment": "Malware payload", "value": "d63cc676c99c46d258a107e4b4a4323130a6db5c68691978024575fb9728b06f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826349, "uuid": "5a171766-20e9-4e7b-b3ef-302b227a9b92", "comment": "Malware payload", "value": "8c2638a9a602a85048bf3d3e8525a9246dc1b666", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826349, "uuid": "eea590ce-6194-4eb8-8915-7e3997dc899e", "comment": "Malware payload", "value": "bad6106ccd30cf17e7cf68854292e3e100653d0155c895de1469c2a713c8f647cb91e68f3f9dc0ffd262ae845ee4724a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826349, "uuid": "af4c09b2-e9b6-4452-b28e-47d93798ec80", "value": "T1CB74AF50EB8820DA0A825397ED5352C1FA7DC11192801168ED9FA37D6B475ECC37BBBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826349, "uuid": "aa9a6646-aba7-4eb4-852f-b51da5f557bf", "value": "6144:0Xt/0D9hCbfYx/xCUylmfrU/fzmqNu7a2EKDkqA0nEUvXQRlZrYD:0Xt8D7iYBsQYykuNk6lPQRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826349, "uuid": "cce0e358-11fe-4549-8b12-3aa5dfd7fad7", "value": 340236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826349, "uuid": "cc21f940-8048-450a-8165-789666c27e5a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826349, "uuid": "830e6fe1-4352-415c-9235-1b00259e0eee", "value": "68.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "556b8f2c-0e19-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630826251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826251, "uuid": "952611a4-7f0a-446a-a842-112d8fa2de11", "comment": "Malware payload (Buran)", "value": "a08aa7c07a7b58f4a86658e4ccd9d2ee", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826251, "uuid": "2817da97-a621-46fc-b3da-6ee81a31b731", "comment": "Malware payload (Buran)", "value": "d65fdca237d3fe382fc07b4e6cd4a44927a8ef879429dcf8c872cc3e18d4fa7b", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826251, "uuid": "6fc3b40d-7014-473f-980e-9a600d6a880d", "comment": "Malware payload (Buran)", "value": "d50e5c22f88d403cb2dd31b54c459cbc594c7f55", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826251, "uuid": "4bda4aad-79da-4d75-a2fd-ff4984660247", "comment": "Malware payload (Buran)", "value": "be7359999c04ec77a095c875c6018420174025e43e9e337e18717f31159f4118619c5a2716c66c1ec6dbd05b94717fc4", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826251, "uuid": "916888cc-5d26-4697-b8d4-88a538766ce6", "value": "T1242412F18BB358BBF893794B1151300FB6976F4D3031EB3509E511A2BDF0606AAD606B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826251, "uuid": "eb4d1e53-0a6d-4f61-808a-eafa11c890ff", "value": "6144:Yrnd5fFYUZs/H031Oted7vp78JOaD65+ZqzgJj:YtYUUHjeFvpAJOaG4Zeg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826251, "uuid": "a178f6cf-fae8-45d6-b5f1-0b9147e02a52", "value": 217122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826251, "uuid": "9046ee65-50bd-4c28-9e0a-51259e5bb471", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826251, "uuid": "3752f567-1679-486f-a2e8-fd7c5c41f633", "value": "7074.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2302b398-0df4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630810275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810275, "uuid": "74457a88-16f6-4996-b3d3-f32c7a6cf453", "comment": "Malware payload (Mirai)", "value": "ec32ba06a9ae5f5b59b4e08632cb29e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810275, "uuid": "6e2f3eba-7924-414a-8d73-e754f9c411c2", "comment": "Malware payload (Mirai)", "value": "d68001e4526da19fa7498a96eea17a964ff8ba42478210fe2dd00067d490a21f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810275, "uuid": "6625abe3-e38e-426e-9f74-6735adb2c1d2", "comment": "Malware payload (Mirai)", "value": "27e2a927f703b8ec53f7a1931bd7c87bc5bd66a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810275, "uuid": "061c7bbf-32e0-4888-95eb-eef0e84a6b78", "comment": "Malware payload (Mirai)", "value": "26507c742164bb13846518956bb6509d3714fd18702d61b6f73bcd7c41e2cb99451c846d874e0d3fc9dfa622be4fdb78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810275, "uuid": "a7b33d9c-9558-4a97-b89c-e35bb6e968e0", "value": "T110D3B63B67170E23C0CA50B001E35632ADA5DF9B34B952D7AAD07D9C6F36A843856BDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810275, "uuid": "8cf1b411-bb7b-48f8-a33d-1611f32145a2", "value": "3072:OW/8wocqsTRZpNPA2O+bkzmmboMuqB1nKYNb:OPpYnplhAzmmboMuqB1nKYNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630810275, "uuid": "77b5c5f1-6af8-4814-b2ef-f41708df358f", "value": 139191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630810275, "uuid": "6efcbfce-5ac8-432c-b584-28b6f5e8ba49", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810275, "uuid": "ea666e13-e35b-4cf9-8e5e-1179ea1a577f", "value": "ec32ba06a9ae5f5b59b4e08632cb29e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8279f0c-0e19-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630826443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826443, "uuid": "9b3a06c0-43a3-4594-aa48-32294f8194ee", "comment": "Malware payload", "value": "82a3949b2a2e90499027ae464ec9bf2c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826443, "uuid": "4c1f877a-daf0-4b2e-b791-1248c87671bf", "comment": "Malware payload", "value": "d7af56952d412edd617965836fa250aae39567b4b08ec137658218fd68fc844c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826443, "uuid": "7ed50e71-8ca8-4f5a-8b69-716bb67051fb", "comment": "Malware payload", "value": "7548fe92c5103bc4f39b5a7ae78d85fc1f57c5b2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826443, "uuid": "8f2efb2f-aae8-4eac-ab4b-8b7f4c6fc790", "comment": "Malware payload", "value": "0855b3add7eee85f7ecf8a4ee2422af4807184970cdb6a215f0bf36203cf1de033a96fb0fd963bdcaaab099738bc3b36", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826443, "uuid": "5865b0d3-093c-41b1-b31d-d29eab621598", "value": "T114B31311E6DE97828E5CDB49C52B484F31B463B91EC627CB4308B7B8E6C651FD221F26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826443, "uuid": "60bb8a59-b01f-4ec2-b08c-1ea66322e23e", "value": "1536:gbCJajBiLsa0a5K2F2tK88bZPsieDZJzJnvz2JiRdT6BbOl4LX+04Xo+C:gOJajBfHK88b8nKBbG8+VXo+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826443, "uuid": "5002110a-2739-49b7-9ab8-f5a47eaed765", "value": 112975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826443, "uuid": "ef77603d-912a-4497-a1e0-35bd8ccefcd8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826443, "uuid": "a07c2f7d-e94f-468a-85a5-2401085183ed", "value": "3659.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d55d220-0e10-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630822264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822264, "uuid": "700104da-9a87-4f7f-9f68-a5160719ef46", "comment": "Malware payload (Formbook)", "value": "b5f32379fc5022ad5e9ce09d0c5d1d75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822264, "uuid": "bb23188b-bf2c-42c4-ad20-eca6a37d5b7f", "comment": "Malware payload (Formbook)", "value": "d7d35002f25eb13d14a68f466db5679be33e14645a4079d242ac488c35531988", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822264, "uuid": "b55a5716-fb6f-4b3b-b2fe-6fb5c66cc0bb", "comment": "Malware payload (Formbook)", "value": "0d22be7f0eaa0ea72df349f654c100b39adbb4df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822264, "uuid": "5d43e040-993e-4257-a859-89730346d804", "comment": "Malware payload (Formbook)", "value": "add687ca7386826880b92f4d15defbaa734fdc261b791644ebaa92c0c1f5e3b639722514801563c547bf51ca4c02877e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822264, "uuid": "670f03c5-8ceb-433a-aebd-79ccb2760c45", "value": "T11DF40C7F19BDA127A175C2E58BE34423F0018BAF31216965B6D743164327A7AB4F332E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822264, "uuid": "c645ae69-a5e0-4a90-b6c3-fe80b856a5a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822264, "uuid": "10bce66d-83a4-46fa-93e5-3fee62a52abe", "value": "12288:nxq16PK3CThGOu4maPyvW0su/tM/ex1rbntf:k6i3XORqOQ/tKexJtf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630822264, "uuid": "9f6eb07c-c974-4100-8a32-b771a42254c6", "value": 774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630822264, "uuid": "660726c1-354a-4e5e-89a6-2d43ec4082d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822264, "uuid": "2fa44647-fd4c-411b-89de-28f907199562", "value": "Swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9af61e11-0e07-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Adware.FileTour)", "timestamp": 1630818636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630818636, "uuid": "7035d26d-bd6b-4fea-98db-fa84a5198e7a", "comment": "Malware payload (Adware.FileTour)", "value": "ae93af91e8e57397bce40bc97ba15e46", "object_relation": "md5", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630818636, "uuid": "348bec17-552e-4d86-80e8-e15c6f50dc59", "comment": "Malware payload (Adware.FileTour)", "value": "da6332feebc2a530509de0c661231bbd427327c31d6607a6a9286db710b68795", "object_relation": "sha256", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630818636, "uuid": "d3549346-b0a3-48cf-a1e6-2efb2fd7ac83", "comment": "Malware payload (Adware.FileTour)", "value": "50d2cfe3efe4e74fb02c73e95af4d066d396fd6c", "object_relation": "sha1", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630818636, "uuid": "f500d4b0-8530-464a-898f-a243b1e79861", "comment": "Malware payload (Adware.FileTour)", "value": "a8ac99703b9966ef5c3f0fabbcd389c11188e688f60f2d2f13c48f5decf0b19824276740f050537e756e8ada97f4111b", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630818636, "uuid": "1ae945c2-399a-42ec-b139-ca76fec3da44", "value": "T135B52335F081493BE0221671484BD3BA753ABA445F7CA4CFF3EA5D5C9C1B24929F86CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630818636, "uuid": "b4c95257-1a32-4a4a-a787-dd8cc721fb75", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630818636, "uuid": "e3dacee4-3b68-4357-8fd0-fa913fda21bf", "value": "49152:pAI+FnLWaYzjpemXXvzln6QnL6KV5NFf8XslqbdZoHb1uZPKYuXPnXr2KCs:pAI+FLWaYjpemX/B6QLv3NFkXkHb0ZCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630818636, "uuid": "0c58fe5b-3a48-4357-99dc-e8c97610e13a", "value": 2361099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630818636, "uuid": "02c55b5b-a71a-43cb-aca1-7e3697b17288", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630818636, "uuid": "a6a4aed5-c06f-4713-a905-5f548e1e9982", "value": "da6332feebc2a530509de0c661231bbd427327c31d660.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f650a68f-0e1d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630828239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630828239, "uuid": "abbccbc0-fc3c-420c-96f9-362762a390e3", "comment": "Malware payload (RaccoonStealer)", "value": "ad3335a123f2ad4283e96d367b61ec85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630828239, "uuid": "a2da6c57-f2e2-4a08-94eb-ea87add467e8", "comment": "Malware payload (RaccoonStealer)", "value": "dad5918b56e3943854b1386c7b9050b00f5b68b0f26bd44eb3639237145dc196", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630828239, "uuid": "4242d452-f702-4fec-b2af-e10706464d79", "comment": "Malware payload (RaccoonStealer)", "value": "087751946f4f1292b1221958b7626d1efe048312", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630828239, "uuid": "a35c7147-4892-4cb6-986f-63f6a4a640e2", "comment": "Malware payload (RaccoonStealer)", "value": "695cacddefc6da3cad4fb0592d275cf4fd44a3f71720ea80bfb916826620eb4bb272bcfbe778e0e2e6d03e5f7964fcf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630828239, "uuid": "72eedc0a-29da-4023-8e7e-5577f5a65006", "value": "T1342633053255C0FBFA030132A84DDFFEB5FDCBE807106E9353A9DA461E35A96B60B856", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630828239, "uuid": "c2e36a7a-ab50-4aec-8c06-cbff5e600170", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630828239, "uuid": "94b3f623-ae56-4fbf-98a3-4cda0192db04", "value": "98304:xCCvLUBsgg6+Nf/mWmCI9kBqwTNOu8XRAB3jlFblKNlBWzFiSt7/C/:xzLUCgh+oz9kBZJyABTlalI5iSx6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630828239, "uuid": "28d35c9c-18e9-4baa-9219-05ffe2a488fd", "value": 4537104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630828239, "uuid": "c36ef464-1dae-4d6d-add2-32ceb22288c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630828239, "uuid": "f7cecfdb-62f3-459c-af05-f42d2a44273f", "value": "AD3335A123F2AD4283E96D367B61EC85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a91f73a-0e32-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630836863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836863, "uuid": "bba04538-078d-4f2f-b22f-9cb478e701fa", "comment": "Malware payload (AgentTesla)", "value": "c5a9432e9c1e9c2b5915544969e63474", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836863, "uuid": "552284a5-e5f0-4b7a-9649-c526c162a071", "comment": "Malware payload (AgentTesla)", "value": "dcd5a9f19feb64fa4b49ad1a4fda6e907e27661e7689971d7a050bdf7537c2c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836863, "uuid": "03def2c6-8893-4f94-a810-61bdccdae68f", "comment": "Malware payload (AgentTesla)", "value": "958d8a0b39f192eb79d8200e5d9e7110a6bfdaac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836863, "uuid": "32518057-912d-4d12-b974-17a817f2dbb9", "comment": "Malware payload (AgentTesla)", "value": "9e9916d0f6c613d7961e8e419f19a2efab3f3763ec8e05dbd0ab821a041f9ee83112b3c6310c3fe813d29694f12e7cb9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836863, "uuid": "b36ec02f-83e5-4155-9885-69ab7d39cb56", "value": "T1C3C42349AFBDC823816C58307ED7AE89A0B98EE4C1FE132257370ED2A41D7E8C45C675", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836863, "uuid": "3332d4d5-7a6b-4436-b28c-02ac89e7c20e", "value": "12288:npuNg3twRtBD1t/NcvWPWNscD8PT1zCbRZG:nfdwBJTcuPWNsw8PT1zC1ZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630836863, "uuid": "3023822b-3448-46c7-8bba-69aa3d75acdb", "value": 546212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630836863, "uuid": "a6378108-eef5-4cb1-9fe5-7ba0956bb5ba", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836863, "uuid": "a5abbcbc-ff06-403f-8afa-7fcfd25fb8cc", "value": "invoice & packing list.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1b8322-0e46-11ec-8fa1-42010a9c0011", "comment": "Malware payload (XpertRAT)", "timestamp": 1630845673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845673, "uuid": "e4f878f4-2ec2-49ff-a4e9-56d07c6f1bc4", "comment": "Malware payload (XpertRAT)", "value": "6ddea92be72b5543d108ec83b588297d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845673, "uuid": "23088d17-9882-4fc7-82b6-6e925c4b16e3", "comment": "Malware payload (XpertRAT)", "value": "ddde7cd1d82b5dee479ac17413690cedd04ad04ee14ae271d590da80e5a2a8bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845673, "uuid": "9beb5097-10d0-41b5-9f44-72a78061ed1a", "comment": "Malware payload (XpertRAT)", "value": "c13a41eb03b9e26fec3e6d6f6c1e273111729c03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845673, "uuid": "4dc1a32f-9c7e-4d81-9376-a4ebfc7cceb5", "comment": "Malware payload (XpertRAT)", "value": "333ff8d8f0cb7b0851fdf13098d75c01b9e7ffb3242c44c7694a23ed4c403141e98b8509678c3b6a644b4d888702fd3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845673, "uuid": "74af22bf-3dd8-4263-82ab-b86af289b4e4", "value": "T10EE4AF35E3A08C72D132273CCC5BA67C583AFD41297C9A4AA7ECAD1CAF2D1413527297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845673, "uuid": "fa4eaf78-0d90-40bd-b1e8-03623aeafc86", "value": "9a95e2e380b061bc9cadf7c92259a464", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845673, "uuid": "f8498d42-3b20-4aaa-add8-c7d54832e181", "value": "12288:rFmx4sA2SFJysWmh2TUjc58OJek3EGAxMRtx9Wn0PG9pCPC:I6kSFJGmhIUI5zn3EGAORr9WnOG9UK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630845673, "uuid": "3c712677-c851-4b4a-bd53-704472f37349", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630845673, "uuid": "66d399f1-b089-4003-bd33-34f1e96aa387", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845673, "uuid": "5e89453f-cc56-4d7f-a544-d35c115609d0", "value": "DDDE7CD1D82B5DEE479AC17413690CEDD04AD04EE14AE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e345fc3-0e25-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630831312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831312, "uuid": "8f562c2f-04e6-4c79-9182-b71f606aa9d0", "comment": "Malware payload (Formbook)", "value": "fd6c9bda00db8ea64e3c0cf6bf41ba15", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831312, "uuid": "8a961df5-c4ad-454c-9009-5ae818db8e2c", "comment": "Malware payload (Formbook)", "value": "ded782759f66e94701fbc220863fa9a67a6287b829bd219fbaf0154be8b52b57", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831312, "uuid": "d1857525-9a2d-4996-a197-af9dea58a4ed", "comment": "Malware payload (Formbook)", "value": "2cf9613db68dbe23721120c30a8194359f95d575", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831312, "uuid": "c898a5a5-99aa-4951-ace9-b3764ea46d84", "comment": "Malware payload (Formbook)", "value": "2995e7c78103b9fbecfff36fe6084488668bfcd4a77e3f168b12b5567ee9ffc66d9cd12413c412b576f0ed6f4fe5fe15", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630831312, "uuid": "12149936-373d-4a93-99b7-697c3bbe1376", "value": "T1B2F41C3E18FE2327D176C6F5CBE18823F6D498AF3132A96467D743664316A4674C322E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630831312, "uuid": "1d86b150-b41d-4d46-8c49-cc0f0b97aac2", "value": "6144:1gBD8x9ojLRR21FJLgGEqv8gEzLH2HAk+rP8qgHtt9aaf/Nmd1d8i0DGi44dm3rq:1gBD8g8v8gE/pk+Ab30MNmdg3ldO1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630831312, "uuid": "5a60af8b-cb1e-48e1-b4cc-d067931c55ed", "value": 778240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630831312, "uuid": "8c56ba18-d613-4cf8-bd03-7576ae191ff3", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630831312, "uuid": "a64ad699-3e3e-426f-9799-8c77893c7e4c", "value": "Proforma Invoice.pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e70061-0e32-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630837249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837249, "uuid": "942ed580-5a69-473f-880b-6aff425147b8", "comment": "Malware payload (RaccoonStealer)", "value": "cb2be9b44b5ccb320e6e6eabfbe3123f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837249, "uuid": "ee6feea1-4c0a-4af3-9ba8-c3e338647a15", "comment": "Malware payload (RaccoonStealer)", "value": "deddab103a2aaae2ce26b6b3b1b1d263ac4c272584ec1d7d5ff8a96bcbaebd4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837249, "uuid": "ca993f07-d403-4fbf-8248-8e73642f567e", "comment": "Malware payload (RaccoonStealer)", "value": "85a92fb7d922a4d2c51bac03fedc2868599f23b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837249, "uuid": "ca7ca21b-18a9-48c9-85d6-2b80ec935bc3", "comment": "Malware payload (RaccoonStealer)", "value": "5838b989da2786c3db8c08bcf53b90cf7774b93a9a1456a4c5c5c0c98c61689c3bec2e27869776c4581043e0bb023e89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837249, "uuid": "439a5af2-c662-475c-9dc2-60f741882655", "value": "T1F7B4F11E6E91E463C6F8C2344435E7B4DE3DBCA61D24968B7745FB9B2E302802A2D353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837249, "uuid": "fa2f6999-1750-47b8-a323-f4079919fc42", "value": "f530acf7acd4a5c8880ba2a4704d4cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837249, "uuid": "2eb23efe-0802-4191-9374-374a2d6f1a81", "value": "12288:S6xb7yfqVqrv+iVxg0P44EcsK6ADkjOUuB0f:F7yfqVcrZPpscmHS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837249, "uuid": "a78be737-c710-475a-b12c-e9050f946a8d", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837249, "uuid": "9e6d1c25-d223-4c9f-9adb-17d8be407521", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837249, "uuid": "e5f57cf9-747b-413a-ac91-7407637c7bdb", "value": "deddab103a2aaae2ce26b6b3b1b1d263ac4c272584ec1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c157aef2-0e19-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630826432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826432, "uuid": "42a7497e-6483-4bfc-9e01-5c8e7343c52a", "comment": "Malware payload (Buran)", "value": "2c7bb78b72cbea024bad3aedd0e97a67", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826432, "uuid": "fa008ca7-4631-465b-8ebc-d8607e5ebcec", "comment": "Malware payload (Buran)", "value": "df2f876a676d88f5faf50a772d06c52a1aa5d4d21a4a611b0da3ed3a499002d9", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826432, "uuid": "b0d6c579-1187-477c-ad15-9a16bbb3f0e9", "comment": "Malware payload (Buran)", "value": "42823c9856560fc5b54d05021305ad8d451e7811", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826432, "uuid": "4eb1be39-43c2-428c-b6b7-8743a088e7c1", "comment": "Malware payload (Buran)", "value": "fb711fa861ddb769be6b8256a0c72d595813e455bac8b7a58f8abd65aff69fc61e16e7574c7dc95c48d170f571fec46f", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826432, "uuid": "8e97ef1b-5ddb-4467-81f4-cc84849c0358", "value": "T17674B050FB4821991E83239BED5352C1F97DD00152801168ED9FA3AD6B479ECC3BAB7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826432, "uuid": "cdd7253c-e01b-4249-843d-5c2e36d3c51c", "value": "6144:0Xt/0D6KS5qvVwRw9VQQzi9YgwggsKrY0WboXsQMCrgfjbUN:0Xt8DrQBzygGMBX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826432, "uuid": "39839080-3d6e-4e60-a3aa-0575ef10ec57", "value": 350654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826432, "uuid": "e9e3b398-4c12-4ffc-9d11-3e1ee1564eda", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826432, "uuid": "965ff07c-6c2b-4354-a7d7-3dfbe9dead48", "value": "1840.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5927d2ec-0e1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630826686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826686, "uuid": "357d00cd-7495-4e1f-9a4f-f995324b72b6", "comment": "Malware payload", "value": "54c8cb0eed1784dcc259634b1fc48a74", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826686, "uuid": "b92f3f87-e218-42d2-af9c-c919d994430c", "comment": "Malware payload", "value": "df2fb1b8324a84f1eb684bde5a30d809e502fd4f812a70ad532dff25eceece35", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826686, "uuid": "f9bd1c30-8922-47bd-85e4-6c670f061339", "comment": "Malware payload", "value": "078b49d402fc3d0b1b9a274ac0a57c5b2ef829b2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826686, "uuid": "38cc65f1-6fe6-47e8-a86e-3c127f227e1a", "comment": "Malware payload", "value": "41e7cb62a97817eace8108a8d85a0383484c5e35f00631a73fe94afeaaf65e8f7a9c0cb925d2d74b22fce012611e6d98", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826686, "uuid": "bde4311d-ad3d-464b-86b4-9cb91ded78c9", "value": "T1FC64BF50EB84309A0A83639BED5352C1FA3DD04192401169DD9FE3AC6B479A8D37EB7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826686, "uuid": "37bc902a-5aa0-4d8f-b1e0-b160dbd3adc9", "value": "6144:0Xt/0DgmGot0v4NpygorCf7fcQP89QB/U26oZvEEZdIsmRMwv:0Xt8DgpAiijfY9C/lZtZdIMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826686, "uuid": "522d5565-2aba-4dfc-ac21-af037bcaab51", "value": 335901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826686, "uuid": "51faf78a-c6cd-4761-b13b-04f904f45ddf", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826686, "uuid": "d55f4c97-8443-4197-af0f-297cecc233e6", "value": "4805.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e774007a-0e0e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1630821771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821771, "uuid": "3fac32a6-6f5b-46ca-aad2-770d836afaa0", "comment": "Malware payload (CoinMiner.XMRig)", "value": "0fa802e8a7eafd690f71460f97be0140", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821771, "uuid": "5c890ae9-6392-4c44-bcae-d3608ecf82ef", "comment": "Malware payload (CoinMiner.XMRig)", "value": "df787884cb15802a125a3aab9b0e15c55952db0b8825814cc8e7ddde24249ad1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821771, "uuid": "b2a0897f-e9d6-4e45-a34f-6571ec50d415", "comment": "Malware payload (CoinMiner.XMRig)", "value": "f950f7da6740f8e38d6c767949ebb7648bdcef9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821771, "uuid": "d651d8ca-a76e-4654-b1a6-f4e44ff43325", "comment": "Malware payload (CoinMiner.XMRig)", "value": "b1c7d2a77c36e0f10927d0a2a82523b597e3f1f995625cf510298f02751a6aa413dea813cb12aecd56bb54ef5208ff0e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821771, "uuid": "969eb56d-de4d-495e-bc8a-102f9520fc91", "value": "T137C4AE2638C2C432CA3734710969E6759ABFB4301D329AAF63D8163E5F345A1AF1953F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821771, "uuid": "e1586fdb-0a3c-4719-8206-da47b4195e6c", "value": "bafb5d14bcfe53a31e955e0f42b2f373", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821771, "uuid": "079a9eda-989d-48e3-b139-b12f76257694", "value": "12288:wAc9dbM4F1Gtsra204wDOs8t1VMa7V8ceU6/IEzkNwRyZ8FuTyCtN8wtIy:BKdbM4F1GtseJTKGceU6/I/wRj9gL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630821771, "uuid": "0793d1fc-97c7-4dfd-bec1-20bd7f3b09f2", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630821771, "uuid": "76fddcce-866e-4b21-88ac-27535aef2d4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821771, "uuid": "7b0250ac-0937-4b44-83b5-1a3d4b874a6a", "value": "0fa802e8a7eafd690f71460f97be0140", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "938361f1-0e0d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630821201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821201, "uuid": "b14ffae2-fd3d-4d19-9ab2-e70372a65dc1", "comment": "Malware payload (AgentTesla)", "value": "204f2d0f5e288d68cf109a325bdf7417", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821201, "uuid": "4acd9a89-6dbb-4c81-b268-b5e6d4efe837", "comment": "Malware payload (AgentTesla)", "value": "e008698ccfbe79d5d4924e8fb3141afc2ab7acbf9e7d2d0f58ddc3cb972a5f9e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821201, "uuid": "e72c1e28-3246-45f3-ae65-abc6c9285742", "comment": "Malware payload (AgentTesla)", "value": "922e674376293f8bf654b7040cebe946cbcb8d80", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821201, "uuid": "42780168-b66b-4781-9c3d-7f65b7b24cd8", "comment": "Malware payload (AgentTesla)", "value": "9cc2598ecef157c658463a2ec81560963cfc31c97b396bf546269c50d338d65e817263c7fd92d54b029e73872a29c2f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821201, "uuid": "3b7b624d-79bd-4de6-a594-d8ed1b263d24", "value": "T1AFB423F16081553E92CDEAF981FC3A6A79563D63F778CE0FE5C4626460E6434A01EE34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821201, "uuid": "d8e1660e-9a0b-4112-9c9e-acbe65e39e40", "value": "12288:yqLS7VxnS74E7rOFQS/GbHRBGb3h2/oHAbW4Xb24irh0ukkXK9:hS5xC1SFj/Ui3h2/ogfr24jrIK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630821201, "uuid": "742333e0-1dfd-46af-9eb3-7e0a42111623", "value": 501504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630821201, "uuid": "37c44df2-c71f-414c-bc21-a4e6bd238b8b", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821201, "uuid": "69a272fe-45c2-4092-9e32-09a2e24d2a0a", "value": "Request for quote.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ab1adf-0e33-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630837336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837336, "uuid": "11af7535-834e-4ffe-9d3a-96fb50870913", "comment": "Malware payload", "value": "21064644ed167754cf3b0c853c056f54", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837336, "uuid": "4c540a64-485e-4ea1-909f-c3ea34eb216b", "comment": "Malware payload", "value": "e09e83a8912f3d3924932fce09745eb5b03d551d47fee5ed10b9563ca3b875f2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837336, "uuid": "3d9d8a28-e571-4e44-939d-bc279f9b2ee7", "comment": "Malware payload", "value": "9e3b7eeb51cdb85440fcfbca61dd2a72e6c92feb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837336, "uuid": "6bbb09d4-556a-4499-a9b4-b63d0194c152", "comment": "Malware payload", "value": "ea55b4d6c4d16c3d0386fbf2b68bbfbd55221e2f11a88e7bdcb14e07e35a400ae6bdd6639fe18a55a39f36847fc9eac5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837336, "uuid": "a480e504-cbd8-4282-bd49-cd1b84ac418f", "value": "T1BAD4C050FA4011661EC3139B9C5262D2FE3DD111534021A8E99E93AC6B476ECD3BFBBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837336, "uuid": "33512575-af74-4c2e-a6ab-2ca71f3871d1", "value": "12288:/ssMJBCJ4qTkOZvPN6PnkfgNLazn9Av4Fbrs:/H8RqTkOZyFNon9Av4Jrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837336, "uuid": "0c0b163e-cbe2-48ea-9ef2-2c6b617b9a4a", "value": 617970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837336, "uuid": "2cf082d6-5d9c-4474-bdf0-5273e4678306", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837336, "uuid": "64e46ad6-566c-4c9f-b303-f2d1540e37dc", "value": "7776.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c928f22-0dec-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630806882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630806882, "uuid": "9988d5a2-8df5-4bab-8373-fe99326104f1", "comment": "Malware payload (Mirai)", "value": "5985c21c279bf242cc7f45a7a2b8f760", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630806882, "uuid": "55863221-997f-4367-a8b1-36b18cc92c7e", "comment": "Malware payload (Mirai)", "value": "e1259b2c6f15f26b4f4c93d73c59d713c858fac64f1e898ed713e4f232285847", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630806882, "uuid": "f328f63e-5485-4f00-a8bb-28a51efd234b", "comment": "Malware payload (Mirai)", "value": "a995bdf94e1354277a4cc80bf84f923f65a66400", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630806882, "uuid": "fde7a395-51ea-4d36-b1d4-1c8d6de42ce0", "comment": "Malware payload (Mirai)", "value": "ec5a81e19ef3d0ffe37e48b7c59f3a42fa39a43d81ac7b51f6bfbcee21b58dfd256283bb783b38b7d25915ca023c61da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630806882, "uuid": "e375112e-e99b-4cd5-b2b3-59c902e580bf", "value": "T18D03E796B9C18F12C5D5127AFE1E118E3313176CE3EFB3129E116F20778696B0A3B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630806882, "uuid": "e1b3dffc-edc1-4add-91cf-9c61570e8ada", "value": "768:FFnG67+QvZXD9Q3cCWf7iWLGLeolp7NUctfump7E1IFt73iQi+hafLMJ1Vwv:FFnG6vvp9QSfj6CwN5PiIvriQimafLM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630806882, "uuid": "feaeaccf-807c-454c-aea7-1b694d9c08c5", "value": 39224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630806882, "uuid": "0788a7af-78f3-4ad3-b16f-ebb3fda87e3f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630806882, "uuid": "11abe7fb-adb6-4a31-b94f-b09f26484e79", "value": "5985c21c279bf242cc7f45a7a2b8f760", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "246854f9-0e10-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630822303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822303, "uuid": "d737512b-5f08-4413-a8aa-459fc21acbb2", "comment": "Malware payload (RedLineStealer)", "value": "5360f34b6b1a35ad12917deb13101bc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822303, "uuid": "36809c5a-a2ab-4b90-baa6-07221bf9ea84", "comment": "Malware payload (RedLineStealer)", "value": "e186cdd4a3a8a2985bdf5a57f1a90e23672a0f2dc196a2f51aaf134ab0e4c895", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822303, "uuid": "2725f228-9fa0-4e3a-a1f1-2038034fd45c", "comment": "Malware payload (RedLineStealer)", "value": "5353a7d90ad5b80264e9c225e8857cb77f911f1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822303, "uuid": "c7e8cec3-32b2-4c5a-9b32-8d75e6facbad", "comment": "Malware payload (RedLineStealer)", "value": "1374334003e5de4a744a0226c9c94ed74d9788fefe033a840500e1203d019afc2c8936739aba56e261187e709808425a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822303, "uuid": "2106dcb8-add5-4bc8-b248-40455b3544b0", "value": "T18F64BF30B6E0C035F5FB51F449BA83B9AA39BA715B2490CF63D456EA56346E4DC3034B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822303, "uuid": "9d5a306b-f4df-48c5-8466-52811c6769a6", "value": "400fbb4d0298c92dcf0f4177f613bae0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822303, "uuid": "c28ea1a6-a5f8-46b5-8a88-ac2ba3e306e8", "value": "6144:Eu1qFZ/hOvYHmOKzgGaJ/FKqovUhaeF3rfzRau:iD/hOvYH0zgGaCqovUhaoTAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630822303, "uuid": "14a8b7fc-dc77-488e-99d3-f961a9f4b50c", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630822303, "uuid": "cb1a8514-65f5-46af-88be-880710373827", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822303, "uuid": "5330f92a-90ca-4330-a25c-7355e0ba059d", "value": "5360f34b6b1a35ad12917deb13101bc9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be074994-0e24-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1630831151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831151, "uuid": "15b31668-902f-4a7b-b1e9-d38c8c30fa33", "comment": "Malware payload (SnakeKeylogger)", "value": "d8c9ea0d886f460eec720f898cef98c2", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831151, "uuid": "2b4ad2ff-14ab-4e4e-89f6-56d9eaaf6999", "comment": "Malware payload (SnakeKeylogger)", "value": "e321f318073d625294ef96ceb4c6324edcad188045b95098a938a6bd7d40822a", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831151, "uuid": "63f1f1b4-e2a6-4c48-bb6d-38a9b49ed70a", "comment": "Malware payload (SnakeKeylogger)", "value": "7267dc06c9e58f56b1e150e1c26a60e6b4323efd", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831151, "uuid": "570c8c5f-1593-4949-b9e0-c0c4893822f4", "comment": "Malware payload (SnakeKeylogger)", "value": "2b753db4c1b006229aae296fe2e7b1649c977355159f957291f6be3c4b7dd68853fb384d26c373cea9585779b4b2bacb", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630831151, "uuid": "dc769e69-f835-4530-91e5-67b3829f0a8a", "value": "T1E45533A94140A515CDA0C1FA6604A9FA922E6E9142EFE4EB271F6B4DC9357C90C7B3F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630831151, "uuid": "d547a468-efd0-4773-bdff-0a64cd5efe3b", "value": "24576:ynryoRivxkXPI4v579RhtamqLfZhgRBcdWbvpihC2EoKXts5j+C6+PeYptLs3:yr/ipf4vPRGoudU+coAt2j+CNmktLs3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630831151, "uuid": "948c24f1-12d2-42d4-8ed9-91229d900959", "value": 1336264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630831151, "uuid": "92f6497e-44cb-4c8f-af8b-7a9a9a04a8b8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630831151, "uuid": "9e196ca3-8fe3-4752-9da4-9a0fe878adad", "value": "URGENT PRICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df68ead-0e0d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630821165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821165, "uuid": "62c802cc-fc3b-48cd-b47a-e0b50b48f9e6", "comment": "Malware payload", "value": "ee294f2a962783b15086ccf9bad3a0ad", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821165, "uuid": "d1c5f325-bab4-4b83-b15b-f26301f3f281", "comment": "Malware payload", "value": "e37c1d678191fb53e6b655e55ea6142cd394178a4d0bedd2ec9cb3b1bba36907", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821165, "uuid": "261a3083-9ac2-41d9-acd6-645a88bb4bff", "comment": "Malware payload", "value": "3ea30b635d743922e33f0b33f316c4a603b58f3d", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821165, "uuid": "05973311-f427-40da-9304-08d1768cd007", "comment": "Malware payload", "value": "f73d12e07afcb4d401ec037f5d6924159b0f068669a417b8052acc4d275cf3c0da80981efb92dfebaca6f8276abf21cb", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821165, "uuid": "a9cc5028-e5c3-4b05-8dc9-6dea01f717a2", "value": "T1F6058E32E2E048FFE0275A796C0F6BB06D157E916A242D436FF4D8488F68653723B19D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821165, "uuid": "6995a40a-2194-4083-adb1-9c6c4b67c7b8", "value": "12288:ccMJCaTkjTh4b6XG3n7ybodv9cPdgRKue03SOXjVwrsqaE6MzF5:cBi94zYSFcFgR6nza2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630821165, "uuid": "95578157-14f6-4ff3-bd2c-78a9b071fbf8", "value": 854016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630821165, "uuid": "299c1cab-a5a8-4056-af6a-39682cb23974", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821165, "uuid": "61a580b8-4bfc-4740-9a6f-9ad6fa8b8bce", "value": "BrownRig Order Confirmation-5543,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1acb47a-0e12-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630823453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823453, "uuid": "9a029d13-d1b2-4d03-919a-fcba353a8da9", "comment": "Malware payload", "value": "95ae99e0f272f2d0621c11b1c61f6959", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823453, "uuid": "27e127de-bd1f-40fc-a3b3-cce60cbbd460", "comment": "Malware payload", "value": "e435aeb32dfe116af7249d0204981227f529de0ae35ed76d454f65f4b28d2bf4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823453, "uuid": "5509959e-a484-4963-b5c7-ae82e2c2e7bd", "comment": "Malware payload", "value": "a4a4371c76d97f2dc03115d33ae0c586c8decd17", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823453, "uuid": "6f91748e-8e8b-40aa-870c-cc7bfd220efa", "comment": "Malware payload", "value": "86f5d77d873af9ecb43517aabf8bde28946fecdadccb4366c6de851bf89fd6ea0b347cd31b22b2ba4db535b311a16e8b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823453, "uuid": "7234fb61-2c4d-4dcf-ac8e-a83800433dad", "value": "T1B434AF40E78430C90A8263A7FE5752C1FA7ED04152801264DD9FA3BD6B439ADD37AB7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823453, "uuid": "2d34437c-73c7-462b-8a2d-1ea13d211c05", "value": "6144:0Xt/0DxSRnFLu5lCt6aJpwMonq+L64Wtflk:0Xt8DxgFLu5I3JuMi64Ilk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823453, "uuid": "400c5fc1-392d-4c51-9e27-cc5929817f54", "value": 243699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823453, "uuid": "17654835-00df-4dde-beb5-2384808a4caf", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823453, "uuid": "04ecee05-d2ec-4dfe-9e1b-71fe44183a3d", "value": "2580.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "298cded0-0e1c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630827466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827466, "uuid": "49fdbd76-4e78-4fb3-aa4a-983c476119c8", "comment": "Malware payload", "value": "b816f9c4e04d2570ab7b0104c5f4f156", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827466, "uuid": "05307bda-951c-4683-9e0b-966c528c601c", "comment": "Malware payload", "value": "e494fe19e2b0319a577b9d2b2ec47345fdb8a79aa638b7840d0efd2bf88f1b51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827466, "uuid": "4bb34342-7079-4929-916b-44d2738815f8", "comment": "Malware payload", "value": "835c31afa436efe6a39bca7e5a609677896cf923", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827466, "uuid": "bd9d7960-8627-46c5-8447-ce3df8dde14f", "comment": "Malware payload", "value": "ad93c7cc910f487c4727256c0095b38e5f2ff7055b35326f339b1ca6337e6ed5b25854b2d6ecb6ee6e70acd1bf752794", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630827466, "uuid": "077a51bb-1c8c-401b-80ee-1cf7bce09321", "value": "T152357B3DED256637E7BAC1E8C4860D4EE69410CBA23B5EDF41D2A389200751776FAB1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630827466, "uuid": "1c12ed69-e2f9-4057-b988-207439eaf0bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630827466, "uuid": "8b12e8b9-fe04-4ba3-92cb-14d7e87a190b", "value": "12288:k87kbK4HtLGEUBXeu0BU5SisIid0kph+QrA2r79gEflEGD/XnyP112PdsfLosmoz:p7VuvXkQwU5qh31pLPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630827466, "uuid": "3f8bd4ae-e6ec-4b98-96e4-a5cd4833152c", "value": 1151488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630827466, "uuid": "68462591-6ea7-4bd8-92c8-8061468a00be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630827466, "uuid": "d491b813-5a9f-4c3b-9537-ac49bde9642b", "value": "MRKU8781602.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d1ad55e-0e33-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630837323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837323, "uuid": "bcd42a3b-4915-422f-b2b2-b51f4acbbecd", "comment": "Malware payload", "value": "0e96d911b0f9991b9daca51b5afcd271", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837323, "uuid": "89c06f40-6f03-4476-9373-17bef9c89cde", "comment": "Malware payload", "value": "e4fb7d5df47f5dd44e59eb67a6ed31b730c5ae110a26de5aed15b1641c76e71a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837323, "uuid": "3539f038-1fbe-4933-8b3f-3481822feffb", "comment": "Malware payload", "value": "5cf2a7c6f8db4b03b3040fc795c9aa1c04123aa3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837323, "uuid": "458331ec-1c6c-496d-a4b2-5648c95e238d", "comment": "Malware payload", "value": "c9fae5a66f15c3b74be0043595be523d638b0cb2cca7249cf698658644694b7dcb4d2b228a51d1608a85978a067f6bc8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837323, "uuid": "95862b93-9030-458a-a605-94befeac33b9", "value": "T18E84235A6E20AF74A2FEFE346A2A84D1510DF3465288CCB5299F1370067195F1ECAE0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837323, "uuid": "28e6eab5-b0db-4c01-ac8b-d3b8b0d67685", "value": "6144:qeDfmxfu3zukoHcCYAmCRM1/DJf0TU2X7u9qwjw8VrIn1BYpkdw:qrm3vIcCYRCa1bV0TUeqqwjwKI1xdw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837323, "uuid": "6359068f-5abd-436c-a607-472c6bd1e886", "value": 374844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837323, "uuid": "85e0439a-bf8f-4d66-8004-650c2f9690b3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837323, "uuid": "70d4b884-3c15-4ab7-93c2-42ee2a892846", "value": "7776.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4364557e-0e1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630826650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826650, "uuid": "24a0f21b-65a8-4e58-a811-86ad2b19d562", "comment": "Malware payload", "value": "3ec20f6c09f49b6f47ea963a28715231", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826650, "uuid": "8c5acafe-330e-46f6-9906-e63758fde85d", "comment": "Malware payload", "value": "e54c5442486520f868cb57dc0098918a8d12789b5c9a0840b8b095274f35c750", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826650, "uuid": "df48fbfb-22c5-4a2d-be89-313e94ae5d59", "comment": "Malware payload", "value": "bba4c90fa46959cd7679f69f69d6c9f93b1ba9a4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826650, "uuid": "3ae34b99-cbd6-479c-9f23-263720f8ca0c", "comment": "Malware payload", "value": "29714b1bdc93d52494ccff41c86635c218c3d71819d08c569a81c0bcc5cd89a0df8f6c7c5883275a21ea696e5cc43519", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826650, "uuid": "20d85fc3-2d0e-4c31-8497-2e883591cfd9", "value": "T116D4BF50EB4421561A83639BEC5312D2E97DC101534121A8ED9F93AC6B479ECC3BFBBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826650, "uuid": "60b657e2-6124-4e54-851a-ff5e6b69f0d3", "value": "12288:8yPay7oNi+EoscTxW89iXuLkukas/6nLUkXt8DzJ/+HEQ7Moux:ZPV7o0cTxbLUas+LzX2UHEQ7tI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826650, "uuid": "de25a0d2-4d83-4b74-a0a8-5c488ae2b079", "value": 628843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826650, "uuid": "722d6a52-5fa3-47a1-888e-bb1db7d15b72", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826650, "uuid": "0f0222cc-aaad-44d0-8b9b-65a85fe1f85f", "value": "6728.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ab75bf-0e59-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630853902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630853902, "uuid": "250ba2fb-36db-4d85-beac-267048ff8cc6", "comment": "Malware payload (Mirai)", "value": "b70d9784908bd054e7a234549eb49646", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630853902, "uuid": "ae40987a-a59c-4877-a715-c0416dcbaf6c", "comment": "Malware payload (Mirai)", "value": "e565ba89d034418fd26a5f642f6eeee4d72ee3b8dc69523419b7ca8dfd452730", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630853902, "uuid": "d5e49fb0-47be-42ce-97f8-f96d8c11f789", "comment": "Malware payload (Mirai)", "value": "e5b3630e8f5261f9225c782dfcb80d183b386c28", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630853902, "uuid": "5c9a891f-a830-47b2-92e5-754d975d208f", "comment": "Malware payload (Mirai)", "value": "a5b4449eff407e0422f2856fd54853128c005a561535114681260a45411f3d54a91625260fa10b0162fa7c004a5a7781", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630853902, "uuid": "7dda728e-d398-4016-9002-24f62bafe869", "value": "T179731925AD391A37C0D4A67E50F78A01B5E1228F6AF4C14A3D730E9EEF246407897AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630853902, "uuid": "1b6a12f0-367a-4cb7-ab74-f0052c1246f4", "value": "1536:N3aCiIgkIE3zFS3Sa1/A3ervO+w6vxuV13DB:NqP53SW4YJvxujN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630853902, "uuid": "5711773f-09fb-4f0d-9dfe-4a2961638abd", "value": 76096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630853902, "uuid": "63075557-e310-40e1-a32d-f52ec27a3915", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630853902, "uuid": "5be507b0-dce0-411c-9429-665210f4e023", "value": "b70d9784908bd054e7a234549eb49646", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87f4e7d-0e5d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630855596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630855596, "uuid": "336cffc1-5734-47e0-befe-93e8af2932d0", "comment": "Malware payload (RedLineStealer)", "value": "fc849a370b39fe1de73586faee9e93b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630855596, "uuid": "09233df9-406e-45e3-950f-82a46ccd4de7", "comment": "Malware payload (RedLineStealer)", "value": "e63b2d03e3fee2d538f8bd721b61dd3641284fa941087d846dea6f15cab40308", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630855596, "uuid": "084f2cbd-d6d4-4509-ad91-5b65e0d47aff", "comment": "Malware payload (RedLineStealer)", "value": "9d307852d7883e9b0f160fe4b018e1e1b0a24f57", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630855596, "uuid": "9cb8a4c3-b8a8-4e4f-afb3-da220ecdb658", "comment": "Malware payload (RedLineStealer)", "value": "881c81c3f684fc1435197f18b1c7ed452b303a6bdeaa5b97b11ea35f740ccd64824a1ebe6125ef005879a8452d8797a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630855596, "uuid": "ccb2d73f-2a26-4733-94c0-cfc56349e43d", "value": "T184A48C7996A398C2F1EC0FB38D938B903DD71C90A590441EE66536F42A733D0E919AFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630855596, "uuid": "42ad21e7-7da9-4cc1-8481-bbc76d268c53", "value": "0de8a80365b774c528154451ec11f7cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630855596, "uuid": "29dabea2-90c9-45df-a907-0d8bda87d594", "value": "12288:BqmIj+JkbWqkWG66gEnPIac2UyUlaE8RM:cmIj+CQWG6mzck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630855596, "uuid": "0a61f258-c4c2-43b8-a263-083c5692b04c", "value": 462848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630855596, "uuid": "cfe47eae-3c4f-4174-a96e-c9b9200ee02f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630855596, "uuid": "da638352-3cf6-412d-aa33-2faa83dbddf3", "value": "fc849a370b39fe1de73586faee9e93b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa384d2a-0e33-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630837560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837560, "uuid": "97ab7134-2797-4b14-87a3-3daafa32b37a", "comment": "Malware payload (RaccoonStealer)", "value": "f545d501be333e5a1ba5bdbb404b031a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837560, "uuid": "acb8d927-f12e-42a9-b38c-bd0d5a67f26c", "comment": "Malware payload (RaccoonStealer)", "value": "e6571c9ee5508a3a15a186c993d9e13ff43b0c0874d43db45dbead81d280c58c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837560, "uuid": "e8614661-202e-4718-8a1e-72463f7aa298", "comment": "Malware payload (RaccoonStealer)", "value": "80e7545f558c2656ececf3ee2f94795b1b7b84ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837560, "uuid": "5d1acc13-69ad-46ff-a793-5bde692aa380", "comment": "Malware payload (RaccoonStealer)", "value": "da78b59b7b20dd85abfd6e15b620f17492c81d994e4ad026e96cb5d8d4cae433fea1e35ecdb1a8d7f3b213d0ee412279", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837560, "uuid": "49e474d1-1efc-408c-af71-17e81e7d85b2", "value": "T162B4F11A7E90E873D486C6726426C7F0DE7DBC712924814B7754FF6E2E302909A2E397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837560, "uuid": "c886c78e-a294-4f1b-b5a2-8407099f9e45", "value": "b2c249fef864036a8cc857592c5ce556", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837560, "uuid": "255555fa-4a18-44fe-8c0b-1819365b6a46", "value": "12288:HHYRg+jv8PYRSq5OHCfEHo9Z/JlwEDkj8N20f:nYWc0YRd/9pJlwEmC20", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837560, "uuid": "a1795739-61d9-4851-92ac-92337fa71e7f", "value": 535040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837560, "uuid": "0563358b-6da5-490e-8476-dc57e4865554", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837560, "uuid": "3c6d3106-1787-478a-8ada-94c6b3201539", "value": "e6571c9ee5508a3a15a186c993d9e13ff43b0c0874d43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "645896d1-0e19-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630826276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826276, "uuid": "26c25f92-16c0-45cc-9b13-38569c09a7e6", "comment": "Malware payload (Buran)", "value": "99f2682b6a636961cb428cbd2623bc77", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826276, "uuid": "f6ff0b3b-191d-4970-afdd-65b19c42ace1", "comment": "Malware payload (Buran)", "value": "e6620067e8a33db9cd9e50b880633842b8f220f96a49d4b9ee1e2f03c4885c74", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826276, "uuid": "62b460e8-840a-4ef6-9711-4328fa9ae743", "comment": "Malware payload (Buran)", "value": "9a37a87bf0a56463f103fb932795ad40ff5c1251", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826276, "uuid": "3ccc6abe-c8d6-4c97-a0bf-ce7c68a64315", "comment": "Malware payload (Buran)", "value": "b991e74e99c88d809c1ef1e23aeaf563298efcc3d2df1f35468af97f281bbe5d0c9c4ed334b537edd4275fa246ee2517", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826276, "uuid": "73db20a7-0926-45e9-b88b-518b235457e1", "value": "T152B423DF269060FF215749DDE4747FBA0023C89C520E1A29F3E716E9F9B58B52729C28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826276, "uuid": "376b6f7e-d1c9-4296-a961-80cb0c8e1a0d", "value": "12288:d0R7esBxkZ1asgCuBUDi65MM9ugS7FmUloCnNO4nv9CuHz:nAkzasg9qO65Mllj84nx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826276, "uuid": "4e7052be-aac0-427b-9eb1-0f60fabc64ac", "value": 509050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826276, "uuid": "5e8b2e18-f052-454d-8da3-147df6dbe32e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826276, "uuid": "0e08fbab-d65f-4442-bf7c-b561e910630e", "value": "5565.