{ "Event": { "published": true, "date": "2023-08-15", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-08-15", "timestamp": 1692144182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "79c57865-8f2d-49d9-b79a-e758c10a7bae", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "152dd866-3b9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692124346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692124346, "uuid": "cd81a3a5-945c-42e4-a744-34f245a65e48", "comment": "Malware payload", "value": "59489bbb920d5131ebbd32f741a908eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692124346, "uuid": "45939bc7-c5d8-43cf-9458-2b66de1b5b9d", "comment": "Malware payload", "value": "00a34c82c501aa9c5f57d106e0db3df07db1f232c4b30a2ba322c1307a431079", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692124346, "uuid": "a32703de-75a5-4943-817b-360eed705045", "comment": "Malware payload", "value": "04d74a3af7b183bc9cc7b0734aed7f23c8468bfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692124346, "uuid": "b5f7a803-2380-4e02-bb00-4c09f6a50d99", "comment": "Malware payload", "value": "7608d1aa19c9ade94d9483a80fc08931fddda12a4bc9cdab997dbc3928bc4fac07cc41015611ef2389c5f3318889eb3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692124346, "uuid": "671d6a1d-1436-4172-9123-68380deb95f9", "value": "T1C3251B5CFA09DA3FD34C8C3950F9DB2B69B99FAED0E1A351C01191B518E6CAD0DB6063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692124346, "uuid": "0ec911c0-9349-4eb8-9bc0-343e5fc9361f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692124346, "uuid": "53314a55-759d-4af3-8ec1-78e1a451b23b", "value": "12288:F6xnSWrvqXsK4ksC+uK5vsHeE6oLu8llEgM6yeqhl97vBHnEyc:FL6CSksxvqD6oqg7yRBHnEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692124346, "uuid": "d4fd0bd2-84d0-47c0-bc51-5869515f4f3d", "value": 1034752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692124346, "uuid": "e7069697-7a7b-4ab6-8624-326026445903", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692124346, "uuid": "546e4d3d-d4f7-4ac8-9151-cba56863e574", "value": "SecuriteInfo.com.Win32.PWSX-gen.22496.17332", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5658e84f-3b73-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692107705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107705, "uuid": "3bb2eac0-2b6b-4898-bf69-7c4f97d12be4", "comment": "Malware payload (AgentTesla)", "value": "8ac64e0cb63e06f0e09d15935ee254f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107705, "uuid": "6452593c-0e81-4841-8ffa-4bc76ad53344", "comment": "Malware payload (AgentTesla)", "value": "0159dd7bf1fcda00aded9d39eed3aac9c57d543aa6abdea653e428d515c42b53", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107705, "uuid": "fa43fa8e-4988-44aa-9d4d-135f90b4d466", "comment": "Malware payload (AgentTesla)", "value": "90edb63d4906c3cc84a2171fc8a79d28f18e85f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107705, "uuid": "7ba1a71b-8f0b-4179-a40c-016ac42a31a1", "comment": "Malware payload (AgentTesla)", "value": "4f8078f5b6d16744f3a8500681ea467fe05c8f9e975d94634f1e2266a5efa60bd8acd554d04cbbd9693e67986f062054", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107705, "uuid": "7cbc5dfc-6793-454f-a50d-bdd2020938fe", "value": "T145D4231C7CBD9F60B4FAB81F1896DE8F5884141292C32E81A56EA7F9D3F027894C475B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107705, "uuid": "60bc0aba-2727-4832-ae2a-52765eb5fd59", "value": "12288:FsDpZyuM5/RlqWy9bAWC5lGg7SJtXaAU5OrG++TAFJo91hIvL9xp4gIZ:FsRM5/RYle6tJc5OabAU91hIvL9HIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692107705, "uuid": "4db7c315-3d5d-43a6-b3bf-17adde66dc91", "value": 654908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692107705, "uuid": "e77a3db4-5448-4121-a090-14dd6381756f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107705, "uuid": "05634f22-2f73-4574-b588-c5f05eb7dd9a", "value": "Scanned #0046108082023.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99be580a-3b06-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1692061003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692061003, "uuid": "25dd96c8-ecc7-4e29-8681-a0e43e215d12", "comment": "Malware payload (njrat)", "value": "b514204ce2d9d79e9b70d3fae64e63f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692061003, "uuid": "542bb407-ecaf-42f0-8c6e-e25990c96efc", "comment": "Malware payload (njrat)", "value": "01898ceafe8980b144a9e122e951890227d4438987894dbe6e01a1f321fb8393", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692061003, "uuid": "6762d4a5-a988-492b-b592-8a3c7c7d2f09", "comment": "Malware payload (njrat)", "value": "0d7e7fffa4589bde734c704527755f032d951536", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692061003, "uuid": "9c9af0dc-b4c3-4ca4-adfd-95f8915cf90a", "comment": "Malware payload (njrat)", "value": "8f1dc1047d7b516511427035ce74f6291cd447d62d2da58c614f2cb49f44a4012d6703bc2a4b4beec9643da3853458ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692061003, "uuid": "fbc23647-1b9f-4d16-a306-be1640642a3d", "value": "T11E93E84977E56524E1BF5AF75471F2004F34B48B1602E39D88F219AA0A33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692061003, "uuid": "81e5ba28-99c8-4fda-aac7-bef0ee57d1e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692061003, "uuid": "716f0235-1eef-425c-b337-b7f6ffc7b75c", "value": "768:EY3gUBnkpjTMpALPGMtsas88EtNXhe9Y1mxCXxrjEtCdnl2pi1Rz4Rk3WsGdpfgM:cURkVbPGHz88EbB1pjEwzGi1dDSDfgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692061003, "uuid": "6e781783-18f5-4301-b51e-0a4213aaa156", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692061003, "uuid": "3074dbeb-2f1a-451c-aabc-72a373a94206", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692061003, "uuid": "7a681dfd-4f74-4ece-b573-dec8b555a999", "value": "Celestial recode.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5407aa91-3b66-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692102117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102117, "uuid": "a28c3f0f-8cfd-4c7b-a6e9-f188556719c5", "comment": "Malware payload (AgentTesla)", "value": "b4a76000de1ff8c343a62f35072fa41b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102117, "uuid": "75969506-c7b6-4ed5-b2d4-e74384e405df", "comment": "Malware payload (AgentTesla)", "value": "044cb562792bad9d4aa1fa99fcb642ed6bf4dd49af86938b75add85d021fa101", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102117, "uuid": "a8739a52-6de3-47bb-9f2a-442807874027", "comment": "Malware payload (AgentTesla)", "value": "4c6a58d8799c91a696cd277425e372cae6004da7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102117, "uuid": "801dcfc4-c3af-41cc-b258-8d9cf6d2f291", "comment": "Malware payload (AgentTesla)", "value": "fae46316a38d5f2b3f8d23e745ad4b58ee06a18b40f8a603e3e5297d10f014d47207d142b7d517e0fa756f73d36a8cfc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102117, "uuid": "79d16686-06d5-4f57-9c3f-630c2e5cc13a", "value": "T1F2649B1161EF608DB1737B530BED68E88F6BBAE55B3A605E201C430B8B97E44CE55732", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102117, "uuid": "e79be603-ec98-49d4-b0a6-993615e88557", "value": "6144:quu9bN8NoNkGNIQcsptSAwBRNM/MXMHO5b9By+Bi9o:quuQQcsTANM/MXMHO5C+BV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692102117, "uuid": "341a1f48-b32f-413b-b010-5170c85c8cec", "value": 308066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692102117, "uuid": "0ec9121a-1f86-440d-b7d0-e92e79836b3c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102117, "uuid": "9425b2d4-3748-4746-97cc-a04b27a91019", "value": "\u0391\u03bd\u03b1\u03c6\u03bf\u03c1\u03ac \u03c4\u03c1\u03ac\u03c0\u03b5\u03b6\u03b1\u03c2.PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca4fc32-3b69-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692103286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103286, "uuid": "85eb6b37-8146-42aa-89df-05ad3f52fba1", "comment": "Malware payload (AgentTesla)", "value": "19c6fca97c6525b85eebbdb7ef89de9e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103286, "uuid": "d9916ece-994d-4d06-9d53-e7b44be9dec8", "comment": "Malware payload (AgentTesla)", "value": "06dad9e87ff647c4b04e0fd371314b2a1c537c6ee2e6cad7ab6f4c15508e7c1f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103286, "uuid": "f725a3fc-726e-4cd4-8b55-d0c0ddc25f18", "comment": "Malware payload (AgentTesla)", "value": "daa3f9dace30c705dd1eb476c38bab29f32752b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103286, "uuid": "8d357f6c-fab5-4078-b90e-f252f694b39a", "comment": "Malware payload (AgentTesla)", "value": "bf749503bb65d2c7346571d61db851a419bd17a4ab194dc5fac685d66b59362b2d90eafb9195d418a00da8949406e99e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103286, "uuid": "9d5d7c97-b395-4ea8-be93-4beb8885d99a", "value": "T18DF42330A657A7AC85AE8D77B048AF82FB09571B4F31DD821AD1FE1C4E83C3609E7549", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103286, "uuid": "2848d45f-38b5-49d4-86ef-13d35eb8b89a", "value": "12288:6sJs2XLAto7ZCezkivNKbCYmNSG6Y8/c7iKVtswwIZbErWmprlhSs9Mh8ZbjQ:6po9jvNKbCY3G6Y8Vaswfq7rlF9Mh8p0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103286, "uuid": "66fa74d0-4efd-4ee4-9c7c-6bab27e2d0ad", "value": 751977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103286, "uuid": "fb07e805-e9af-4048-935a-265a5498d8c5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103286, "uuid": "ca3dc5c4-96bf-4c0a-aa75-f49f6b45fc00", "value": "TRANSFERENCIA BANCA ELECTRONICA.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461fc22e-3b8f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692119703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119703, "uuid": "43dc56b7-695e-4600-80f7-f69cc2585fdb", "comment": "Malware payload (Mirai)", "value": "cdeebc504d4894ff0e02ded7f93c63d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119703, "uuid": "3fb7ab4a-73e3-4cd1-9059-b911457185de", "comment": "Malware payload (Mirai)", "value": "088ee8967863655db39a424c47db5065253e2f14f1c7d7156e2afc88cf29d97c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119703, "uuid": "67d58f0d-de59-4141-8f11-8c5bad049290", "comment": "Malware payload (Mirai)", "value": "a1880730d8bfd35458004f6aecb99e52a9683a02", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119703, "uuid": "00a87b0d-f4a8-424a-a6c0-7c30862e7290", "comment": "Malware payload (Mirai)", "value": "c1bfd9cfa629b641d14638ae58bc939043eb4b551723f27174451df9a9d4f272eed13c595d23f21d0d0c7c126e0e3a45", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692119703, "uuid": "e7812765-b905-41d9-96b7-2641c7ab4b44", "value": "T1D9C2E696BC87A56BC1D0137ABA2F2B8E3365B3D8D2DF3753D8151B10368665E4D32B01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692119703, "uuid": "b8f483be-bd31-48a9-985e-3efcc93e5cb6", "value": "384:H7QsqX3tEls68AXp6fEaZenA24489G5gter6hskVT4SmJjRx0Fru7zzknpjoo3/Q:bl6dEi68FYA2X0G5ggr0PEzzwjoo3/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692119703, "uuid": "46bbe0bf-759a-40aa-af90-35face87c80f", "value": 28212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692119703, "uuid": "88825b81-fbea-4de2-ad18-83cf18422de9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692119703, "uuid": "39ca4ef2-733e-4fa6-86b7-1939c3d61a66", "value": "cdeebc504d4894ff0e02ded7f93c63d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05590125-3b4d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692091248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692091248, "uuid": "ee80dc31-645a-4985-bb31-fae3fb16d6c0", "comment": "Malware payload (AgentTesla)", "value": "8306babc704fd78660862c0c4213a924", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692091248, "uuid": "24bc447a-c050-4c14-b16a-2f38d9e76bd2", "comment": "Malware payload (AgentTesla)", "value": "0a11257873d5786d74c6521640664c516fbd058aba5677bb2487f9b6be197508", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692091248, "uuid": "3ed87afa-ee4e-4ed3-b6c4-5aaccc567da5", "comment": "Malware payload (AgentTesla)", "value": "e930d227cfb29a2b7c358fbbecee898f8bc0c3b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692091248, "uuid": "352d59e9-d7f4-4fdd-a337-86719605b708", "comment": "Malware payload (AgentTesla)", "value": "8ebd982c1f02c21e617b6934f95edd934c9c821e45866c9f447b5c402981a33f5443637a8652ab26e8ab9d5e977e1b70", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692091248, "uuid": "a7348067-66e2-4a59-93c4-b11350a37ca8", "value": "T1FB657C25E7BB2856EF19A5F88E1F847138CADD80F0B5D58873E7290389C23614D35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692091248, "uuid": "c7aa90d3-c7e6-4665-901b-50ecea4fb042", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692091248, "uuid": "2ac554db-8249-4d1e-8fce-6130ed0d7207", "value": "24576:TaOgu/O+YeZxqcKZOUmRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOv+Wk:mu2+YerqTGRs6CE3jLbO9Rs6CE3jLbO4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692091248, "uuid": "d0814eec-1b0e-409c-9509-00c5959db17f", "value": 1452544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692091248, "uuid": "a7a938f9-a596-45fe-92e9-01f1a0ba5211", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692091248, "uuid": "b838dc12-b6e6-421f-b2ef-2c11af975001", "value": "Purchase Order_sk1109811.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16426df7-3b66-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692102014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102014, "uuid": "4c49f348-3ea4-4b72-9801-58baa4261cab", "comment": "Malware payload (Loki)", "value": "e3627a3af9e5b87a695986bbafb653db", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102014, "uuid": "3785bcd3-6d04-4c18-bd91-23a9229ba210", "comment": "Malware payload (Loki)", "value": "0a58b07d0cf426f0204a901ec0308665e5560d8583d16dd449ed3cbab1e11f19", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102014, "uuid": "03bc4dd9-c776-4b95-be39-0b97b35c76fd", "comment": "Malware payload (Loki)", "value": "96a006f378208067f6cdb73d23d6f6e618affd86", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102014, "uuid": "83951614-8df1-402a-a193-afb6a985ef2a", "comment": "Malware payload (Loki)", "value": "4129ec3c1d493fcff6209568f0be99d4a7a1700a10e9709ea7f5843a08bf49c8d044eb2b9d186602a681af91928c2184", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102014, "uuid": "872c4c32-9e72-481b-8362-4d0037ee2cc5", "value": "T16155F103E900DBC3D41D83F87E530EE90F0A6F19E99569DB14663F9B3B70A72099A16D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102014, "uuid": "c601ba64-3ce2-42e1-8578-75ed01d7b5f4", "value": "24576:qaZy0w6VgjKaWlEzp7a+Zydw6VijKaWlEzp7afzd6f/b7QAUQp5E/zwkx:qE86VgjKjOzrJ6VijKjOzwdU7/UX/z7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692102014, "uuid": "fbc48c9b-f7b3-4d51-a74d-156d2d8a2e4b", "value": 1330176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692102014, "uuid": "e77d6a73-0b31-4aaf-b8e1-e37a9d83e5a4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102014, "uuid": "b0fbc733-8963-47a5-aaf5-fa6afa4b2321", "value": "MT103 Payment