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4732506-0e4e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630849200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630849200, "uuid": "ad43773a-f171-45e9-9e7f-50ff38c1101e", "comment": "Malware payload", "value": "1683c292c5fe90a7e4fb47c7f79b9543", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630849200, "uuid": "49f03e4d-b321-4ea0-85d3-8c6d8adec6fc", "comment": "Malware payload", "value": "e66ed0dcc42d320f62001e861af7df18ef9924a6a1daca05a23f2c1fd0357b3b", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630849200, "uuid": "2e5bd9e9-c39b-49d7-9eb7-8d594360a1cc", "comment": "Malware payload", "value": "3be4ab4ec3dd36f9f897f061a7964e19aa9349ae", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630849200, "uuid": "c8ab05c0-51ea-4395-a7e8-addc85770e43", "comment": "Malware payload", "value": "7da477820204b28ad930dd47cc79b240348a13766091e0fdfe3b0351a5e0f610494f8ce8e736c7600d68e39f52125835", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630849200, "uuid": "454db5ce-0715-45d0-97b3-9ba5f660e5d9", "value": "T14394233956DD96380D751CE181B640BFE2FF808AADECBE8F68E04F2D1549310C76E559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630849200, "uuid": "729f506f-c55c-4c2b-8791-98c15b598e6e", "value": "12288:ahS8Kv9QS+GA+aevQPgbpU7FXIxV5MBqOP0TFBNLZ3:abxEaSYgVUeX5oPMNL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630849200, "uuid": "f3e54265-5c62-43e6-b776-03cd1196e912", "value": 445162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630849200, "uuid": "51066af9-8010-4250-8fde-fa6123440130", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630849200, "uuid": "0260571a-d042-4c01-a5f4-19cfd478e887", "value": "purchase order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221ebf14-0e5b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630854511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630854511, "uuid": "997985b3-7aba-413c-801f-6d8e43e0dc81", "comment": "Malware payload", "value": "88013faf7ff8c6f533e39638f62b00c7", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630854511, "uuid": "4408a772-903c-419a-a848-e25eb85574cf", "comment": "Malware payload", "value": "e7261cc6d5bb3e51a09c4d8a97416cf1487022a793042941bf0894bba341c5b0", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630854511, "uuid": "2701b89c-dbfc-42fb-b4a6-fb33de6a152d", "comment": "Malware payload", "value": "1d4ef81919712c60f654cb004d5a8babf43a9362", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630854511, "uuid": "b634632a-fa5e-4f87-b786-539fe453f0e6", "comment": "Malware payload", "value": "8986eb676cf8f5f79f81d5f52c5986e25c3ebe3b11e94cc01e1248fd9be167288836fa86e09eb354a5ff52d54d14250f", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630854511, "uuid": "0e30a038-9f47-4577-975f-68c8579965a9", "value": "T1D351860AF847D15C9B79236BED978562FF1B811B9DA2104C71DCC2495F20809A66CB8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630854511, "uuid": "ea989267-595f-4579-81e8-1a1e994544fe", "value": "48:Axk48iLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBozl4:dGhrffvIypvK0elkEYZ85zK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630854511, "uuid": "1aa9c33d-e522-4a22-9abc-629e0797b7a5", "value": 3132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630854511, "uuid": "f2021691-9ddf-498d-984f-6cbad606853c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630854511, "uuid": "c741d4d0-4e6c-4d03-864c-70c68bcd8278", "value": "ypjfsHkY.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14977cf0-0df4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1630810251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810251, "uuid": "fb1509a5-e37f-4e8f-9f98-f595adc1472f", "comment": "Malware payload (Gafgyt)", "value": "be38d5003c3424ba8518562e25abcdec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810251, "uuid": "68de5ed5-6be7-4aeb-a9f5-e1cb97b9114d", "comment": "Malware payload (Gafgyt)", "value": "e7797c4fef109de0498a776d7e7a3544202e194b931ee88fe07097c6569d33a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810251, "uuid": "e2dd0b9c-3014-4981-89fc-1d2afabf9208", "comment": "Malware payload (Gafgyt)", "value": "85c59345a0298b0b9b55dfc42b483187c96297a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810251, "uuid": "01aea22a-1027-4319-9895-2137414ac4bf", "comment": "Malware payload (Gafgyt)", "value": "37a31decc7a7ec968473cd5c619f528d00a2f8d07e975c33b3ff8162adb682080afee9d6e5c3d75a42cad79298f36281", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810251, "uuid": "6cff6202-54da-468f-be9f-c5d6273aee52", "value": "T155D30830E904472BC2D227F6E79E469E3F361E9B53D733115A3879B02FE27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810251, "uuid": "422ebc9f-5ce0-4be4-b6ed-b8c98e85dbb6", "value": "3072:3e0iklmjgaufEBRLYE/jbXHs3kmPOqaQy0PlfKCNb:AjufZE/jbXmPOqaQy0PlfKCNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630810251, "uuid": "f56a3301-2666-488b-b001-f2d0b24e816a", "value": 138604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630810251, "uuid": "f7039916-cbb0-4800-987a-cff6c9626712", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810251, "uuid": "19ffb343-c2e2-4efa-bbe2-e23147518f17", "value": "be38d5003c3424ba8518562e25abcdec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af93e90-0e1b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630827119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827119, "uuid": "99b26343-0cf0-4753-92bf-84f0b55c64a4", "comment": "Malware payload (Buran)", "value": "21236f3427412893854f2254f9012e38", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827119, "uuid": "f0d8b68c-347f-4c09-8401-1049d1016edc", "comment": "Malware payload (Buran)", "value": "e7876ce943b31a42740a91b091321c9267777f9e3df750264980146c7a097a3d", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827119, "uuid": "6a9b0d03-ceed-4ef5-8515-91c517c479f1", "comment": "Malware payload (Buran)", "value": "f63872b8bbfa91b976b9b0af3d13d2bd1fe296ed", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630827119, "uuid": "1f49d354-e10b-4bbb-8a18-19f90df805a9", "comment": "Malware payload (Buran)", "value": "d7497ef7773f393d552b45698172182654e6215cede92822d13c37005a6d1b1b2d0bae93430f4435c4ff7382bed11839", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630827119, "uuid": "7d6cf2de-1b49-4c43-aea4-52770e4942c7", "value": "T19B142337F782D34F4DCA64AFB6CCA9C5973F3A5BBA8A4805E8D16528010D1B384BC597", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630827119, "uuid": "27ee27d8-4716-4563-acfa-8689f7f4e52f", "value": "6144:lQMsi7PjZykBQhgSU+xbPThxQQXBmdUKG4B+IH:xsi7jZypRftxQQXBmdwm+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630827119, "uuid": "ddb700cf-e73f-4cd3-a100-6d9c14fe4b6e", "value": 208751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630827119, "uuid": "aeaddfa5-365d-43e6-8d69-26a3e887a901", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630827119, "uuid": "2013a471-7cad-48e0-a8bd-db248855e3b8", "value": "7637.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79a0ac87-0e13-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630823734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823734, "uuid": "595e5f3e-8edc-4998-a668-aef1660e5262", "comment": "Malware payload", "value": "ee115c15b64a5abdaa33b1ff8497830c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823734, "uuid": "db5c6721-8873-428d-9d4e-227c4879baf0", "comment": "Malware payload", "value": "e8a8d5c230f43e552cab5374b361d3c1f1d22f1e0033812037857c9e69ae5268", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823734, "uuid": "f618729d-24f2-460e-9e6b-ff6133a48eff", "comment": "Malware payload", "value": "94737742cdc8aed7aa4246ce203b5d0304d9fcce", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823734, "uuid": "7135c54d-8b8b-48f3-a6e9-5180ed0b493f", "comment": "Malware payload", "value": "53c5fdd1eae35af98997ca604cf36e295e73253e60a05daf671e12c1b86360ee5a5aafd1c8b79b193c323dc64450f051", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823734, "uuid": "45e30624-4fa8-4173-a404-5aae79c83856", "value": "T198342367AB943AEE6EC2CA044F10D95B2C25CD3127F7EA89CF9B0571B03F4113B5519A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823734, "uuid": "414ed15e-9241-433f-a8c1-da3f6c186d84", "value": "6144:AW6qXBUg5jK+68ULdRovLzhHM08a8NF6tzOCoA6i:YqRLNJsnkHFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823734, "uuid": "e61822a7-8098-4947-bb70-463a106ebf38", "value": 242017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823734, "uuid": "e1aa838b-12f9-47ef-9acb-0627bf58dd91", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823734, "uuid": "e105620c-0af6-4a3f-9069-ea1c86d25da3", "value": "2851.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee4f6d6-0df4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630810295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810295, "uuid": "23929241-20f0-4569-8444-d0edd9fee3a7", "comment": "Malware payload (Mirai)", "value": "dae864713f4e3f98e94ee818793d7547", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810295, "uuid": "79c485fb-e7c9-4793-bc71-78b618bf2ab1", "comment": "Malware payload (Mirai)", "value": "e8abad38ef62a9c569c94b2a1adc4d195df4158bacafb46960f464e873d946ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810295, "uuid": "de6ce9ee-4e1e-4473-8a43-45387ba76986", "comment": "Malware payload (Mirai)", "value": "576cb36d1f19dc832d0823c48f40f5e5716f21e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810295, "uuid": "0ebed1ea-173d-421c-822a-659e405f478a", "comment": "Malware payload (Mirai)", "value": "2cdebc24dbae4379aec1a5880f921c9ccef37ddc4311705b57853775d3675553df0ea8e9f3073ba2bbce389091603acf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810295, "uuid": "a4e5a1c5-f09e-42e1-b746-e3794c1bf0dc", "value": "T111C30772B900DF66F40A96F204E38A267E30BFA70E63166673173966DD371D12863F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810295, "uuid": "51d17564-f899-4796-8dca-3bb038e15999", "value": "3072:z1RvSmHICQnMX32KryJ/ui9mmbocuwB1ninNb:zT5ICQnMbyJmsmmbocuwB1ninNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630810295, "uuid": "d49695de-8d43-4f17-9585-be591e079247", "value": 124925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630810295, "uuid": "7bd8370b-6fb6-4736-b8ed-e0ae6c99cbc8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810295, "uuid": "ac02ec4a-9a4c-470e-8449-ef9fab0e8c8f", "value": "dae864713f4e3f98e94ee818793d7547", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c94ace6d-0e0e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1630821721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821721, "uuid": "2c6dc6ef-b3b0-452e-ba6b-487390a0bb5d", "comment": "Malware payload (SnakeKeylogger)", "value": "8e2750ad266316fab704351ff4ac662c", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821721, "uuid": "856afb80-c403-4663-8df5-01bacd40a5a9", "comment": "Malware payload (SnakeKeylogger)", "value": "e8e0443cae3ef8ff5c0d19724d5082caa72ae5d93a1ca37b00b00e85c8cf968f", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821721, "uuid": "90c0f559-c316-40bf-96e6-ab0613c986f2", "comment": "Malware payload (SnakeKeylogger)", "value": "9b47038314a19a3bdc7a27938cae25feba5db288", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821721, "uuid": "c0be3d12-2920-43f3-9888-19e703ede898", "comment": "Malware payload (SnakeKeylogger)", "value": "8aaa44aaa02758aeb006e7d41870c6104696fc8dcdea370fdbbfd8d63b1a6cf14af7f51061b72ed0334215802ce879b9", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821721, "uuid": "44b8d440-388c-48ef-96d8-de771e361ff8", "value": "T1F78423C5CDDC1AFA9C16ADBEE62165E4A20330E3B1B951713D418D94FA692C0EB94CF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821721, "uuid": "afe45ad6-438c-45ac-837b-6a885d15af5c", "value": "6144:hFoip1UWo8TUtyHF6A0rjRYBxdlkVSf0jn+3zpvN9L6UUfPAmM9HL:hFHYmTHI1yrLkPONl9WRf4mMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630821721, "uuid": "d03e27ca-4dfb-40e7-9b2c-458d679461a5", "value": 370955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630821721, "uuid": "14dc3f58-6058-4e58-a73c-856a8d870695", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821721, "uuid": "794f6446-ebd0-467a-ac34-291ff1de4ef7", "value": "HalkBANKASI 336,pdf.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea2e36c-0e24-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630831259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831259, "uuid": "45f334d2-0656-4686-b4c0-e1b8b072736f", "comment": "Malware payload (Formbook)", "value": "4e2796a2868b3c747df7d5c5bc359caf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831259, "uuid": "61acb70e-22d1-4384-a25a-68cf039a5c0a", "comment": "Malware payload (Formbook)", "value": "e99ee0d03ae293aec74c31a6db628d9fe12be9699365ebf71de4b2bf6e8ca0d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831259, "uuid": "87737507-45d7-4bdb-b83c-bc059de9885b", "comment": "Malware payload (Formbook)", "value": "7219dc2e9a2980e60229dc32d303d158cf56a195", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630831259, "uuid": "c5d74eb6-7cb9-4c20-abcf-50fcb718cb5c", "comment": "Malware payload (Formbook)", "value": "a348ae47d7ac7f3346fc3d6b21b8b4f647534fcc234afab21c6579f362a31570acb26da58468caa5c81a95632359d7c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630831259, "uuid": "d5a3e04c-d8fb-4ac7-8782-891866044a3d", "value": "T1A3F44D3E18FE23279176C7D5CBE18823F6D098AF3233A96467D747664316A4674C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630831259, "uuid": "dd389aa1-80a1-45d5-8a09-ea19955de5cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630831259, "uuid": "feccc34b-a5d5-49d3-9505-3db30da6fbb6", "value": "12288:2hBDqq1fJAm1/eKyQKQBgzBKbNjhWQbCiuOY3o:DnmdkQCVmCkY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630831259, "uuid": "342fa798-6901-4b01-84b8-838def90b56b", "value": 751104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630831259, "uuid": "d8492363-1fe2-46b8-964d-8c0e5bbaea82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630831259, "uuid": "eab5c9b6-c4d7-4cdb-a72d-ef0c7c4602cf", "value": "Swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1b3d97-0de1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630802108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630802108, "uuid": "f3f06ad8-5308-4294-9d6b-39c42419b5a0", "comment": "Malware payload (Mirai)", "value": "ff3ffa9a1b317e1398de4f0d592c079f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630802108, "uuid": "b9f17081-8c71-463a-91d8-0ab0e1c24d76", "comment": "Malware payload (Mirai)", "value": "e9e7fb2c799593e74e45fe3321c8ce0306821bd1e7b56cc01e643e790b11af9f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630802108, "uuid": "1c05c8c7-1d20-43a2-9eef-edead74fad11", "comment": "Malware payload (Mirai)", "value": "3cb81e59e1521ca6b353d4276bdfb28cfcc52b29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630802108, "uuid": "bbd775d9-6587-4ed1-b7cf-a718e8c3c16e", "comment": "Malware payload (Mirai)", "value": "454904b0ac63b4264918317d0b16d0e2534f930da415acf7753f4957ab02d86904458fd85318b4483f8b179dffda15c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630802108, "uuid": "774e81b2-8422-4668-8fff-0cdabd144188", "value": "T1B7640287FB22BC1FCE010BB125DB078976BCD65B82CB9091B2D4C95F35BA185B7A11C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630802108, "uuid": "6b5bb5af-ce1e-4c27-92ba-ef5289c5204e", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xiodQ33Q:p3lOYoaja8xzx/0wsxzSigJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630802108, "uuid": "bf0e267a-6dc4-40d4-bbe3-90f54758080f", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630802108, "uuid": "fc1f369b-bf14-4af1-8075-bcc39950a09f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630802108, "uuid": "9a7f0e36-0ade-4034-a7c2-7f3171e59b31", "value": "ff3ffa9a1b317e1398de4f0d592c079f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b08248-0e5b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630854564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630854564, "uuid": "40ab1c9b-3d9c-4227-b505-3ff30f4c7ea8", "comment": "Malware payload", "value": "1f702d2d63b0d9cdc4297c913727bc9d", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630854564, "uuid": "fc4bcecd-70bd-4843-855e-0e5a751f816f", "comment": "Malware payload", "value": "eafe35c1d24474120218e6dd51be70e690d1c3054db2790e864748d9a4019f7f", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630854564, "uuid": "acb1ec51-eace-4d9e-b92e-71e453a99a5a", "comment": "Malware payload", "value": "d0c55cf9986767f8c8b98da464db669cb50ad2d4", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630854564, "uuid": "8cbdf3a0-3cfb-4a6a-946d-eeb25ea7e64a", "comment": "Malware payload", "value": "a7fcbcec908c1d34e93fa4cc0f3ba1eba75018ce9cb5b75693f768fc8354e8c40c92a0221fc6db56e3f84cb9f450bd3d", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630854564, "uuid": "2f3c19d9-f6ff-4b0a-a52b-e82722b62dee", "value": "T1253142B71CC191260B15E791F685882CE724940F9882354CE1DE858DA1E0FA32FDC2F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630854564, "uuid": "dd4f3fd2-1e79-4a92-906d-932bae59af84", "value": "24:xcEU8fhPCkaP4mXjvTCkLKCPWm6JqGqBYZbxIkyyD++ETTTQ/Tviwdy:GEXfhexTvrtWbJ9iw6yri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630854564, "uuid": "fa971d3b-25e0-45a5-8407-66f14d18a62f", "value": 1532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630854564, "uuid": "3f8f74ba-d27e-4ec3-989a-a3ada7e1e0b3", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630854564, "uuid": "7de8576d-dbf7-4679-9b7f-5a5377755e87", "value": "1iWA0D9j.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f444d903-0e33-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630837684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837684, "uuid": "ea7d3e68-3768-45ff-bc80-38ce65ab9bec", "comment": "Malware payload", "value": "509f46ff589116a2584f0b90339d462c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837684, "uuid": "2b96badd-606f-46d7-9035-f58f79072f97", "comment": "Malware payload", "value": "eb7e97eff1c24cc06875aa4e6b57111311e1799820d6a4dfd0c4ab4ce3fe5834", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837684, "uuid": "1f6d7691-bf96-4436-beea-0b5a84bb0575", "comment": "Malware payload", "value": "a0a550964d69934b72c26cb6f8c999ed34823f41", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837684, "uuid": "aed010e4-0cf9-4115-809f-dd968dcb603c", "comment": "Malware payload", "value": "6a8715138487656a60f12122b711221971d794d798c8426acad65d7f115c622c1d3975adb67a0cb3a9ca4f7707ac34f3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837684, "uuid": "e85f5052-65d0-4d03-90c2-f5b8206a82cb", "value": "T128C4CF50FA4011660ED3539B9C1262D2FE7CD01193412264E99E93AC7B476ECD3BEBBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837684, "uuid": "6b82c12b-cfc1-4223-afdb-1b11eb867a94", "value": "6144:0kOBFat5zVmO9KOEzBDlfvnuwIt4AZaTWDCKY2OP8oj4zr6POg6rphcPk3SkBEEF:0kObDBD40AJWxjA8xqpD37Ykcz5GWgd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837684, "uuid": "ae0b62f1-fb37-43e6-b85d-71cb7fc4c949", "value": 563458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837684, "uuid": "bd4dd2da-0718-49c6-9bac-6ebe80e95d4e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837684, "uuid": "cc8ee40b-b423-4146-9560-0ae97a313f0a", "value": "8255.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07a27a72-0e23-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1630830415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630830415, "uuid": "15ef6ee4-bfdb-4c37-842d-5bd4f7a92432", "comment": "Malware payload (SnakeKeylogger)", "value": "d620a3a10ba7024815d362f6a954de2a", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630830415, "uuid": "0458d674-abb2-4e77-8066-9847076c41bb", "comment": "Malware payload (SnakeKeylogger)", "value": "ebdbe4cd5c516b74f33bca786182fe2ed4be2d07ea3dff26358c3c906f0c7d38", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630830415, "uuid": "08e509cc-34b9-4445-808e-b393c79addfb", "comment": "Malware payload (SnakeKeylogger)", "value": "9ad0cad0e3415e4dd7e91dbc72ee4b7f3c63bb17", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630830415, "uuid": "37591208-9158-483a-9acb-46205c45437a", "comment": "Malware payload (SnakeKeylogger)", "value": "5c5e392e91dfef23dc4c5b98661f2c064afa4027b4231a9c9d7197475e55944d26b3151c0afdbbc241cec364f98680ac", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630830415, "uuid": "5a4db7e8-e51e-4e77-af60-5e8b235e826f", "value": "T1A3742360AB704F30CCC4152539E71A573704666F28AB2BEB1D1D427BE587E921F93CCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630830415, "uuid": "946e91f6-6007-456c-b336-08e93e7c6df6", "value": "6144:zJkPhi67zqusiSvNbJOyh+HPbUZCsoZQaL34k/i8PHDE6Hn9TPOMiR2cpm/6QrNE:zJkd7OHvh+zIvo+a8k/i8vNHn9TPL8mU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630830415, "uuid": "6f599f3f-3fe5-482d-8c79-56abb40cc562", "value": 338407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630830415, "uuid": "c075782b-83f6-4ce7-8bea-a7b74b93824e", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630830415, "uuid": "52cc370c-d026-4dd6-b951-a629fa742e3e", "value": "Revised unpaid Invoices.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc7fa86-0de7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630804840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630804840, "uuid": "a870c406-c520-4b1b-8d1d-62d7c1e13374", "comment": "Malware payload (RaccoonStealer)", "value": "a65b1b0c7c35efbf0ad82691841c7f05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630804840, "uuid": "2dd7faaf-0824-44a2-bcee-bca889d6cb15", "comment": "Malware payload (RaccoonStealer)", "value": "ecc23ade7514bff1e172b9a02c27572a66e0d16bb68b4927198dc091abf1c982", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630804840, "uuid": "34f47d83-6d64-4ab5-96ab-715fb660414f", "comment": "Malware payload (RaccoonStealer)", "value": "c82d92894c0709eb319b19f8a0d4d8797241f384", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630804840, "uuid": "3cfa5771-5703-4afd-a311-8194477826e1", "comment": "Malware payload (RaccoonStealer)", "value": "2b90f08df136a850f8202bc3ba60ccb5b4ce8b50ff229f861f1e8ce133a9cea5230525591d298e7f199306ab93f08067", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630804840, "uuid": "1f9af046-12d6-4bff-8eaa-0f2eaa9d19b4", "value": "T1782633283EC1C0B9EE46B13ADB182FB2C4A583A45A340EC7536A461D93FC5F1D5ADD39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630804840, "uuid": "d66beacd-f9f2-442c-afca-26c0533b1047", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630804840, "uuid": "26b96883-5605-41bd-8ca8-ee948cb6ffd1", "value": "98304:xmCvLUBsg6AK6cCcJFe+qDP1WxYwnLNV8A5e6GoHW3lGRxPLk+1NlQg3:xPLUCg6AK6cE23sm1HWoRq+13Qe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630804840, "uuid": "41a4a0a3-6fe7-4beb-9c4c-d04f2b30b7e6", "value": 4837678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630804840, "uuid": "984f326e-028b-40d6-9af2-f0f24c45c5b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630804840, "uuid": "22a62ae3-62ba-4533-a4a0-e2a35b290c3f", "value": "a65b1b0c7c35efbf0ad82691841c7f05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7687e58c-0e0a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1630819864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630819864, "uuid": "a49e4f43-dd7f-4a9d-a99f-0a92fa1ee6ac", "comment": "Malware payload (SnakeKeylogger)", "value": "f9b0609686ebc425cd28be8e3fff273b", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630819864, "uuid": "193c8f56-ff71-4a70-aee9-8998e56d5db9", "comment": "Malware payload (SnakeKeylogger)", "value": "ecd9a849c45bf39575c01d2cab5776b1e3f606910dad4124fa4a909d0e833086", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630819864, "uuid": "7cbb29dd-042a-4134-8a7a-659a3f82c1f5", "comment": "Malware payload (SnakeKeylogger)", "value": "f08b96f3d198b8c838e930c1562a1aac535d208d", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630819864, "uuid": "631530d2-9432-4b98-a738-9246a408473f", "comment": "Malware payload (SnakeKeylogger)", "value": "91bbca41ebceb715f273cef5761aa9a54c176021a50c257637911e8888f56a6ea3ad49fc72b34769a3c994cc720b3fd2", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630819864, "uuid": "982df9ce-7796-47bb-b00e-32fe985d9015", "value": "T114C423EF85FB81D3C0C165284FA8B91BD55ABCACD4029E1FEB27B54D468CC46949223F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630819864, "uuid": "944e857b-4f50-4a3f-952f-8be74d1c06f1", "value": "12288:X96AATqiUBS6PJz4Cm1MG/bgE6Ltx+zC84jvRRskkkdYmCmEBYeBZV:t6AAGiUtFP9GTz6Lj+Gzjq7EEBYeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630819864, "uuid": "0b53250e-7eb2-48ec-9c2b-6f93e59e0a55", "value": 586617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630819864, "uuid": "a594784c-8806-46ae-81fc-2ad5cefe62fc", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630819864, "uuid": "b8a09499-07f1-4379-abcf-e98ac2b47720", "value": "DOC.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e570944-0e68-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1630860276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630860276, "uuid": "b999ec59-ec64-4420-8589-6d2a8d2acf2b", "comment": "Malware payload (Cerberus)", "value": "fe0f57c2cee8fac6116615050ebc40e9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630860276, "uuid": "facd1720-ca28-4bcd-8585-7433f2f2bb11", "comment": "Malware payload (Cerberus)", "value": "ed0145bd7b7116f37f32d070fcf1ad321b288bc7b38d72caf2a582d0414aca9d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630860276, "uuid": "953f75a1-b3b8-4857-88af-1449c7cd0e92", "comment": "Malware payload (Cerberus)", "value": "ec4859c5cb103788d83f7ddba1ea2869112813a5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630860276, "uuid": "3c3d4343-e235-4f6c-9271-198b27a91943", "comment": "Malware payload (Cerberus)", "value": "d71295339848ede9debfe474eadf3f8d9ac87564d0d3e9924b1f3076b6e76e1c7d0d28cd3c0b9b5e467c37318602a696", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630860276, "uuid": "e54888aa-d41d-49f4-95ee-a2d9667d4d24", "value": "T12DD3F10363D4586EE4BFEA385F9DD3622A724AD8A7E4B3C3351550085CA326B2F4CE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630860276, "uuid": "dca518e4-9eae-48c8-b406-49a98deff368", "value": "3072:5dqA7E/jD+fbl4FP1ulFSc0nuLuIQ2XzXcvNJ:5dqAw/jDGQPolMc0novQ2jsvNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630860276, "uuid": "d15b03dd-f2df-4968-8008-032510f5a71c", "value": 136620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630860276, "uuid": "48c76453-4363-41d6-909a-e2b07b0f11c0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630860276, "uuid": "96be5a93-7714-4311-875e-65fbf2b9dd97", "value": "Android_Guncelleme_build.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce31cee-0e9b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630882205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630882205, "uuid": "e5867420-95ca-4c35-af03-40d091fe59ef", "comment": "Malware payload (Mirai)", "value": "af59897a79e939c9738d7d0e47dac7d2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630882205, "uuid": "815c4440-8ec8-4393-b686-d7f4332e937f", "comment": "Malware payload (Mirai)", "value": "ed7d119e459d8f8f63b8dc2c31579d4a16e522cd29dfc2023b03aedb4907c90a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630882205, "uuid": "353f2e97-8b0c-4f04-9dda-13050d88f74a", "comment": "Malware payload (Mirai)", "value": "e133c962a20c6987c1d99013cfb1dad465dadb8d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630882205, "uuid": "6bb58bf6-2948-4a0b-9056-38d73b4e4525", "comment": "Malware payload (Mirai)", "value": "8cd3df3b7d69315121d77bac4a18b5afa5f9e7c5ae4900dd47fbc4515981c5057910ad80edf4675a545fd69758759248", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630882205, "uuid": "9e2897a2-8127-4ff7-b3f9-3e48af79c0fe", "value": "T19EC2D0601A967F60C17018318C68C7C66B3727B9D16DB4E7157807ECA0DFA4F697DAC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630882205, "uuid": "7b8e8fc6-a318-452a-83fd-db10834050d6", "value": "768:3QaaX8dMsZUIj84/11d5PKBEVXjvI4MS0lxs3Uozbi:3QaaXP+Fj7t1KmFwS0lczbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630882205, "uuid": "1bac4a88-8a89-421e-af7f-aa3845c08a86", "value": 27920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630882205, "uuid": "3348c47e-c595-4fed-a73a-9bf5971b6f92", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630882205, "uuid": "17c932e7-ea61-4114-999a-db169bba7102", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aef9e3f-0e0d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1630821213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821213, "uuid": "7a225273-8a50-4df5-826f-f37972b8e307", "comment": "Malware payload (Glupteba)", "value": "c86735a1c278e8caa681037a16d247c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821213, "uuid": "d242d743-16a3-4063-96de-2ab1f153eabf", "comment": "Malware payload (Glupteba)", "value": "eddf51b647cdf3f3b1c93279ceff1e6967e36324126a24ed5d3301500ffdf66c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821213, "uuid": "88feef51-812f-4809-ad76-81848cee483f", "comment": "Malware payload (Glupteba)", "value": "e339877c4193a8f1a0b5889033404d8c7149340e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630821213, "uuid": "fea41ab7-ff5a-4098-a90b-13878443bbf1", "comment": "Malware payload (Glupteba)", "value": "bef616e0611944c5be9963eee98824e404bd5cc9c7abc23e885fa59dcf87fc26221b503b43e1c0f4d3df77e22fb93add", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821213, "uuid": "ff652111-b733-4240-bbf6-22de3a7c7723", "value": "T1642633473EA2F887D651D17145AAE790DAFEBCE2B93883267394FA2F5C311C0C91E194", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821213, "uuid": "3188e740-5fdb-48d8-9465-6c776cd14047", "value": "f530acf7acd4a5c8880ba2a4704d4cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821213, "uuid": "c5a0ebba-5a8e-4733-abbd-33817c50b6a0", "value": "98304:Kv5ymCkjWLCQ27ksJHJJybs5eVvRYqa72use3wFCNus:Kvb8LF6Hiieb/a7n/XNus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630821213, "uuid": "9eadf49c-7759-42b3-966b-e52b89ce158a", "value": 4650536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630821213, "uuid": "91c13133-5193-4b24-a36b-5f3b152d7859", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630821213, "uuid": "eb081278-2640-49de-98f4-b1f6099d79cf", "value": "c86735a1c278e8caa681037a16d247c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11f9c95e-0ded-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630807240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630807240, "uuid": "9052c214-dca0-49d1-9d4a-cddbc3063c81", "comment": "Malware payload (Mirai)", "value": "b831f674efc4d8b3b619edbc400d1285", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630807240, "uuid": "c0fd2ab6-3ac0-4e90-a96c-bc458480b2ba", "comment": "Malware payload (Mirai)", "value": "edf0fcb7a63978da3ee7f347bd81b9f869ce839f7bfc2e0962184d710e3a27ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630807240, "uuid": "d5137920-05d7-4394-b989-394818694750", "comment": "Malware payload (Mirai)", "value": "7feb6e2707dbe1cb04d82086968cd2f5d842979e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630807240, "uuid": "367a0cb7-22ee-4ad7-bb75-615e5df4a671", "comment": "Malware payload (Mirai)", "value": "1114ee2bfb7989e0c6ed2aea22f8127d4071b374e132b24da7c2a72ae3a0bc60d260711f5124bb85e62b33c18ee271c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630807240, "uuid": "8b7eac70-9cfc-47cd-919a-59561a46c9e7", "value": "T105C20842725C0E5BC56B6E702A3F16D093FFEA6520E4B584365F9B8AC135F36018AF8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630807240, "uuid": "e5ff2432-625a-4e20-957a-bfa938044468", "value": "384:URHD+xuvXUWXEYRMcXmeLCLHPSK170t6WDtwavn6CZMowlDS6ImPQWx9gZhDOd:UpDFcWUYRMRkuVXysDSPybxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630807240, "uuid": "a3c244cf-33e5-4464-92b1-76c048922187", "value": 25756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630807240, "uuid": "0b532d29-e136-4d8c-9162-72aa57aa4ea9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630807240, "uuid": "4b609d2a-9b6d-40ea-adb1-f70770e8f597", "value": "b831f674efc4d8b3b619edbc400d1285", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c62f6de4-0e0b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630820427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820427, "uuid": "9538381b-eb93-4abf-b2c4-4ce47f318abe", "comment": "Malware payload (Formbook)", "value": "4084ff9d3642629a82a4eec429c9d85a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820427, "uuid": "5f94691b-bf61-40b7-9525-1179b99c300d", "comment": "Malware payload (Formbook)", "value": "ee1483f83739e7f6b7f0d9cdf76a9889557e0da65b426759f02ca8bd6461b755", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820427, "uuid": "4a8ca6a7-5387-47ca-90a4-75ccd8b5b1b3", "comment": "Malware payload (Formbook)", "value": "0d82989143e7b916415b9b7aa95f3709e3a9e3a6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820427, "uuid": "371ea5cb-4019-4993-a4a2-34f6de3f2558", "comment": "Malware payload (Formbook)", "value": "73244a9e6a8426fc1a91d10844aba9c5c4db4de75fa6e9f9a273e4c4f42686353b24861531c315c5e5db75be9e29048b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630820427, "uuid": "907f97f8-29ee-4d69-950b-61fff1ea0c9c", "value": "T18BB423FBD9480A5314A09D4D8A09A763BC9C15C3F840FB3934A1C395A2F6DD4B71AF96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630820427, "uuid": "9b839735-fcf0-4499-946a-0abb024b946a", "value": "12288:3HVUwA4RYkZmi/OQvbjzUF+CmzQTK8/rsbird:3elq/gPl+4zmird", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630820427, "uuid": "c787796b-87c6-4c44-9c5e-aa3e27564448", "value": 503079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630820427, "uuid": "2180a1f0-dc5e-4263-8d35-d79ff8d7584f", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630820427, "uuid": "b01bf967-fdf9-473e-a339-8f291dd74d91", "value": "scan_bank_transfer_09039838902982882.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc997804-0e2d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1630835041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835041, "uuid": "0659a356-8e4f-4fbb-8e6e-04e47dee4096", "comment": "Malware payload (RemcosRAT)", "value": "c3d83975781737d9e258ebd273b99de0", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835041, "uuid": "85d44ab5-fed6-47ba-ac0b-9afd8c2f5748", "comment": "Malware payload (RemcosRAT)", "value": "ee4634d5cb3f6f62df7473c79865f609c09781759d86996f9cef5d7cca0d02b9", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835041, "uuid": "085f9a6b-605e-419a-9756-b14295c899d8", "comment": "Malware payload (RemcosRAT)", "value": "69f5e424f46b6c6e0fb6ab0777319bcef0dbca0a", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835041, "uuid": "6ad7fa3e-4ff0-4c2a-b417-c599ab7af170", "comment": "Malware payload (RemcosRAT)", "value": "a489f34ca502aaddc1a310deebe11a0f2d150960cb4ec72b9e31dc1d7a471f07886a401d1b3c86d172298badec74b6e7", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835041, "uuid": "4aab26f8-1abd-4226-95de-3d8871b2aadb", "value": "T1ED556C7B96928CF2D0705BBEC81ED3C5681DFC813938CC0A65B42E671B725E978265E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835041, "uuid": "f1605eb8-6b05-42da-9207-ccec1c08cc6f", "value": "12288:pyL+XIUEkt8A+CSspygap6vXD85pzM4ecXgi18IXY:MS4Tkt7gsHamDqpzMlcQiqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630835041, "uuid": "8fe51aff-aaf8-45cc-b102-85c7a5222ac2", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630835041, "uuid": "0cfc6414-a97e-4e8f-923a-584c30d8949f", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835041, "uuid": "cce3d365-99a9-4777-a71a-025e121be8f2", "value": "Attachment.