advice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b98b800-3bc4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692142476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142476, "uuid": "7d7e3885-69ee-4997-adf9-04dc059229e3", "comment": "Malware payload (Mirai)", "value": "f4ec6fbe9ff0afaf74e34f6f515908da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142476, "uuid": "1ff58b8b-9f5e-4c1c-a5c9-ca68666a67b8", "comment": "Malware payload (Mirai)", "value": "0a90757356e6082c3a048ab1c24831303bff207197a4dee5d38d52d1ef4a468b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142476, "uuid": "06ea2a94-2dd2-410d-963a-8baba0495d07", "comment": "Malware payload (Mirai)", "value": "78277ac0e02a677ea21fdeb8191382187593953f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142476, "uuid": "9c2c15b9-50a6-4f33-b5cd-a09847a26aca", "comment": "Malware payload (Mirai)", "value": "b30816349a779cef5122d4d5c4892a28cf1920f5e89a833eabc9e037c79998cf95c54c65f3c92bb966687feea747fe2d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692142476, "uuid": "ed4b757f-e5ab-4859-8669-eee84189497c", "value": "T1F0B33A72DC662F68C255D4B0B0B48FB92B939A90928B5FBE1577C2744083DCDF9057B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692142476, "uuid": "50bcaac4-ce7b-4b33-8ba1-32c9544fbc9b", "value": "1536:9avRBAk94htKxo2+CXKc71exBabF3Xh4WTvo5AvSF13FG:9CRuhp2+rc3bFh4WTw5Au13FG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692142476, "uuid": "c444a8eb-d5ed-4817-877d-45c77897ff4d", "value": 113472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692142476, "uuid": "007f59f1-81bc-4d9c-885b-93e56694a4bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692142476, "uuid": "2a38118a-8b67-43c2-b87f-6ef356547a5a", "value": "f4ec6fbe9ff0afaf74e34f6f515908da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d1f78a3-3b73-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692107689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107689, "uuid": "5912d0b7-16e2-45cc-99d6-c22c8deee0f6", "comment": "Malware payload (Formbook)", "value": "408c8de1cf7d5ec31e6c857f9900fa62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107689, "uuid": "56161fee-b391-4b7d-8962-5e93d8b5f3d6", "comment": "Malware payload (Formbook)", "value": "0be1cd04cb84003839d5438dda8e2c40e89857f5c48300e59cac9db26ae7ebed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107689, "uuid": "bca1b6b3-e7db-4d9a-a0d6-34bb0e507885", "comment": "Malware payload (Formbook)", "value": "8138c17c987fcfa2602604949206992b7d7d05f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107689, "uuid": "8b543ea1-82f9-4936-af61-4eccf80d163c", "comment": "Malware payload (Formbook)", "value": "ee797a821ac019d74b86c23050e3cc6619f4157545ff4e1152a330c6f50dd3fca3e48da56136dc6c595992e72359fd22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107689, "uuid": "9369d34b-1662-4b4b-88a3-00711cafe5b6", "value": "T10B64130663E0C563E5A22A70AC30A6777BEEDD161480669F9780CB887DB1FB0DC1F765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107689, "uuid": "0717b98e-ef3b-41c9-8429-1750370f15f3", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107689, "uuid": "efec2a10-3745-4b47-8a73-3ae5a765d9fe", "value": "6144:/Ya6345n3Ji/36d0+TAUk6TBx55go8jydElSG/bTFxzaopw0/KqJYJxlycesDj+:/Yd45Z79sq518jjlSGDXzDpVJYJnyceT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692107689, "uuid": "d85c0220-875f-41bc-ba9b-8ca5dc61da43", "value": 322380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692107689, "uuid": "ead10a5b-c92a-4825-a052-2b8cbbf1d251", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107689, "uuid": "02ff9efb-5a72-4dab-8c96-26615df3c841", "value": "rSWIFT_COPY_010100301.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc257375-3b68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692103258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103258, "uuid": "22ed5798-8433-4106-85f9-e17bb84d4f9a", "comment": "Malware payload (AgentTesla)", "value": "2cce981fd59f4f18267b2d2dabfa0594", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103258, "uuid": "b8b42c5e-c854-4dfe-95a7-acb7dc76c482", "comment": "Malware payload (AgentTesla)", "value": "0e9817915464588eecd0fc0bfba8e601dd887cd9dc8c9f37edfa49eebdee7ded", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103258, "uuid": "e3e134dd-48e8-4a42-9d0f-9e356bc4f094", "comment": "Malware payload (AgentTesla)", "value": "a3b6653d76c82cd6513d79cf3ae5a90a3078aced", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103258, "uuid": "d29500b3-6e5c-4388-95ba-5ace467c2b21", "comment": "Malware payload (AgentTesla)", "value": "702edf8d73b6eabcac6e123fa51ca3e704feb018df7ef204d4586c2ab27a026bc0c26c436fc9a773817f0a30cb1deb8f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103258, "uuid": "16060b0c-b00b-4b54-9274-658bc80e0d70", "value": "T198D423F843F851E6A3680761831C3423D686F754AB4187A2CF764A6C953E1E3B74ACDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103258, "uuid": "79841027-13a4-427b-8246-07989cd49bf2", "value": "12288:Yfzx7fiuWpUE35IkRNCAW1QF9s8t97CAjLAhZGrK0SmvtIbd:QzlfGUE35XiAW1aS8/7jCGW0SmlIbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103258, "uuid": "a5714064-73f1-4e2b-8c45-3bc8ae2aee1c", "value": 605261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103258, "uuid": "308718f5-6ac7-454d-9574-2bebf8bd36fa", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103258, "uuid": "0adbc6d7-db79-468a-83b6-3a3623dcc068", "value": "NEW ORDER 346521.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d4d828-3b85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692115374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692115374, "uuid": "540dce39-ef72-4686-be46-d0ac17577f45", "comment": "Malware payload (AgentTesla)", "value": "4bfb69519bd38850244caf02284765cb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692115374, "uuid": "21428715-1266-4656-abca-974fb9b410a7", "comment": "Malware payload (AgentTesla)", "value": "0ed23a63c8183bc51ac08a01529473d9cc4fe7e35999ca93ed30af35fd7f7f4b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692115374, "uuid": "da576dbd-0090-4755-bac2-e8ccac964e96", "comment": "Malware payload (AgentTesla)", "value": "49c855f76d2675d975a1d15a8a441341a35d1ed9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692115374, "uuid": "7fa1b006-1f07-4af2-824a-23b3c9a3d073", "comment": "Malware payload (AgentTesla)", "value": "d7b22d03926d3565596dd12dbd93a0ea3cb2f030138b5f3d854c0a16ade4e8415cf8f1106b892b86fbc82a41410c0733", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692115374, "uuid": "ba47b790-2dfd-4c1c-acc9-b74475717bbd", "value": "T11C15070059750092EF3E227D1A63573DB4BC1D53A2F2C5E96B2726D38DD3012CEA9BE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692115374, "uuid": "691a0ec2-6bb5-42e4-bc4c-fd1975898f6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692115374, "uuid": "be63f560-0f2c-4c50-a6a7-2ce9feef0aeb", "value": "24576:Bj4m9ePIJpppXpppppCOopppXpppppCOkAQjh3KhwZp1YCM8Goxqv:apI8O/OkAQjh3KiZfYth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692115374, "uuid": "a2a64252-0b64-421c-b1bc-e80850943296", "value": 949760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692115374, "uuid": "ce3e09f1-ccf3-40f3-baa7-c072700519ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692115374, "uuid": "c53d22d7-5c04-4f40-86b9-9bae8c852f15", "value": "BOQ Materials Needed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab6b5d7-3b0b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692062991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692062991, "uuid": "f9dae2a1-2e35-414e-85cf-7f698fda443d", "comment": "Malware