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b3f487-0e13-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630823617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823617, "uuid": "e752bfe4-9b14-4432-bce4-de3d0ff7081a", "comment": "Malware payload", "value": "66dcdf005b42ca57a5d5d57ff7fdc01a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823617, "uuid": "73083b5c-a9f4-42d1-9c19-72ce06c58ef2", "comment": "Malware payload", "value": "f0467d6d705ff8ec49d82be2854a7bd9d81aa5c03b15faf485b2a50df2ce409d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823617, "uuid": "eec79bc0-a98d-4b43-a7c9-b49eaf8f8051", "comment": "Malware payload", "value": "213798a964a7a941bf1ed42621ce59fd740edd49", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630823617, "uuid": "0fa1a1fc-3cc9-49ff-b4f6-428e6716f0ac", "comment": "Malware payload", "value": "d0070ef678fe09a5461445fa033d981ebec90e15ab592be17b103ac9725fd82fe8eab2c3954f6bed0d669a82698205a6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823617, "uuid": "f1c0396d-83ce-400a-b6c0-0f47882b177c", "value": "T1D374AF50FB8421960B83239BED5351C2EA7DD00153842165ED9FA36C6B479ECC37ABBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823617, "uuid": "70bed720-5ab6-46b5-b80e-a7b23f2e6222", "value": "6144:0Xt/0DDNoHfVF/4e9caQfMnpkyffmxV4VJBUEoHpmd0S5M:0Xt8DDM/m4gV4CETlC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630823617, "uuid": "74bb5768-727f-4577-bb60-316978b2e696", "value": 353202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630823617, "uuid": "30e03882-5028-4de0-909c-cc8108e63ad5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630823617, "uuid": "126e99e1-0d63-4ef7-8b43-81fcce63c3ec", "value": "9887.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c5493c8-0e1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630826745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826745, "uuid": "2ec4cae5-7f7b-4ace-be7f-705d9cb18402", "comment": "Malware payload (Buran)", "value": "39b43992fe2c3345ab730e994586181d", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826745, "uuid": "d47c0f69-11a3-4a86-90bd-18e02cb6fee6", "comment": "Malware payload (Buran)", "value": "f071ff62cc2b4a50730f415c743a3e5133ab683a34181736baf9a769a8b90eff", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826745, "uuid": "91da6d86-31f8-4888-bf7d-050d10bc3bdc", "comment": "Malware payload (Buran)", "value": "499c16fa116603799ef2fcf77d7401450b023ade", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826745, "uuid": "5604cbbd-74ef-4076-a66a-d81e648c3480", "comment": "Malware payload (Buran)", "value": "0c61d6b02c8628521e506b3184ab299a07eef73638df5731ef0ec99b39585f4213501c7375c71a0a74c7ad2522538a52", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826745, "uuid": "e186a1e0-9edf-498e-ba9d-1536b94817f7", "value": "T14194B050EB4820961A83635BED5351D2FA3DD10153402268E99FA36C6B875ECC37EFBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826745, "uuid": "e83ea4cc-5464-4caf-93e4-64fcfce47fff", "value": "12288:0Xt8DeFQ0x2Ola4ZZXhDzabo+6jzh2PO9a:0X2d0xFa+ZXhD0qjzh4OQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826745, "uuid": "eaa62fc0-a04d-43c9-9895-64e3acc3bb77", "value": 441887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826745, "uuid": "d874aefb-5393-4ec7-ab7d-c27f587722e9", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826745, "uuid": "dc94c7a0-11f8-494b-925c-6ce232f72a88", "value": "7012.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a180245-0e32-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630836942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836942, "uuid": "35f78c1e-3d9f-4298-9a19-96fdec3300de", "comment": "Malware payload", "value": "ab554a6a408e86cc9a0332dc9eecc186", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836942, "uuid": "f0a41db6-7f5d-413b-830e-3bd01d8d813f", "comment": "Malware payload", "value": "f09cf54f58a869d12b74f761fcdd1436446a90ccbc43625b93bf9e0699e27277", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836942, "uuid": "0846506c-aa91-4746-9105-27948b56b700", "comment": "Malware payload", "value": "359ef8e532b18950e80ffd686563099be4da5e5b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836942, "uuid": "60a87f84-58f2-488a-9a73-773c81a62a00", "comment": "Malware payload", "value": "70214c4dffaac18dc23b231a1d033d2af0742fbec6b2822b5fc995dc3a2de2782ee08bb1b453d096814e41c674521ce2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836942, "uuid": "692f3245-2be8-4939-b43a-37a8a243d019", "value": "T1E7347C107592C436E8B344324DF9867BA539BC310B1996EBA3D80F1E4FB95E17A31B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836942, "uuid": "4ed1a19b-963b-4d62-b3f5-9e17279de026", "value": "4bf525a95c960651ee1903cac916a093", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836942, "uuid": "570bf748-9f17-45bc-8ef1-1d99f57b660e", "value": "6144:4HzaISCTsSeBSBGIrJC5242YIeAOzLwxdV:4HzaIfTISfNC0TY/xUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630836942, "uuid": "f2e0a200-902c-4858-b18a-fad148af60fd", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630836942, "uuid": "1640b1ca-630f-40fd-a317-2a5f2e6e971b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836942, "uuid": "fb185afe-7452-46aa-b658-c78a566719c8", "value": "ab554a6a408e86cc9a0332dc9eecc186", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ad5162-0e8e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1630876660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876660, "uuid": "fc81991c-4760-4e51-9389-237eda948f1c", "comment": "Malware payload (Smoke Loader)", "value": "a4260865f8b771e8e487528f489bd465", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876660, "uuid": "3fe67771-4cb7-46c4-9592-5633e5bd1e5b", "comment": "Malware payload (Smoke Loader)", "value": "f0dbfab521e4449004579db807d59bb7341925abb6d96f8af77324a7e436c764", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876660, "uuid": "ded18abf-565f-4fca-b3bf-63fd89e36107", "comment": "Malware payload (Smoke Loader)", "value": "f91229a613699042ab7f17aafa55a29db11fe2ad", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876660, "uuid": "247ffcee-db51-40b1-9c9e-157ec5043ae3", "comment": "Malware payload (Smoke Loader)", "value": "b93e21f830b031ea75cf5a871f3300e07b58cd26afdd6ca151770bdd80d0462fe19897224a20c642163a2d0b191cc5b5", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876660, "uuid": "baea8511-fb11-4033-a17e-8c79540db867", "value": "T1C134AD5A7E90E433D2D1C5305525CBF4DE3EBCB61A20456B3748FB6F2E706A09A2E352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876660, "uuid": "a3fbaf66-0188-41a8-9e00-4d2b20ffa680", "value": "5107fa4193c2849c77704d8870503de7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876660, "uuid": "fb47e893-1d4e-4bfa-b7d3-ab6dbd8660b6", "value": "3072:4Komfmc5ZviFuHT66UYxYrF7UM5Y683Tm7uySP3/sj9JP/WpokHHx4bBvHOf:4Ko2mc6sHzxYrFCDauBsj9JP/W/WBfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630876660, "uuid": "7236a5ff-e6c7-4f92-af8c-22194999c081", "value": 248832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630876660, "uuid": "969ae58e-ce5e-4543-9d56-c8d58f732ef9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876660, "uuid": "b1163aaa-0e5c-49b3-8de5-83cc99e4e8d8", "value": "a4260865f8b771e8e487528f489bd465.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aa4aefb-0e30-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DiamondFox)", "timestamp": 1630836057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836057, "uuid": "c7ff297a-ec56-4ee4-981d-655c324790b2", "comment": "Malware payload (DiamondFox)", "value": "0a313a73aac1905c6ef571c4e700554a", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836057, "uuid": "963d0e17-ab9b-4894-a847-1bffc81ca9b5", "comment": "Malware payload (DiamondFox)", "value": "f25e4213555bb2e557f66fb99d91a03972c1882ca8c2ac8748e25fc09798e2be", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836057, "uuid": "2f8a1673-a0e5-4f7a-9dd1-1d2c8a833b99", "comment": "Malware payload (DiamondFox)", "value": "7f2e2d4656ae4a5e6015c51184e19ef26510fb12", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836057, "uuid": "7f9b3cdd-d347-4e32-96a4-d4d2da0682cf", "comment": "Malware payload (DiamondFox)", "value": "b90a706ba99d7626b2f0635b61d6fbc3d9734bbe81f854c1cbc8109adea5b346650e399abb616c40a5f32931e32a4a06", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836057, "uuid": "0f55d079-b826-4c36-aac2-3051d399ff55", "value": "T17D4633223DF20D31CC590171A2E93FF7A2F9CFA8AB1514C7AF51635E97B89D0801AE91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836057, "uuid": "df3f2ed5-237f-4d30-9c05-8e0504f35985", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836057, "uuid": "87344ec2-6e8e-4bbd-8b5a-2834aa4cfc04", "value": "98304:xorRBQQyUroZi+nTf55/2UJ70UsjVk+io3McLpN3SQXB/uz7h4sWsjFe5qx:xorR3rETfjB70Ush9io3MeDOl4sW8+qx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630836057, "uuid": "dffaab85-5f50-4f44-a140-388f35fd8494", "value": 5802713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630836057, "uuid": "cc1e3308-e40b-490f-b2bf-914778d1b504", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836057, "uuid": "878e39db-1359-4e0c-9bfe-32c18be4bf34", "value": "0A313A73AAC1905C6EF571C4E700554A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecdb79a9-0e64-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1630858717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630858717, "uuid": "e8336377-55d8-4046-9db7-f7ba54ffa283", "comment": "Malware payload (CoinMiner)", "value": "d59962806fcf8c3ed228654da0b964da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630858717, "uuid": "a1f348d3-253f-4b6a-9b5b-4cc47b09e061", "comment": "Malware payload (CoinMiner)", "value": "f29908da1b8065356704e746f9e282378a7e5ae65c753e2e9fe02b214b5b792b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630858717, "uuid": "35c27a96-772c-4952-a85e-a3f844bfc49b", "comment": "Malware payload (CoinMiner)", "value": "0373488126b5f13c8fd60ee37b81624568490db0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630858717, "uuid": "67ac4f1f-917a-433f-971f-bd3a74ebb90c", "comment": "Malware payload (CoinMiner)", "value": "19a8cfa320626c33fdc77ec0aeed3b48f1b2f5cfef15b30a253168ce6d0dd4ee01de6157cdfc07c35e3c0ab46e3f5004", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630858717, "uuid": "1ba894b8-a475-4cea-a660-4d41f8e75990", "value": "T19882844277F84225F5FFDBB86DF215508877FEAA5B31D96D1898000D0A33B908AA1F76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630858717, "uuid": "ad8a638f-d83c-4504-8695-6580bbf44fa1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630858717, "uuid": "e0469796-8739-41dd-b371-fd93ef45a69f", "value": "384:80CzyqvxQ/DgwnTPb7Sa2l7Z0z3MyWbrflZQqwI30gRwd:vCzyqvxQ/DgwnTPboq2rfl6qwI3002", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630858717, "uuid": "d8e1e67c-9f26-4334-a8c1-471a9fef2610", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630858717, "uuid": "f9358c34-a474-4969-aff8-4a3b17801de8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630858717, "uuid": "65f9e531-0bdc-4776-9bfa-d5bf381e8490", "value": "d59962806fcf8c3ed228654da0b964da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd4b93c1-0e8e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1630876783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876783, "uuid": "d216f0ae-fa90-4dc3-b7fb-dae484684bfc", "comment": "Malware payload (ArkeiStealer)", "value": "e82112809c0043643842b3b712d2faf2", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876783, "uuid": "d5793410-44ac-4d0e-ad96-40581f261738", "comment": "Malware payload (ArkeiStealer)", "value": "f3aca29ebe030327614bd9490d21337a76c99fc690da96143c778e949b4f3014", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876783, "uuid": "3193d688-55b7-4a65-b880-c87efcf1fd92", "comment": "Malware payload (ArkeiStealer)", "value": "7c02bcf16e1a0eaafa0297d0fd4cbdcc9c385e62", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630876783, "uuid": "60129c0b-2dc6-4c86-81b1-6eb1af2bf66e", "comment": "Malware payload (ArkeiStealer)", "value": "22687b769050abbeb2cbb53166cb74d2a62ba949e06c6cb9cae138494c0bbf13113733975d26f0c65015abe33586f6cd", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876783, "uuid": "3c02906a-56ee-4a08-84a2-9fb99ceb4d49", "value": "T181E40202B1C1E427E5D209349535C6F16EFEBC712F64884BB39CEB6B2EB42809E25757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876783, "uuid": "e7f02efd-5f7a-4f83-b3fe-2d6868f72405", "value": "a5091bd61667ae52b24f539467c52b28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876783, "uuid": "de9c7154-e50e-4fbe-a336-6cdc19582954", "value": "12288:MObbk3N+5j5YaKHjySPAOts0wckuZOnHxWbKDH:dbgd+5jwDvh7jMnHxqK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630876783, "uuid": "69373a5c-a5ab-4f8e-aabb-00fae0b79d69", "value": 695296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630876783, "uuid": "c0f517ac-284c-45a7-a122-b5a6dcd725ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630876783, "uuid": "6c5352e9-0567-442d-b95d-c663f22d2d7d", "value": "e82112809c0043643842b3b712d2faf2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f01a34-0e19-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630826300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826300, "uuid": "969bf05b-47e7-4319-90d6-0d9c59dc4d1d", "comment": "Malware payload", "value": "14a8e3066cc20cebfa136c93b66ecea8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826300, "uuid": "715bc162-9177-4d45-ad2f-06db84c5f3ed", "comment": "Malware payload", "value": "f4c8fd711d05c6ec386c079668d8d79517bf8c22710fb86c6d70b87b186a1ba3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826300, "uuid": "285f1c94-3bf8-45d7-9492-d38095bfe814", "comment": "Malware payload", "value": "cdab772efdb8a34399a0ea97fc9191a76bebd438", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826300, "uuid": "4aaf51e4-81f1-4b45-b64a-20899b5ebf76", "comment": "Malware payload", "value": "a8e37609b4c078d4fe9e7b826743d46ebaa387e2a5e2f0c3545f1721a77da7b7cea7897266b369754ad33015a81e4871", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826300, "uuid": "eadbc33e-c201-4bc7-b4aa-b3e4c0676c13", "value": "T17C44232634BB984324AD552B5B3F936E0CCE84B61370BFB5E85366B29CD4F13BD11622", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826300, "uuid": "c207e8ab-84dd-4f70-9dfb-83407e8e2d2e", "value": "6144:5fqEsq9UxMsJNZuKwnd2JGSENCuRpMKRm8aioy:KTZuK+/1dpMpnJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826300, "uuid": "ca277031-0ee4-421a-bf66-e40fdc46b709", "value": 270862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826300, "uuid": "aa7ae824-d4c6-49d2-b844-b1adb4752d12", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826300, "uuid": "7ca45b87-d6d4-4956-ac0e-f3931c0dea7e", "value": "553.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0deb7cf2-0e33-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630837298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837298, "uuid": "0ec6b74d-0ea9-449d-ba1d-c9504e68df14", "comment": "Malware payload", "value": "77818cc798ad398f938d5d394cd7f24c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837298, "uuid": "6324ae09-f4c0-42c1-80b8-f80db9e02aed", "comment": "Malware payload", "value": "f530dd1af6ff49f6f55b1b69b1ccaacf6d5daab580f30df74ffe076ce6412e18", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837298, "uuid": "f289e4a4-6bb9-4327-a2a5-f4b3a6e54c20", "comment": "Malware payload", "value": "30392be809b73cf966816baba173e69b18aac5c4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837298, "uuid": "1e084e41-cbb5-4eff-b577-fc003ea5013d", "comment": "Malware payload", "value": "46ca84357fb13fbc0b35127d78fb3020b96a662b57c47c980e7dc8d50e29ff1cb711c1b71f4f586935adf9cc1c693b33", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837298, "uuid": "50769c74-2c11-432d-abc0-3d95457dc8e5", "value": "T19F442388E23DAD628DB07039A17A7F9EB9E0D318748D954CC5DF8B887075C2792D82DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837298, "uuid": "2d55fed7-8965-4d88-a28c-5a01982f779a", "value": "6144:w+pRUCmpj1EvUzNEdxTA5uZcy3DGNA1JA6+k3Tiq3Gw/:wWUd+UZx5qEA1JA3k3TikP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837298, "uuid": "72e96369-f17f-41f4-892e-8f3f2365a206", "value": 265624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837298, "uuid": "71c797cf-3c7d-49af-956d-5979c185644b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837298, "uuid": "fa0153f1-2b5b-4d98-9e3e-b87afd27a8d5", "value": "5445.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a14488-0e32-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1630837237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837237, "uuid": "0079bb86-8870-4a4b-bd51-77fa1c239d81", "comment": "Malware payload (Gozi)", "value": "263c90613a5c0421b8ef4aea302142a6", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837237, "uuid": "31443ca6-777c-4ef6-baac-688395822116", "comment": "Malware payload (Gozi)", "value": "f552614a15e64db3705f879073501a9c188d1558ea2e7500dfe47db20af3b640", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837237, "uuid": "8f552195-9dbe-4a59-88af-458e3a5d7007", "comment": "Malware payload (Gozi)", "value": "ac888d70788b83ae9732e8e13f3391aaf287b0f4", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837237, "uuid": "371d85b3-e57f-48f0-bfa6-f801b7018cfb", "comment": "Malware payload (Gozi)", "value": "3dbb061780e0c617f8c359ded549cdf0819425f5812b4d57a48c505bc4c1b5b5c43fb419141a7ff03441b98ec89ca8d2", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837237, "uuid": "9ef9e8f4-5750-4710-9527-1ab44676be62", "value": "T1A874BF50FB8420660ED3539B9D1662E2FA3CD001971011A9E89DA39C6B475FCC3BEB7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837237, "uuid": "a3ffa5f2-e281-474b-a97a-e25bb48ca7c5", "value": "6144:0kOBFat5zQP5XlmPnYdDMyd0qo3hD8VTkPtvcZn31NX7SEmWtgaJVD7vFNZFbfi8:0kOBXgPngd0j1wp3PfmW/vzFNZNf7r4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837237, "uuid": "e1fbcb4e-ed6b-4979-b3b6-db0880a99bfa", "value": 357292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837237, "uuid": "2b223c81-0884-4ba8-9c22-c1e5dea7b3ec", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837237, "uuid": "588b4a2e-510d-48ba-9e3b-a22287294907", "value": "4618.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c309661-0e2f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1630835604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835604, "uuid": "3b9737a4-8aac-4aad-abf3-412229655daf", "comment": "Malware payload (SnakeKeylogger)", "value": "97bb3637455fd6f239996e75a1b61203", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835604, "uuid": "a1ab70ac-890e-48eb-bb53-9f89cd165e39", "comment": "Malware payload (SnakeKeylogger)", "value": "f622197e9e3134791d93d78f9d4996408169b5d88c9cacd783085301ebfd1529", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835604, "uuid": "5fbec50d-175f-4f3d-b2d2-c1a480afa850", "comment": "Malware payload (SnakeKeylogger)", "value": "032f48aa9b36b7476df1e8bab9bbabacd8bf71a7", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630835604, "uuid": "64073ce0-65ec-442c-8e79-99d0bbe233e8", "comment": "Malware payload (SnakeKeylogger)", "value": "6ed1066688af9c262d470d3b8333f41e0a4abcfec98867b88f3a08649bbc45fb949777ecc4bc9ec9f26707ad0c3d891e", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835604, "uuid": "f343a6ff-ed2a-47f3-a724-1d64d458a101", "value": "T1E7E3124E60E214D973EE337326AAD49F6C70EB4447923B3E5C6C50A8A52E71B923717C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835604, "uuid": "bd458a94-2227-4b97-8842-97ab9020ed9d", "value": "3072:i71H3WwZkKYCn12kDjVqiN8O8m38imI4bgNlYB82vq6Pv5jxxHXr:i7R3/ZDT12kNaRaJH/2S65x5Xr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630835604, "uuid": "04f36e3d-74b5-4117-9a21-1c37fedaca59", "value": 154630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630835604, "uuid": "e9c0d0fb-83b3-453f-8a08-9b2943fbec5d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630835604, "uuid": "f02fdb9c-a138-4c4e-892e-537345ee38bf", "value": "987654222.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde899f4-0e79-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630867658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630867658, "uuid": "2c3d7aa3-2817-461a-b31f-a699d6adb734", "comment": "Malware payload", "value": "bbabd33946df44bdde69dd8725796e5d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630867658, "uuid": "1e8dc15e-ca79-45bb-adea-def8248dea07", "comment": "Malware payload", "value": "f6a2e871d95220ee502443d38adfcc3fb4fc386973e3339b4a27c154e423dc87", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630867658, "uuid": "22231b01-1bb4-4857-b298-cd764b182eff", "comment": "Malware payload", "value": "04bb6456c83055d848ea95f6666ee91aa6f32a0d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630867658, "uuid": "a9c9abaf-ef9b-437e-b7df-e085bc823ca2", "comment": "Malware payload", "value": "dfed6276766d8334b419288d89d9bf4dc44e96a0cbcc1e28858e74769564b5f950e56ccb3fb814792db96cf2c4bdd91e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630867658, "uuid": "7e6123e4-8ca0-4e65-b2fd-198660c3f86d", "value": "T14D742356FDDC8041411E2A67B1D6A7CB29356AA10FEEF6FF3C21C23B255C6268C6C4B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630867658, "uuid": "6a009282-c110-47e0-a85b-af24d660e95f", "value": "6144:mE1qrBsdeO7Rt7spr1avwn2mynAENZND+7S6lGCl3ui1YELDSJjGjUifFVZhBKpW:9IBsdeY+r0v62nnAo6Dui1xPyGjUajhp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630867658, "uuid": "aad4f7ac-077a-4ff5-a070-3575dcd1336a", "value": 370744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630867658, "uuid": "b4488797-421f-4acb-a3a5-34a11f3c9471", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630867658, "uuid": "2dc292c2-fecf-4496-a862-61fc2536d976", "value": "Inv # KEX299.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcaacc73-0e19-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630826424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826424, "uuid": "dfe92456-36c0-4cde-a4e0-8612a7cc0c8b", "comment": "Malware payload (Buran)", "value": "61cb87814c961bdbf33855f26183fb52", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826424, "uuid": "0077dcad-9dea-4595-aa7e-2796241910e4", "comment": "Malware payload (Buran)", "value": "f6a96dfd345da4ed21cf474290046c3724e744a4d81ff9df9c0093fd6127ee53", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826424, "uuid": "63ea704f-1c66-44d8-8f14-fff650c5775b", "comment": "Malware payload (Buran)", "value": "d99ed73d4f034110ea7ad3da2c0f2128dd30222c", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826424, "uuid": "e8acb19c-4fd1-4de1-a7f9-981ce7e381a6", "comment": "Malware payload (Buran)", "value": "e56e0d4a6b4fbfa1e1ea6c8b3cd37167e59d5e3ca5237778b8581f0e59893cbd11ab47ade69c032773c0bbca3774dba5", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826424, "uuid": "d34ef707-705f-4ad7-83f9-beb8833e72d9", "value": "T11E1423DB2AEDF97506D2143D1606EB9C994B4C36ADE847F4E023787CA285643B3819F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826424, "uuid": "d97e00c4-f798-400d-bcf5-616b9eff160f", "value": "6144:sQRv9ve+owX5HAiQOHLstYI9ahqnlb6FPtyJGMO3jYNv7pT1:Pv1e9wX5HAixHLUb9ahqnlbW1ZjYNv77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826424, "uuid": "f0955c02-d580-4a9d-b594-5c33cea244cb", "value": 208521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826424, "uuid": "2d55c887-2fb1-44e4-b31c-d54bc03bee18", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826424, "uuid": "ec3ed0b4-4b39-4668-8184-f62adc1c2a8c", "value": "1840.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69e70299-0e19-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630826285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826285, "uuid": "fcca0f00-9b77-4175-bd9d-376b7c3f3b91", "comment": "Malware payload (Buran)", "value": "177ccfc8eb30a1859bde0acee29a9c9d", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826285, "uuid": "84f92040-2da2-402b-be04-6614b773049a", "comment": "Malware payload (Buran)", "value": "f72b217b855362becc6035267f70bbdacad7e1afc9017f63143242284ed8860e", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826285, "uuid": "0b15d1ea-3d76-4d54-8b74-96f7ae948328", "comment": "Malware payload (Buran)", "value": "9a61c1f402f43b3be9c002d00663a5ec003e69c7", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826285, "uuid": "07e20461-bf12-4a5c-ad3d-642e2f4ac407", "comment": "Malware payload (Buran)", "value": "4f70ee006bc83aba0a8edcb52a8a41825eecd7b566a7ed7ada721d6a2954a2592e59cb034e4e53cc4da2cf8d363e76fc", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826285, "uuid": "111a4509-ebc1-4088-b751-435527539836", "value": "T1E905BF50EB4411660EC3635BAD5312D2AA3DC11153402168E99F93AC6B879ECD3BFFBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826285, "uuid": "eba4c7b2-1451-4141-ae76-93dc3667ab9f", "value": "12288:V6zmCoq89+MxH1bZjpJ62Xt8DKE0RhTVbZ3+4+y2MxRLPze9quc+0akaNxM:V6zn89+QHnpHX2YTVF3HxRze9qaC0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826285, "uuid": "3c56886c-c5a8-4bf2-9d52-1fbfb4b08f51", "value": 835762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826285, "uuid": "b70dbd06-cf7d-4968-977f-bf5cb773e273", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826285, "uuid": "d801f088-2a22-4136-9485-2c2638f3e628", "value": "5565.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66cad484-0e1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Buran)", "timestamp": 1630826709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826709, "uuid": "4a19f566-11a4-470d-b38a-c30804f72adc", "comment": "Malware payload (Buran)", "value": "e6ff9c4a3aa594840c26a4ffa395ba4a", "object_relation": "md5", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826709, "uuid": "7a57548c-c9b0-4a53-8c2e-8e8292c7205e", "comment": "Malware payload (Buran)", "value": "f77ffb0e8384db2bdd4f23f72a3f3fe9a6fda0ba30446747060a5a3b3828c3cd", "object_relation": "sha256", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826709, "uuid": "33945451-426e-4b57-b67b-a475ab1925f4", "comment": "Malware payload (Buran)", "value": "d16623e93fdd7d8e78c0ef12e3ffa755bbb83059", "object_relation": "sha1", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826709, "uuid": "8126d5a0-bad3-40d0-a0fe-d6c96625d069", "comment": "Malware payload (Buran)", "value": "f8f20771e245b0651ece9e50ff7afc899865c0f56b1714b772caf9134133f9ccf0e4e3ce908b68b0c8f2aa2c9166aa2f", "object_relation": "sha3-384", "Tag": [ { "name": "buran", "colour": "#E4E0C5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Ransomware.Buran", "colour": "#E6B9B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826709, "uuid": "a5dd2398-3aed-4984-838a-75695654d75c", "value": "T1B294BF50FB8421960A83539BED5311C2EA7DD10153802168E99F93AC6B479ECD37FBBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826709, "uuid": "5944ffc3-2c64-4310-af43-ce8ccf6705cd", "value": "6144:CGmggnxJopkHFesB9M6IMdM6bAEuB9IXPgJ2dOvLI1cy+b6JfqAXvncOboZkbkyd:0xtdbQ2dOvLLZb6VGwbkVXt8D9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826709, "uuid": "d970092f-0ce3-467e-8031-a4145941185a", "value": 424666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826709, "uuid": "b614fb43-081a-4b88-82be-33b2d3b26ff7", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826709, "uuid": "08733702-4cb1-402a-9374-2c15b1070739", "value": "9471.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d30f85ad-0e1a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630826891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826891, "uuid": "3cd1e69b-6ffc-48f5-87cf-c7c10cf370ee", "comment": "Malware payload", "value": "2836ec1ce9392d2e492cc8812122be04", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826891, "uuid": "9533011e-9627-42b2-b095-610f0073b02c", "comment": "Malware payload", "value": "f7ae29639dc2d523b5d020810c69d5511632b55cbb3332ebdca7c0eb6795a0c0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826891, "uuid": "fdac7209-4a7a-409b-8ee7-93424b0181c0", "comment": "Malware payload", "value": "4ea16919e9f47ac170860b18d0cd1813a3c3118f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630826891, "uuid": "ad5b96ec-889b-4420-b606-45e592a4adfb", "comment": "Malware payload", "value": "67f442f85e1f41e61c1f7157f2ac174763e0010d772c286d5086535688d27acfb55ec3e14792bd9cf6ca2e2dc3312021", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826891, "uuid": "0d6ff261-6633-4cfa-bdad-49f4ae9f2db5", "value": "T120C312475FBC082EFDF8100DBE74FC970DA199BBA33266565B1409BCC29A24953A432F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826891, "uuid": "c05fa268-9cc2-4cb8-bf39-89d45135d3f5", "value": "3072:FO+2+FYD4tIRQB9rQBn5aQfz732PMRCxaBsEk:J2+F04GEhan5lX3bRCIA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630826891, "uuid": "e25b2908-aa3a-4122-aed0-ae203ab68471", "value": 128723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630826891, "uuid": "43177f34-970d-4379-ae38-104ce78b827c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630826891, "uuid": "ce55108c-5c71-4809-b41b-a14585126952", "value": "3259.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad82997-0e6b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630861586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630861586, "uuid": "6dd4207c-b1fa-4413-b95f-5141e87fccba", "comment": "Malware payload (RaccoonStealer)", "value": "b87e18eb14782873673fc60499c49cdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630861586, "uuid": "4171fd64-5db5-4a85-9625-e84962147fc2", "comment": "Malware payload (RaccoonStealer)", "value": "f7f9f844ab0daca30003a7da79baaf17c9ab7041903a6453a6eab565f3337566", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630861586, "uuid": "e341137f-60e3-442b-aff1-732b487e2062", "comment": "Malware payload (RaccoonStealer)", "value": "0749ae906c70d42e411f77c862b81a27e138d246", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630861586, "uuid": "12307729-e44e-48a1-abce-a9da4da5ba61", "comment": "Malware payload (RaccoonStealer)", "value": "a0126afc7fcba90562d0b7a7c4ca5b6d2f9cdc1d811cbfecc396580c8ed99e34cfcc57b169b9555e9c1880ef57897776", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630861586, "uuid": "691c353e-afdf-4168-8d36-8fe1bf6dab20", "value": "T1F2B4D030AB90C035E4B716F456BB833CA5297AB16B3490CF62D52AEA0B346F5ED31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630861586, "uuid": "f31a82bf-24c7-4b1f-b99a-4cb67b43bd31", "value": "a3712f5292e4f38ef3a6c28b5ac50fb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630861586, "uuid": "d77b8b37-1a5c-4eb6-bf7e-0456a8048557", "value": "12288:tMo71veWAFrDy9hTgZbEGDnRtQbs2qit3FCIEaoh9CU:LRercTsIUn/YD3QIMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630861586, "uuid": "a9f1a4d0-aba3-47bb-9d36-890c24b788d4", "value": 534016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630861586, "uuid": "6efdb850-cf88-41ce-bfdc-05687856901d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630861586, "uuid": "cdee2680-244e-4aab-be65-db13748976f3", "value": "B87E18EB14782873673FC60499C49CDB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d74532-0e32-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Tofsee)", "timestamp": 1630836965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836965, "uuid": "1d79debe-15a9-4f41-84c1-afc566410799", "comment": "Malware payload (Tofsee)", "value": "ecc5ff5ec4263a4df13ff7cc23dfaec0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836965, "uuid": "dba26e6e-0eeb-44b6-86f4-d7539bfbdf81", "comment": "Malware payload (Tofsee)", "value": "f9f5a7a48d22604b9321d8a752bf609f4bc64edb75f71b4fd47e9f32594f85b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836965, "uuid": "155d703f-4636-4de3-af55-2e40bcc5c485", "comment": "Malware payload (Tofsee)", "value": "8948f0fbdb570fa2d6c374d10584aadb67c17642", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630836965, "uuid": "9d4e7b55-2ec4-4cf0-bd27-c19805aa3df1", "comment": "Malware payload (Tofsee)", "value": "701566fd81ce21d75c31339e69c7c32b8e2d21636718bf999915120c5ff11bca21a1a35d4c58b814ddb79c04951d4632", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836965, "uuid": "0da146d1-ff53-4c0c-9964-8dcf4504808f", "value": "T18A348C997E80E933D5A5C3704425CBB4DE3DBC769A6444777328FA6B2E202C0562E37E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836965, "uuid": "0b2131a0-87d9-4ccc-a038-22e631b07060", "value": "9258099a7e5adb7f2e1fdf3536b86000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836965, "uuid": "813ccc2f-6265-4498-b802-19a8548509d3", "value": "3072:eWvzL+v7xV8bZKfYJTXR726V52Jl683Tm7uySP3/sj9i9+tJvmHXQHHx4bBvHO3:eSLCD8bfdhq1DauBsj9c+vaoWBfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630836965, "uuid": "979dc66f-a19e-4f47-b95d-a9831417e783", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630836965, "uuid": "d19442ce-349f-4efc-88fe-1362f02f0f62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630836965, "uuid": "0b265263-7b7e-46cc-a8ea-52556053998f", "value": "ecc5ff5ec4263a4df13ff7cc23dfaec0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05c271b2-0e56-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630852316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630852316, "uuid": "1024aea9-c10c-4c9a-bc6c-b3fa4d73f7f0", "comment": "Malware payload (Mirai)", "value": "090e08f77217776fcdf8d130ee87bd3f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630852316, "uuid": "e4de8ca0-de02-45a4-bdd1-f67705f9ea46", "comment": "Malware payload (Mirai)", "value": "fa0aacca0db6c8fe486fbf571d8b96e40920d494c94b2d30edfc91d476ac416b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630852316, "uuid": "ae5cdaae-5742-4903-aaa1-6bff9badfb68", "comment": "Malware payload (Mirai)", "value": "2565680baf2a626a068c9fd1ebabb7db513b88d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630852316, "uuid": "a52f2812-3a90-4882-a349-f0095152d3d0", "comment": "Malware payload (Mirai)", "value": "6b0fc4fc79d05db9b76104958a27f408f54cde69c33e7e474f042970000a6f160b73c2a14a1bbacd04bd3c455e831493", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630852316, "uuid": "90542e09-0b10-4524-bf50-f24ac9641e51", "value": "T1E793C506BF250FB7D85BDD3706A91B06288C510B65EA7B767E30C558FA4B20B29E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630852316, "uuid": "13c76ff5-6043-47be-9dbb-8716b08a4654", "value": "1536:1/jBR9We2WU33I8ZZwIzQNPkVAYYlNnFUdZCI7v:1/jBR9b2WUHsdUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630852316, "uuid": "d5ee64c2-d171-4595-a6ac-292e14e4a15e", "value": 89872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630852316, "uuid": "ba6ff834-3cc9-498f-b10a-a64a079a037a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630852316, "uuid": "94cec57d-beb4-4f0b-90fa-45d94e959652", "value": "090e08f77217776fcdf8d130ee87bd3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "739c1ce4-0e0b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1630820288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820288, "uuid": "5d75b009-4e5b-4dff-b9cf-001f824f57ae", "comment": "Malware payload (NanoCore)", "value": "41fff60bafd617b0448836726073646a", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820288, "uuid": "1caf50d4-99c5-44c0-aa25-aa579b08c268", "comment": "Malware payload (NanoCore)", "value": "fc45df143d60a8b86e47284428c075d79368705ca6849c2398a748f8ca150977", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820288, "uuid": "75cf8a83-f707-4762-b18b-8bd8c4f7c58d", "comment": "Malware payload (NanoCore)", "value": "f6ac0b3f0aace5fab649af833465a4980c3410fe", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820288, "uuid": "15c581e6-3b1e-4471-afca-92ffbbfaf472", "comment": "Malware payload (NanoCore)", "value": "07a1b3681612fb3f33faff63937b600d3af59133002bac07e69dbb62a4aefd271ae179f0da00e4f11b3287d19dd5d40c", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630820288, "uuid": "1501a342-5703-48bc-903c-78c3757a338a", "value": "T1A9B423A55B62CE045BA94B3A3ACB62D5E6B5AF4F12350C1C96D7EDFA158233EC3003D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630820288, "uuid": "3d119c0a-6ebf-44d4-8e22-e6d5e0e8352e", "value": "12288:lHij/F4vr50K+VoqFvs8Kk9aCE2NzLK9K:sTF4vttMoKvx9/rNzLK9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630820288, "uuid": "79b4d1ef-fef2-4c20-9739-b4eeb0482f39", "value": 497993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630820288, "uuid": "3be06b64-0b2c-44b9-9e20-a2fe3c0675d2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630820288, "uuid": "877ac34b-67cd-4e26-bc48-a4a69c5264fd", "value": "RFQ.