payload", "value": "b8b6580abe6d5a66cad29c091aef488c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692062991, "uuid": "369af954-09e3-45ac-b84f-1abbc65a8f76", "comment": "Malware payload", "value": "0f8eac7fa19913906b0821ed053b39f8c85c72a4aad65c3484dd49364bdf5bf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692062991, "uuid": "dec21919-95e6-4dbb-8414-4692658c2311", "comment": "Malware payload", "value": "8989da16ae25e65f715f089e4843228c0d753ec1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692062991, "uuid": "dffa224e-5e5d-42c6-96ce-24211b80c24c", "comment": "Malware payload", "value": "bb1c937b966a707b45feef065d4501aff8d2b207d7d573abaf42d53d4696d7c88dc24ffbca5025ee90202992bc342ca7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692062991, "uuid": "4c2b1b6f-1fa1-42d4-b6ba-6915c6e99d99", "value": "T12A747C01B5C1C472E5B619314974DBB24E7DF8301F60AE9F77D81A7A8F246C08A3AE67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692062991, "uuid": "9eacc8b1-63b6-4c0d-845f-350e1360d488", "value": "3072:efRmhGtRoaJZ0TQDUg4SbaT85Qsf7kLkZZym/fJaustpR:MsQJZzb4mDDYLOJaH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692062991, "uuid": "a95bdb29-78ed-4b8a-be60-c3eb79817512", "value": 345088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692062991, "uuid": "0868ef7b-89c9-4e01-9076-bbc50befbd86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692062991, "uuid": "11d7a366-133d-464a-be09-f5ebda877456", "value": "SecuriteInfo.com.Variant.Zusy.423329.22241.199", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc4f185-3b7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692110995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110995, "uuid": "021c4fbe-9518-4e99-98f6-43164fabb557", "comment": "Malware payload", "value": "55e802899ff192e1140f9b92d3b83342", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110995, "uuid": "b60eca93-b56d-4d3f-8434-4d174711cf1f", "comment": "Malware payload", "value": "0fd3b714c43ceb15f6267a6d0703e8af3742a186b9cdaaa3c63f9c0dd1b00cb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110995, "uuid": "20e5c9db-d892-4b91-a2c8-a2016032b3d9", "comment": "Malware payload", "value": "9b04f438477469a3eb5b3418cc105151b90d57b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110995, "uuid": "dcc6e0db-e395-4015-a7b2-192f8b2dbb84", "comment": "Malware payload", "value": "55ad7c4e55b446a1c932f0dccaf729cadfeb0811b93578888eab24d31a6ab3a7e3917b2f554b1b1270431a04e0f71e9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110995, "uuid": "0a8b8e23-9c86-4568-b261-9b6f4447bbe0", "value": "T1AD235D0037A8C13AE2FD4BB4ACF3A6458679D65B5903C6596CC814EA2F13BC597036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110995, "uuid": "9898dad8-bbf4-4fca-b604-508121df2911", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110995, "uuid": "27a64be1-442e-4186-8f25-563294826ba2", "value": "768:FOEuILWCKi+DiZgliW+8Yb2gJc/PvvEgK/JPZVc6KN:FOtmiMzbpu/nnkJPZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692110995, "uuid": "770e3db7-35b5-4f69-8f65-0a6e0a68ddbb", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692110995, "uuid": "f502ae97-b2ec-401a-94b7-cbcd1b0316b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110995, "uuid": "f5fe3cbd-1951-4108-bf59-897574ce398f", "value": "decode_8255e102d4e51fa00a0f8a97880b0196e43ac5acb5de3368f739a0c98290404a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f955cbf-3b71-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692106754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106754, "uuid": "87f9f324-ff2e-4d84-80ce-cc9ef9aa02f4", "comment": "Malware payload (AgentTesla)", "value": "b51b5f86ab1711be467362301a0af56a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106754, "uuid": "b13183b8-2083-4fc7-a88d-54a5035e37dd", "comment": "Malware payload (AgentTesla)", "value": "1101af9e3109b762e74c770899c2c09835952f87872637043b2c58a24650a7e4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106754, "uuid": "7e399555-715e-4f9f-bbb3-f4c5b2a51d66", "comment": "Malware payload (AgentTesla)", "value": "8e7748214a8c26abffe177beac98d485c37c5acb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106754, "uuid": "538aced0-c9e8-4304-91f3-4d3bb86f27df", "comment": "Malware payload (AgentTesla)", "value": "4ff6ca3ddd06728aaefa7fe5d48e5e4e6276d13d579ed60ab69662b1d35f079b051e6d4d9dab32f089b672e544afe9b7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106754, "uuid": "457c11e5-09cc-4e0c-85c3-6ca613ae042c", "value": "T17EC42353AB79885DDC97FAA5631C8E95237CBB4F8E41871BF1EB627416316873E02C20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106754, "uuid": "50e28627-bf2d-4ea7-938b-6b717995fb2a", "value": "12288:4KPvXHkBCTP2GOWP04oNQjblAuojYyixpwVQ/CTpBPAl:NPvXNP2IxOQPlAuznph/CDQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692106754, "uuid": "b0353f8b-5162-4a6b-a8a1-bb6142ceeadf", "value": 581317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692106754, "uuid": "a69f1d10-41bb-41fb-85fe-1827169a4618", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106754, "uuid": "a3b5574a-d9b1-4669-b0ad-2397bcfc557d", "value": "new invoice.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfbcb35d-3bc4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692142697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142697, "uuid": "15839ca9-3829-4a89-877f-12a7c9db868a", "comment": "Malware payload", "value": "d6c0ca51a18d1d3588171768799c97bf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142697, "uuid": "bf168350-8122-427b-b5cf-257fc21012d3", "comment": "Malware payload", "value": "116c2f06c00c554169bb7a3d1726586d6d5f53f577e734017bcaf61e5a05d196", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142697, "uuid": "af474201-0868-411e-bbf3-b6e8df6292bc", "comment": "Malware payload", "value": "ddfdd2e2213cb6dc05f194de4ebccf0098bdbe70", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142697, "uuid": "6916e8de-3c3d-41b8-8ff9-3faea63b9720", "comment": "Malware payload", "value": "dab4ec8e74901cd261d175589eafb9d3955b9e34987156a8d6026f67dbe79b45ef34881db1073a5b954efaaa124cf541", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692142697, "uuid": "414d4f93-b444-4463-b164-4a1534a1ee27", "value": "T171F30A56F8819B11D5C112BAFE1E124E37131BBCE2DE72029D246B747B8A87F0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692142697, "uuid": "edd082c5-1375-46b7-9c4d-a2f85e93ad42", "value": "3072:diZXmFOdEMUAsh8rXN0pxrDPaxOn/ZqGAUkU+CSLSfRZs:EZXTL3rXqpZrag/dAUSLLGRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692142697, "uuid": "3f182872-e634-4be5-9dbb-cc283f31c066", "value": 160860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692142697, "uuid": "783a919d-64fb-4050-9ba8-56b7ec34f03b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692142697, "uuid": "b1b1ceec-99b3-4c8e-b93c-02a9cc9822b6", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e58bf5b4-3b3c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692084323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692084323, "uuid": "0f4994a5-dc1f-4696-921f-728b31473053", "comment": "Malware payload (RedLineStealer)", "value": "932607aea7c625cffb5c528fc07e9120", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692084323, "uuid": "b330cad3-0a2d-42a9-a4d0-ed0059819d83", "comment": "Malware payload (RedLineStealer)", "value": "120f07b74d3851e775ca166a3f24e4c797370fba8ff5de503bc11f9f2e096638", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692084323, "uuid": "acb5cc34-cba0-48ed-a367-10675b1accab", "comment": "Malware payload (RedLineStealer)", "value": "ab34fbd30efa24e01635e72f43e748b1560ae747", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692084323, "uuid": "33c7456e-aa51-44a5-ad38-0058004864d2", "comment": "Malware payload (RedLineStealer)", "value": "aa1ab315f789000d3bf8078535e7610fb6272f991bfac506114a3cd06f1d0949beeaa0a480f81b68506f15672b6ba028", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692084323, "uuid": "50447474-67d1-4b22-9ab3-06ac19fefd33", "value": "T14CA41209B2FD6B26D4FEE7F91951D81907B9A1AB6163D31DCCA330DE4831B060991F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692084323, "uuid": "52e96231-0e98-43ac-9409-cc69708b9223", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692084323, "uuid": "16573c34-c9dd-4695-8a91-d8ee605100bc", "value": "12288:jyIYV/OUzyF3wPlyHevZkhpRlTwyHIfPoNz1M:jy45glyoZ+nYPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692084323, "uuid": "f467009c-a6f8-43f7-8392-4775f49dd8a8", "value": 461824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692084323, "uuid": "1b271b1a-1205-419f-8517-b11e6697a459", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692084323, "uuid": "c2186629-04ac-4b90-bc04-cfe05f437118", "value": "120f07b74d3851e775ca166a3f24e4c797370fba8ff5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba2bba08-3b6a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692104007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692104007, "uuid": "2f8c5ca1-71a5-4000-b2fc-1c62408997df", "comment": "Malware payload (Formbook)", "value": "170e480cd0c2e3bfe0141e24ccf6447b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692104007, "uuid": "113c001d-b6b2-4ec3-b469-225c85ebad29", "comment": "Malware payload (Formbook)", "value": "126e048eed0b55d00c200460122394c059ad7e7fda97b0d52a97d478aa7b0998", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692104007, "uuid": "6347b653-a87f-4143-bbe0-6f9162890fc6", "comment": "Malware payload (Formbook)", "value": "e9df2df99543970611be2abb8bf519adf43e45e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692104007, "uuid": "428208b4-da78-4f72-9145-2d41b84df196", "comment": "Malware payload (Formbook)", "value": "c740aac7a1a433ef4d7842b3f97806aad19a26d5aef52bfd7ad6118eb52109e94a2a721f0617658d0e30996dfce57e91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692104007, "uuid": "b5a7dfd1-983b-4002-b185-c41d0af346cd", "value": "T1A5C41201F2AC2767D077DBFB5930A8454F76A9AF9262C39CCCE0B0D52522B541BA1F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692104007, "uuid": "b05b099c-7ce1-4cc0-a334-0ea58e07aa20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692104007, "uuid": "6ea9d2a9-d008-4985-993f-acb4f4624458", "value": "12288:oy7V/OAT2ujzJeFFP8cNebcPB+yCCx0GCSpnxWTx:oy0A6uPJe8oebmqCxPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692104007, "uuid": "906fe613-3574-4782-871b-f836a402a256", "value": 574464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692104007, "uuid": "e310245d-29ab-4480-9781-3c8673898c7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692104007, "uuid": "d74e9dbe-11dc-4a64-8c32-524c703361e8", "value": "170e480cd0c2e3bfe0141e24ccf6447b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26934523-3b40-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1692085720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692085720, "uuid": "f4160c1a-3963-423c-bf5f-b8fc14bd9e21", "comment": "Malware payload (GuLoader)", "value": "6513fd332d42d8879b3b33ae29ad8336", "object_relation": "md5", "Tag": [ { "name": "91-234-195-113", "colour": "#FDACBE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692085720, "uuid": "db408b31-7bdd-4f72-855d-c7c1f70a8276", "comment": "Malware payload (GuLoader)", "value": "129c35612733e6260aac7d6ed10df76217504ca95322812df78c7edf93eb1e97", "object_relation": "sha256", "Tag": [ { "name": "91-234-195-113", "colour": "#FDACBE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692085720, "uuid": "0133feef-bbe5-4233-90e3-5f03d4208991", "comment": "Malware payload (GuLoader)", "value": "5f7376cae68e8db30a87f6f1f2968e3e6d143f61", "object_relation": "sha1", "Tag": [ { "name": "91-234-195-113", "colour": "#FDACBE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692085720, "uuid": "e685f2ae-41c8-485d-bc13-0b86491f9c6f", "comment": "Malware payload (GuLoader)", "value": "86a86a72fc15e215abf3af13eddc3a6f311716af0bab293608c5434a192e662627f8690144f12320a8665938515f764f", "object_relation": "sha3-384", "Tag": [ { "name": "91-234-195-113", "colour": "#FDACBE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692085720, "uuid": "aa99b83f-cf72-4651-b309-a95c7fe30539", "value": "T1C0A4D062D690BA2FC1A7503E519692F1B936BC11B6235D3B27C43B3F98BE041C61B31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692085720, "uuid": "db2e86ac-e623-45e0-a34e-969c2d4f5071", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692085720, "uuid": "dd9fbd72-bd11-4da3-9750-13b41f0cc41b", "value": "6144:VmGIhJFHs4wfO1AJcmm6ZSWVrW3hKQ/9vG6s+9W/WbRUvSs6JusMS2AsVsio:AvSJPm6XW3TVu6b9W/GO1kus92nV3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692085720, "uuid": "03ae4798-19b9-4c30-a48f-8993b9bb106e", "value": 457096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692085720, "uuid": "420babed-5db3-4436-94d1-334e44c407b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692085720, "uuid": "966927f9-5f50-4178-bb85-cb03bc4c7409", "value": "SZERZ\u0150D\u00c9SI DOKUMENTUM-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b3ebb1a-3b89-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692117108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692117108, "uuid": "616ffe93-72ee-42f3-a126-4bd9d2fb3a30", "comment": "Malware payload (AgentTesla)", "value": "47de122c36373a026aa257dc11308fd7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692117108, "uuid": "95a93334-b465-4b95-8c6f-84ef291ce4d2", "comment": "Malware payload (AgentTesla)", "value": "12e5b82532b73abb25218f602cc9df661e9f58a771631e3baf1f0145db6d74b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692117108, "uuid": "dc3a5886-5c39-49cd-9d60-62928639b697", "comment": "Malware payload (AgentTesla)", "value": "5038b85c562b99d66e8aa629da6a42ab2633699c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692117108, "uuid": "9cd63697-2906-4f62-b6d5-ca333d1c9c6e", "comment": "Malware payload (AgentTesla)", "value": "9c5d10e649c9bbb4c8a5026ea32bb02d951550cdf5678a25ab5610e5d48012cb17374f51dedd60cd4f2d604a5ea5f769", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692117108, "uuid": "94a2b13b-f03e-4f01-8189-23ab38e47b20", "value": "T174D41213B2BE6F23F5BDD3FB1840411907397B5A7622E75D9CC260C32912B15AB92B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692117108, "uuid": "0435b165-e367-4a0c-bf8e-8c29b65466d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692117108, "uuid": "1dbdeefa-9e21-478a-91f4-c30120b03dda", "value": "12288:QyY7EV/O8i3sB2e+3oEKyY14KDuMFyCNDkXZ49fkw:Qyk8qe0Kx9pNNQXZ498w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692117108, "uuid": "35dd1876-994a-4aab-bb56-71728b0d1d9a", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692117108, "uuid": "0e2d0126-3437-4a0a-b09e-cdd86395ce0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692117108, "uuid": "ab8222d4-9b33-4d43-a3ff-c063cd200a13", "value": "SecuriteInfo.com.Trojan.PackedNET.2273.9489.3582", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f980a93b-3ba1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692127735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692127735, "uuid": "a115290a-9289-4717-a6ab-b712b73455bc", "comment": "Malware payload (RedLineStealer)", "value": "3b690e2f9f6a1184381063aa68bf0842", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692127735, "uuid": "73eee1c8-33f1-4e0d-a8a6-983a5f1e2bb2", "comment": "Malware payload (RedLineStealer)", "value": "12ee05efc2bf83c04a219e2a7f9392e9355bcd12c0faa035b14cdba9cd9d21d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692127735, "uuid": "7d181060-912b-436b-b6e0-5c6777b34d2c", "comment": "Malware payload (RedLineStealer)", "value": "e3ee68f25e11eb1491d40744e535feb375f76041", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692127735, "uuid": "d42334ce-d5f3-4de9-8c8e-846d08033670", "comment": "Malware payload (RedLineStealer)", "value": "dcf1b61e8a7209df6e81ea432a3bdcc02aa91e516bf33e19a075d4027dcb68019c7f24f0577fe2627468b210bdf7a573", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692127735, "uuid": "7fe0f964-60ae-4f34-b5ae-7bcb3a088040", "value": "T1EA953370A4DF50F2DEBB6F724664B2BD9C26E3221946193F326A55D8C062353A7C3BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692127735, "uuid": "0316972d-70e3-4d88-9501-c483d15c8891", "value": "49152:BvuAqfazVE467UxpbHCwZZaw/sn/zP2zyDW4WYga7aaX:JpqfazVEEZaw/k/iyK4jgaH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692127735, "uuid": "cf54942d-fbe2-46ad-87ec-64770a3d5074", "value": 1972736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692127735, "uuid": "971408ac-e48d-44ca-861d-32fe606eb7a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692127735, "uuid": "ed376273-7f93-40ee-b5ed-4db716a4934f", "value": "NitroGenerator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe5b2b9-3b33-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1692080421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692080421, "uuid": "a3e556cf-d583-407a-8b09-9242575ba275", "comment": "Malware payload (DCRat)", "value": "41f028959e04551350b60fd1318f5ce5", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692080421, "uuid": "6f845eee-be84-4895-9155-bcd7c3f96241", "comment": "Malware payload (DCRat)", "value": "132f99aa5074f70c70dfe39868ba10243bb615ac9f714af3c177beede1dc0506", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692080421, "uuid": "a9e0ceb9-6ea8-4ae8-817b-8d45bf4ac0f0", "comment": "Malware payload (DCRat)", "value": "52b4f0b96ca91822c9f780fbca2318cb8d9692d6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692080421, "uuid": "8a50d068-93a1-47c2-bd5b-597b729a2758", "comment": "Malware payload (DCRat)", "value": "828a81b09d85de40b449cb182fcc6d707296346e251559217c4f89c0266b3b256dd3bac9344c9df1ddfb80a7a0ea3aea", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692080421, "uuid": "c181918a-11f7-4eee-a9d2-29616b5c54ec", "value": "T1A1657B017E44CA02F0081273C2FF495847B1E9516BA6E32B7DBA776D65123A7BC1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692080421, "uuid": "291ed6b0-0277-45bc-948d-843e96d0da47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692080421, "uuid": "c16b677b-a653-4950-850e-63b881bf69db", "value": "24576:OkGXN+ZZPRu6VbNjTvw7Od/QgII+3v0ssTUwXKILghMuX2L35JA5LF4:Of4/PRu6VbNP3NIiU92L35J+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692080421, "uuid": "c44a3383-dd07-4059-9d3c-3a1a05e8ddd1", "value": 1445888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692080421, "uuid": "6ce83da6-09de-48a2-acdb-73a3c8d96660", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692080421, "uuid": "ef7287eb-e6ec-4bbc-8734-afcd682c6b98", "value": "41f028959e04551350b60fd1318f5ce5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e2ec515-3b66-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692102054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102054, "uuid": "a8f44b41-7128-463c-8ac4-ff3a9523ec3e", "comment": "Malware payload (Formbook)", "value": "a1d5340d98145a8761b8f6e08025c918", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102054, "uuid": "a801dd69-b74c-432b-8f92-d80d1927353f", "comment": "Malware payload (Formbook)", "value": "139cfcae4ad335b722ffd0a27324b5e55bfed2ab303b1ae1ca697a3f936cb886", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102054, "uuid": "8f264516-9940-4445-bfc9-6304a43f368e", "comment": "Malware payload (Formbook)", "value": "9e68e8f9d0946afd057cdef7cc4ed487186e8ddd", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102054, "uuid": "50e4c202-483e-495c-b9e9-976fdafa8cbe", "comment": "Malware payload (Formbook)", "value": "38022db9f5cf65e2091f1a9ed74f68e988f79569f4a731c0cdb2ddf323388c33439bcec17a564985802195aff7019910", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102054, "uuid": "82e2608b-659b-4d8a-8676-11319ca42515", "value": "T14255F103E900DBC3D41D83F87E530EE90F0A6F19E99569DB14667F9B3B70A72099A12D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102054, "uuid": "551aef83-b281-41ca-bb13-a6ed014aa358", "value": "24576:HaZy0w6VgjKaWlEzp7a9Zyaw6VpjKaWlEzp7a8zdbiMb7QA5Qp5E/kwnx:HE86VgjKjOzMy6VpjKjOzJdd7/5X/kE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692102054, "uuid": "55cb02a4-44c1-49f9-be55-4e3be2c77f65", "value": 1329664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692102054, "uuid": "28c98853-1805-4be0-b585-d9ea09258e8b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102054, "uuid": "43ed108e-c50f-4622-904b-6b0d55f62816", "value": "belge.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c67788-3b81-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1692113816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692113816, "uuid": "5ee8b236-3544-4f38-8522-d992df1180e8", "comment": "Malware payload (Smoke Loader)", "value": "ae09bd17bfb13b1c29f747448665d455", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692113816, "uuid": "efc2f6f5-a075-4c02-af4a-81f26171e933", "comment": "Malware payload (Smoke Loader)", "value": "150bda353b6753fa94b05b4cde7ce8b5f1ea9cc0e8f9bf1b02bd5db194f964ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692113816, "uuid": "97484e51-5487-436e-86fa-5a1a5c111df8", "comment": "Malware payload (Smoke Loader)", "value": "ad77db27217d1034ed3bc1a85378223ffce80f02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692113816, "uuid": "7dbed60f-be6f-4b86-8260-fba019de56f8", "comment": "Malware payload (Smoke Loader)", "value": "098f1a2fc6bfb491951e1fa42c87fcb8afc5379e1d9fa65c3b487f59d730fec9f26ec2c3a16b939f9b2c0f6e75e6ad4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692113816, "uuid": "72dc669e-12da-430f-9da7-92119542e66a", "value": "T17A34D01176A3D0B2C85705704864D7F06ABFB875B774889B379C2BBF6E302D1AB75242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692113816, "uuid": "1b2f9c16-34e8-4eb9-80a0-b971861e3300", "value": "7d6df4fc54c54990fefdaf7d1c8b703b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692113816, "uuid": "63ce3e54-8d3a-4b48-a4bb-83108305527f", "value": "3072:4XE8PTrLzx18OzzZqeY2BDv1sG5Zlpbxn8QWfttU5kfY:MDLHtXwSBz3pt8VV/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692113816, "uuid": "18057e45-7784-4dee-b2bf-508ce64720a9", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692113816, "uuid": "0bf8e1cc-c5b3-4e98-9df1-d01c9d3b2d6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692113816, "uuid": "7a58adf0-e6f7-4186-8143-5e00a904e230", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f65c6b-3b71-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692107085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107085, "uuid": "82841640-32bb-4fc0-81fc-47d0ff72e9d7", "comment": "Malware payload (AgentTesla)", "value": "fe72ed87a902b5d8a1267ba54f4135de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107085, "uuid": "f65b8894-f127-498f-9b22-25786752c426", "comment": "Malware payload (AgentTesla)", "value": "156305fe33e5c9944f7de74cf2c94fa9ce976163c128019e5ffd761351368a09", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107085, "uuid": "960ebc61-6aa3-41b3-82ae-50927db21d73", "comment": "Malware payload (AgentTesla)", "value": "3a2a791ebf9f3a80ca2e7c9e04cc7d9588b5e333", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107085, "uuid": "9c294a42-4aad-46ce-b640-a409f65d67d4", "comment": "Malware payload (AgentTesla)", "value": "746e7440a497a427c6f41eaa2d4c0cbbd5ffe89627c752b2f0e616e3eb046a68e5652a59f0af355c306e0061097d4899", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107085, "uuid": "4c4454d9-713b-4b2b-b330-b70c077a2eb9", "value": "T11D1501A3BE5C81DDF90E8CF80951A469C0687CC1BE22D5447A713EEDE532364A217B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107085, "uuid": "f41aa702-7157-42e4-aee5-6f1f9a5ab535", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107085, "uuid": "e5292c14-bfd0-492a-ab5e-fdc7bd062c11", "value": "12288:6PV/OigRfDCVAt0kvsu/RBdJUZRqVP3PMCd38ucaKJ0xl:vpRf7vv5WIPf/1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692107085, "uuid": "ef990ebd-e6bb-4d95-b6ac-72ce8b9c60d8", "value": 952832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692107085, "uuid": "abaeb64c-f0c5-4e2e-9686-9bc1beaf7f50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107085, "uuid": "70f1df11-9229-4426-b604-698df72aa020", "value": "rPaymentAdvice-AdviceRefA1282920Prioritypayment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f626f9cf-3b70-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692106684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106684, "uuid": "4d6fd812-2376-41bd-a3dd-dd934aba3bc3", "comment": "Malware payload (AgentTesla)", "value": "23a9d5840888f90ccff7e892e038688f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106684, "uuid": "6f1066f9-be09-4a82-b3d4-8296d60fe0c1", "comment": "Malware payload (AgentTesla)", "value": "1576a5192d74d90d92a5de1fabafdfe71cfb6654f26bd7a6ca5fc80dc0b9954e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106684, "uuid": "c358cb79-36a4-47ca-a82e-5e9facc6113f", "comment": "Malware payload (AgentTesla)", "value": "7bb8056fbc9f08b32625459481054f21aea20465", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106684, "uuid": "9a851e12-39d9-4656-9802-d15a6a43e5f5", "comment": "Malware payload (AgentTesla)", "value": "f09d8b036f3b5d22b4f81d3367a6a289427c93793487ea3d284d297220093c32aca1c9311cb03835f7d74352d9422f6b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106684, "uuid": "8979dab0-05bf-4157-bf1f-bbe1936242eb", "value": "T1CD44E7123141056AFE273675B55FC9300261AFEF936ED70A338F3F664F9236944A7A0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106684, "uuid": "07f67dd0-08e8-4681-9f6a-5badbe866dc1", "value": "3072:5GhgogMFoQHY5H4iqEwwR2H9EuIfhAP8tgCqXYWXqgy7U6S7NMEihdD4Ceo4NAyD:whgxOoQHWHfw9xwAENV45l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692106684, "uuid": "6ebff2fb-eb60-44ef-80ee-dc9986ae9bef", "value": 272384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692106684, "uuid": "57c0e0c7-6468-4e9e-986f-a5f15e465e92", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106684, "uuid": "79aab5a2-e26f-42dc-b241-b164e3c35455", "value": "nOrden de compr.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d24139e-3b46-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692088281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692088281, "uuid": "40363736-559b-45c6-b3d8-b55a93e0765f", "comment": "Malware payload (AgentTesla)", "value": "4e121cb2c7210d67c129b7959acbc466", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692088281, "uuid": "bf4ed0d5-8e92-44d5-903a-c969c92cb2b8", "comment": "Malware payload (AgentTesla)", "value": "15b50d5116ba030d793d4fd500c49708f54298d1a7fc5fb5f704713f2ab6b85a", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692088281, "uuid": "505c1ccd-139b-49da-8d9b-b9ab0857026d", "comment": "Malware payload (AgentTesla)", "value": "d183990e1515f2b1f39e9ecd39c7e541d0c87067", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692088281, "uuid": "dc8bab1a-b578-4d89-b116-dbf76007539e", "comment": "Malware payload (AgentTesla)", "value": "b42b1bb03efd501693eb1cdcb6a65e15ef0e5b7512ae3856a03c24c3ddccbe91c32b324a63a13c52e99aaa20ea2041a2", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692088281, "uuid": "8f46b245-5bd1-4907-a6be-c92b4de66c40", "value": "T1E1A4238B1A4CEB89E2E87361426B3916E3375170694D77295118FAE35B0D3C3F4ED2D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692088281, "uuid": "b5c2afcc-cf40-49ec-b198-53efee0c4e51", "value": "12288:ccNlGHcenqYZqWPsDyLzmSQrgCDL7RsxZofgiJSqI/gD:ccNo9qZWPIyLlegCDLqxKvrD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692088281, "uuid": "0fe74ac6-1042-4338-9d82-baab60abef5c", "value": 471386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692088281, "uuid": "f95a6b49-8161-492b-80bd-1e67506f1905", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692088281, "uuid": "d4c8690e-100e-49ac-b92f-e6dad6b0265b", "value": "signed PI.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd267f61-3b65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1692101918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101918, "uuid": "b093a4fe-265d-412e-8d63-7da87f78e3f9", "comment": "Malware payload (SnakeKeylogger)", "value": "e50771bb8339029c56648778441e0bd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101918, "uuid": "c4c01d69-780d-47b4-a407-7516997707fa", "comment": "Malware payload (SnakeKeylogger)", "value": "1655dd140ca64fbbba26fac5c63072c362c161361fd8c3399b54fd5e1666bc90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101918, "uuid": "a228c1c0-6f49-4f73-9634-4c9d4ddea5f8", "comment": "Malware payload (SnakeKeylogger)", "value": "346883500a8a00ea0c05cb030aee34972b81c435", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101918, "uuid": "58e9971d-083c-4785-b4de-21e1c34c1e90", "comment": "Malware payload (SnakeKeylogger)", "value": "7845fdc448fb22fc4dd8625fa0efe8737686d52c9848d9e52927a0a422a7d061e56a8f2c500b75a1b90202f8b9a7d1b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101918, "uuid": "5175878a-5cf4-46ca-a266-24e16ffd8a26", "value": "T178D41309B2FD2B46C0FEE3F7B626A865077479EB0961E25C6DA131DB2A30F454681F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101918, "uuid": "ce38f031-58e4-44a0-8d9a-7c08be212ed0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101918, "uuid": "705f44a1-7a26-4903-8237-89b5fc843f2b", "value": "12288:1y53bV/OGTSjH7poaXBeMdhjBNhi9+GO7/CCyWubLkPS7X+fXzWVY:1yWGTSHpoaIMGnlvhb+fC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692101918, "uuid": "96c6a979-cf38-4f85-ae63-5717c097e036", "value": 600576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692101918, "uuid": "59ce8947-f32a-42f4-9add-1329ffc91b8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101918, "uuid": "6012e61b-f9e3-4448-a7fd-d6c5dcddd96a", "value": "15-0209.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "effe4644-3b68-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692103238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103238, "uuid": "85718ae0-9e65-4ad0-baca-3999c1b95011", "comment": "Malware payload", "value": "15f2344b0840f63649bab90b6f49653b", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103238, "uuid": "fe26f33d-74a1-43ed-ab97-cd1e0e1d37f9", "comment": "Malware payload", "value": "16ad6e2bd4bce6939f1b743d03707fe4cea68167a6f6dfbac9061728292697b7", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103238, "uuid": "7379dbe8-8003-4636-bff9-e09330eab19b", "comment": "Malware payload", "value": "a35a5115785d3a42460c9538cc53a3798c9b364f", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103238, "uuid": "d7a59e41-a5a7-4d6e-a8f7-ced991eb11d6", "comment": "Malware payload", "value": "d2f691e8be0a94721c764ce6783e6d403376f832beef159e987f8ac23905ca26b1f0d3c09884a626b0f71a041cdb0804", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103238, "uuid": "75ca9411-d0c7-4ac4-aa40-def12f03b1e3", "value": "T168D32A83DA68C12AD3F30236F666A3380279EE9B1715928F304F71D51B33BD19579E26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103238, "uuid": "22b72a89-ba9c-49de-b5bb-6a79c73bedd3", "value": "1536:fEy5G7ivecHQb60OfWdl5PAaZ/Sv93Q28FhN4ImB:07eecHQbflfhAP8jeIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103238, "uuid": "601bb96d-48d6-4b6a-8d38-6df8122b5bc2", "value": 138240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103238, "uuid": "c19cf25b-1a9c-4bc8-ab9e-cda41c05a95c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103238, "uuid": "17d6ba72-b411-4fdb-92b0-660d9faf5e62", "value": "DHL_SOA_1301512200 Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "067f60bb-3b66-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692101987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101987, "uuid": "4ae1d54e-7f20-45b5-885d-f675de21a4de", "comment": "Malware payload (AgentTesla)", "value": "f9bd669474401ebe67afbadf8213f322", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101987, "uuid": "b2924d10-0ef5-4c89-8bc8-5237e7c60e5f", "comment": "Malware payload (AgentTesla)", "value": "1768eeca3dbf15b17955ec2e16702f1d3b39f79420e2c218c5f53019d85680cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101987, "uuid": "66b8207f-129c-46c6-be0b-bd7fa23b3eb6", "comment": "Malware payload (AgentTesla)", "value": "be70095cd545ebf06ed499fb64fe6ac1bf06a0bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101987, "uuid": "3de22169-4772-4835-b427-0bb8c54ca043", "comment": "Malware payload (AgentTesla)", "value": "5ef37d6d1c1de8b090205836983352f60666a3cebee8a22e6d72f8e8c0dc71a443f91dda930b78871812a36144e901a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101987, "uuid": "64a222ab-378b-4a91-b98a-9155e9157bf0", "value": "T100B3F16DC34F02A9CB6652779B1A0E0442FCB73EF34452B2346C937533AE82E55265BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101987, "uuid": "d91e238d-f898-4e19-bde0-7bf37f28d063", "value": "768:JwAbZSibMX9gRWjj5pcksAIRCconaHUBoJzJcBAO3MYwhLjymOQxtQC:JwAlRK5/rIRDoYJJcB533wJjymjxtQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692101987, "uuid": "5edac322-8a3e-4ed4-bdb1-95e957d6b2ca", "value": 108615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692101987, "uuid": "569d8fc7-df57-4e83-86ea-09ed1e4f5d43", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101987, "uuid": "334101dc-5f31-4281-9511-522a9de79750", "value": "f9bd669474401ebe67afbadf8213f322.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e60f704-3b65-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692101598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101598, "uuid": "74f0b1e4-9c06-4cb4-86ef-c23fbb2481af", "comment": "Malware payload", "value": "bddb0b8bb2042b41a67d09def427f8dd", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101598, "uuid": "02c3cc77-f4eb-4e55-a9da-458368828608", "comment": "Malware payload", "value": "18201e2d5849e9f0d2d963fce5e4ddd453922930595909ffe41eedca883aa83f", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101598, "uuid": "f9ea595a-92f9-4006-ad5f-d0fa22f59ccc", "comment": "Malware payload", "value": "cd01099b1226e66d29718905f63b37e57b60a2d6", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101598, "uuid": "aa6317b6-8ed0-49a7-809e-888e83875e16", "comment": "Malware payload", "value": "482e571dc5f0347aeb11d0ffb57f01be416de730053d8570e1f3470f3f329d62ed391b542272d452a374d8702a8e7734", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101598, "uuid": "71bc5662-bf52-4b67-9bd5-a6c35022f39d", "value": "T14A55F103E900DBC3D41D83F87E530EE90F0A6F19E99569DB14667F9B3B70A72099A12D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101598, "uuid": "6c793b2b-42a2-4529-9e2f-53cbfabd42f3", "value": "24576:KaZy0w6VgjKaWlEzp7aLZyaw6V4jKaWlEzp7a6zdbiMb7QA5Qp5E/kwnx:KE86VgjKjOz6y6V4jKjOzLdd7/5X/kE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692101598, "uuid": "6c2399e5-ada8-49d2-ad48-ee7db2e4aeed", "value": 1329664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692101598, "uuid": "afe594bc-3d90-44cd-9ee7-bbdd6c8d9cae", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101598, "uuid": "76152ed0-5398-45f5-a660-9fff219ab100", "value": "1212-00-RE-REQ-649-01.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70d372b6-3b46-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692088422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692088422, "uuid": "19bc065a-5ac5-4314-9132-c07d5cca0c85", "comment": "Malware payload", "value": "8545a5dfbcc4bf31a2099c2494c88c27", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692088422, "uuid": "b005eeb7-152f-4a03-b6b3-c5ad54e9cd19", "comment": "Malware payload", "value": "1a0115915371f50f855b44b31f3bda9db3a0ce9f8a438d56b0125fc3dad3e458", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692088422, "uuid": "831e5230-b345-4f44-a09a-48710cb24bf7", "comment": "Malware payload", "value": "1f9c6f8563e52c558c6878e0eb9cc9cea82209da", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692088422, "uuid": "3988761c-1330-4467-a0cf-ec6c556a741f", "comment": "Malware payload", "value": "3b16add72bac58e999a45f465d980d7947df35a3931cb220fb4a1c712b235c29e8ac0a8271c1e02e8ad44d772c348ad1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692088422, "uuid": "9426a2f4-d2c4-474d-a61a-2db7ebd5fc43", "value": "T1CA935B11B6D1C471DABE19361420DAB54B3EB920DEE09EAB37A9067D0F302C1DE34D6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692088422, "uuid": "83a9cd1c-b35e-4cb4-876c-b09d23f4fef7", "value": "9de2c5f4e7412eda6daeaef638405b83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692088422, "uuid": "acdbf1df-7ef2-4d76-9565-75617977da71", "value": "1536:DN/SnqpFxn09e2LFUQKsKLjxkflHlX8/S0ElsWeWcd+WoLC6W9hCbW:B6GFxnA1LFFOLjKE/Lv+WoLCpsbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692088422, "uuid": "f28a142a-44f1-4777-ab00-2348f69b7b3d", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692088422, "uuid": "124fe0c1-913a-4c22-8d16-2aab8dbef18e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692088422, "uuid": "9555fc37-a7db-4c2f-aa95-cc8767fbbc42", "value": "SecuriteInfo.com.Win32.PWSX-gen.24395.25569", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "987b558d-3b67-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692102662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102662, "uuid": "d6904ed9-6339-4f4c-981e-52ef1d65f77b", "comment": "Malware payload (Formbook)", "value": "903d5f8adb6f17e25f419df6db9c6a77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102662, "uuid": "277c34d9-2259-4e2c-a2e3-8adfb695d0fc", "comment": "Malware payload (Formbook)", "value": "1a4a833905ed2b06f990054eee77c7f92d536d52797c6a18de6d1358e25e8e03", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102662, "uuid": "4ce7e83b-6b33-4378-a730-387e38cc54c4", "comment": "Malware payload (Formbook)", "value": "fce9ea598fe363e63da978f73ffefecc4eb5d14a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102662, "uuid": "8a4cb86f-110c-4583-bb