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac2fc697-0e32-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630837134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837134, "uuid": "0ec9731f-d5df-4a93-b7cd-7e117228a016", "comment": "Malware payload", "value": "ffd7f09183a1e87c84d30eb70c77bdff", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837134, "uuid": "2ece8743-4f3f-4de0-acdb-2210c443956d", "comment": "Malware payload", "value": "fd353892c85f1d461226b252039da3a5e97eb45f92452725e3f0969573ace8f5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837134, "uuid": "44f26bbd-13c1-41b7-a7ef-3524251db1b7", "comment": "Malware payload", "value": "6bdfc0843dbd75726f426292fc4e1b921e7c6d94", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630837134, "uuid": "323224c4-bd87-4f3a-9879-ddaddd566ba2", "comment": "Malware payload", "value": "8ea25f0a625eb0c0fc64cb73b5c842328a35df0e1f22a87d2440b96a6d3b27ec4d99d0d0bd64ca227ac8ccd906d497b9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837134, "uuid": "59f63c08-76aa-478d-90dc-b83f9c6d10b9", "value": "T1735423FCCFC5ACA4666896F3B4ACB56815F4682E84B15861C3756F42E23E10C3B370DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837134, "uuid": "01612098-2f22-43f8-858f-122f0ef23fa2", "value": "6144:Z8dfUjnXInFAd3llm3WWF5olz4jqRAj4abWpwXajlAbnawNr6T:SAXo4lm34lzU3LXaZAnh6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630837134, "uuid": "11082fd1-2098-46bb-a798-1f0c50ea6bfa", "value": 298450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630837134, "uuid": "c8050ceb-9e94-436e-b464-d17c3dce3d5a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630837134, "uuid": "e078c041-53c3-4a95-9a01-dd22abdb75c9", "value": "4097.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff56f809-0e0a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630820093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820093, "uuid": "7c56ec15-4fb2-48d9-b971-8560919e3f51", "comment": "Malware payload", "value": "24ca5a98aa19ea161fc9e5b91097471c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820093, "uuid": "6907d39f-d394-4f6a-b085-60252fa1a2b9", "comment": "Malware payload", "value": "fd7f8fdf60392b1927c3ba57ecba8486eb05300eee706d62cbe12cad773ff127", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820093, "uuid": "0482ce81-24e0-44bc-92da-d2492f0a5343", "comment": "Malware payload", "value": "624fca1cf5d4cbea79fc923fdb0eaf3b04f3c39a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630820093, "uuid": "ffa85245-288b-4908-a5ac-72b1d2189e72", "comment": "Malware payload", "value": "2d804a4a0d3535b286eac698c152d78f940fbe5da83a9c0c0b139fca780e2a9508d3a14ce0efc0f71f4e79542f878757", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630820093, "uuid": "6794fe96-d886-4dab-ab3d-21530a10a30c", "value": "T182C533ECE58D31F2EA3167337E747CC10274FC455B7B7A68E80EA205186137AA25E47A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630820093, "uuid": "d6be393a-9736-49d9-b177-483ce7cfc90a", "value": "49152:7tzvYPhFaohJNg249LCt2now9kwYjxfj/d55bXy6Liwf6QIOc7KQ3C9AY7eTI:ZLYPhM3249+wnobwQx7/d5B7f6pehyLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630820093, "uuid": "76eac58a-1cfc-4cbe-ba24-183c068b2378", "value": 2647709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630820093, "uuid": "9a94494b-a2c7-4083-b054-473481897596", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630820093, "uuid": "84c0a6ad-49b6-4afd-a54a-ae1411817366", "value": "Impact of nutrition.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48b2dc9f-0df4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630810338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810338, "uuid": "e0a75363-da99-4684-9b16-059274a58075", "comment": "Malware payload (Mirai)", "value": "fee77e1c1db6f3d9769c3630fe35547e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810338, "uuid": "77c55858-0614-4f4f-b61f-02485c6abaf4", "comment": "Malware payload (Mirai)", "value": "fdaadc2c472e7f1694ad6af9fd6af6d0b5758037bf887f2b7afd89b585c0952c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810338, "uuid": "865b8664-3d20-4798-a470-8cee623bced2", "comment": "Malware payload (Mirai)", "value": "8b07222ea25b9e7cde118333ecfba493dd73acb6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630810338, "uuid": "6de4b169-d667-4e17-8255-a9bf0ed34ef4", "comment": "Malware payload (Mirai)", "value": "a30165aedde1dd912009d101e1ef10f0c0bede09bffd627f647c0a5b877f94610aad047ddcd4b26cd5a8d2dba9801743", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810338, "uuid": "bb77edfe-48d4-4c48-b4e8-15e22828660d", "value": "T11ED3F830E804472BC2D223F6E79E469E3F351E9B67D733115A3879B41FE27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810338, "uuid": "3ea5b65b-26b0-4589-9e78-6ac453fdba03", "value": "3072:Me0xkLg7LTa0UdveikRbzI7WDm7bh7QskmGfIKNb:4ra0yJkRb5m7bh7QskmGfIKNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630810338, "uuid": "735b653d-97ae-42a9-8220-d8bace330c71", "value": 133506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630810338, "uuid": "714975c6-3f95-4c59-9df9-ec4b5e9a146d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630810338, "uuid": "14f42ee6-8863-4407-a532-e65c4805c3f2", "value": "fee77e1c1db6f3d9769c3630fe35547e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "887e65aa-0e57-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630852965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630852965, "uuid": "89b0ef29-1b5f-4528-8a44-20a51f230a10", "comment": "Malware payload (Mirai)", "value": "f00d814c4ef80c09711510b3daa5e6ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630852965, "uuid": "111a4af4-42b6-45d7-86cf-1e6427f72421", "comment": "Malware payload (Mirai)", "value": "fdec4357596c12bbbbd1ff5d012245a65224b92ed0a590bdda4b02e127c4f2e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630852965, "uuid": "5ddaa42b-1076-4ca4-a1c2-7f4cb7abd1a0", "comment": "Malware payload (Mirai)", "value": "ea3ce1981f64fc97c98f590972cfda9c336a265e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630852965, "uuid": "0e52d6fc-a59d-4de9-b80c-7a3dbbb0a95b", "comment": "Malware payload (Mirai)", "value": "d407be61ca683ee420e8570dd8dbc90538a4f46c1563ad79665fd25ab314bc400269387e8579212c2701d60ac73e06ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630852965, "uuid": "7e61a3c0-d544-46e8-ad63-059e6abbab98", "value": "T179532AC4B952E4F6D801023C306AEB331E33F077A979D997D7A655736C42282F94B6AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630852965, "uuid": "3fc573ce-ebc8-445f-ba38-db5a87002b0b", "value": "1536:cAQBaouUPRE2ICehAiwEJagDYpLnXkS1coPcd/a4tTNwQcVskR:6Nu0RE2ICehAKJaeYp7XfSoP0/a4JqQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630852965, "uuid": "f797676a-a694-4589-9610-633172215c71", "value": 62256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630852965, "uuid": "0fd36ea4-9576-4b99-8029-5b0492c74ac4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630852965, "uuid": "ebed1f42-889b-4298-aa6d-322b601329eb", "value": "f00d814c4ef80c09711510b3daa5e6ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f4ff9a-0e10-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630822255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822255, "uuid": "ec0d054c-5715-4774-aeb3-2f475caa9d88", "comment": "Malware payload (Formbook)", "value": "2f201b7cf789a93301179862495f02f8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822255, "uuid": "7cec58cd-291e-4361-8137-6d93df5cb650", "comment": "Malware payload (Formbook)", "value": "fe0221ca8641da90e808fb7ccf857e40c3599ae442b57343279c43292176f694", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822255, "uuid": "bd2ca32d-ac91-4783-9a49-0ef841341bdd", "comment": "Malware payload (Formbook)", "value": "ade7ebf01478856125eb0c32bb1bf7fefdb2acff", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630822255, "uuid": "28089bd8-f659-4f74-a94c-8bb0961b9a0a", "comment": "Malware payload (Formbook)", "value": "fb753236a130d1fb25f8d84644326073099f8aea62503c4cd77b25012a1784ee672b5868ac99df96686c9999c8d48fa8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822255, "uuid": "5f1aa7fe-11c5-4ee4-8efb-f4a7747cb8fc", "value": "T1BCA4236514DD48E2E4731D192D3EFC59631A2FF48846AEDCFDE201B1CDB0E15A923EA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822255, "uuid": "da9d565b-6559-4fb6-9ab1-85754c66c67b", "value": "6144:DwH/8tplglsTPYyoCQ7IOslwhh6ParnvdlOxPx/OB3zkyG33tjAJSy8ck36j5gaq:K8/lGufZSJIxPEL65cgPmYFLGgD8SO2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630822255, "uuid": "6b12b363-9b64-4cfc-bcdd-a03945780bbe", "value": 470592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630822255, "uuid": "5ada9de7-3eee-4b9e-9573-226ee56533da", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630822255, "uuid": "0cf6983d-6077-4ead-85b5-080fbcdef820", "value": "Swift.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9017ae-0e47-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630845967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845967, "uuid": "b6bf5601-210f-4bc5-82db-cb1839662933", "comment": "Malware payload (RaccoonStealer)", "value": "0ea81d3eaeae4045c9f5a73db06d8af7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845967, "uuid": "c407a93d-ec98-4272-9302-2d5ffa5c9cf7", "comment": "Malware payload (RaccoonStealer)", "value": "fe256df07648006fc2e1385a2bdc66ab90c0e1e825fb8d8d3eed7d9bb3450b56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845967, "uuid": "e5edd7ca-7810-4339-9d23-9676e3432e4e", "comment": "Malware payload (RaccoonStealer)", "value": "2ed623de7f7b7c036ef7fbc780c153e7fec9a39b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630845967, "uuid": "a7400e8a-e6d4-4f6a-9d6c-7a85bf53dec7", "comment": "Malware payload (RaccoonStealer)", "value": "dcbb13eb7f9097240add3581d6fade9002b3a4e436baf742d82a29f01442203575c9b0e6427db210b08393f0f58c98bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845967, "uuid": "a7bc8566-2798-4bca-82ff-0963a047d949", "value": "T197B4F02A3E50E827D19AC2715826C7F5DE3D7C722964404B7764FB2FEE34390892E366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845967, "uuid": "b0b879ba-1981-40be-9e66-ed6a927b7872", "value": "5107fa4193c2849c77704d8870503de7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845967, "uuid": "c7c7d655-5023-4868-9ab0-6a3b791dfce4", "value": "12288:1HlVQ6tENpoiGgFE3d4At9wZhTSGxrdUcsDkj14po0f:ZlKIe6bgF8vwZh2arKcsm14W0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630845967, "uuid": "0c68aac5-5f69-419d-80ab-a48e4045bba6", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630845967, "uuid": "24e67a6c-4e56-4d95-9700-45b24737e460", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630845967, "uuid": "e5103f40-9985-4ef0-aa52-1446bfe877e2", "value": "0ea81d3eaeae4045c9f5a73db06d8af7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06bb103f-0e93-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630878517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630878517, "uuid": "938b88a9-523a-420a-939b-f85d2d3922f5", "comment": "Malware payload", "value": "b5d53c4dbacaa04350366e05b7222e7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630878517, "uuid": "cd95f469-f29c-4d1c-89d5-1026578c92d6", "comment": "Malware payload", "value": "ff257a7b22badf7948f21dd5dfaf008dd72895aa63bc6a1c5838cbe26036bbe7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630878517, "uuid": "d9462280-8905-4ffb-80f2-b6cfd65a0d41", "comment": "Malware payload", "value": "7b6a049d934368099ec559159464ca8827b92c3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630878517, "uuid": "615590c4-fd32-4d2a-9fc6-85558a2a0e2c", "comment": "Malware payload", "value": "6219e25501d4aaa59b25b440d9956575be0f7596dcf8d11ebec3b67cb2218edf88b7ca260e2247060a08baeaa17f6e34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630878517, "uuid": "795a308a-a96a-4eee-ac83-1e4b8bc2d0f0", "value": "T1F556F107BCA474B9D9E9D231897592913732B459033937C32B55A6BE2FBB7C40E393A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630878517, "uuid": "35a575c7-362f-4ee5-8193-d7f79a6c7fb9", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630878517, "uuid": "de15977a-64e7-4734-bcaf-3c0dbf41a60a", "value": "49152:ozpUQirb/TkvO90dL3BmAFd4A64nsfJBYX5K/kh9Td1aDwQOq96GCXi06wDgKq3c:ozfiYUmAQQQQQQQQQQQQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630878517, "uuid": "ea9d08e3-1228-43ac-a858-44b12b20602c", "value": 6203904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630878517, "uuid": "e3dbba2e-1ecb-40cb-99e0-ba86108bd9c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630878517, "uuid": "fc377d51-fc47-45bd-b56f-f9c16fb751e9", "value": "b5d53c4dbacaa04350366e05b7222e7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "134c9528-0e35-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630838166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630838166, "uuid": "b29bdd64-4e8d-46c3-945f-52b0e00e91e8", "comment": "Malware payload (RaccoonStealer)", "value": "49e3f1ba228f5b076eabbe045cda84f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630838166, "uuid": "d07d5738-78d8-4866-9314-a92ba6c9d7c2", "comment": "Malware payload (RaccoonStealer)", "value": "ffa212f2e4a69930a47fab0c12b6e2d98c590dd18c5ee1115e5ea4571b89ac50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630838166, "uuid": "aebb26ef-b086-4934-836d-f1e2f8e8b8a5", "comment": "Malware payload (RaccoonStealer)", "value": "7a54f08edcd6d9a1fb1db142ee18b689014a514e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630838166, "uuid": "95a51553-c080-4d3e-b46b-717791340b3d", "comment": "Malware payload (RaccoonStealer)", "value": "ff7a1809967b02537de4a176ba1eb22e55b22eb7a3100f728ffab12093ff5f163fb2c5875ab17574e929befbf8795af4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630838166, "uuid": "f5a55c05-252d-46da-a43a-4e57a6a23825", "value": "T1D807332BB295A53DD4AA2B350573A11088FBBB2DE4177E5627E0C48CCF365C01E3BE65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630838166, "uuid": "5cd617cc-4404-431e-9d11-cbeab1d75f57", "value": "eb5bc6ff6263b364dfbfb78bdb48ed59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630838166, "uuid": "e562bdd0-476b-4294-9cbe-1965c3f6146e", "value": "393216:lolMJCXup7T1lLLpCUFXyLZ2bLG7h2clq1A2AUQ5:l8X819iZYNuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630838166, "uuid": "81545128-925b-4ab7-8960-6dffb87ff60e", "value": 17147138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630838166, "uuid": "4da46e3b-6f51-43f7-92ad-465a8459b8f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630838166, "uuid": "ada72c95-83f0-4693-8be3-7df2159dc658", "value": "49E3F1BA228F5B076EABBE045CDA84F3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }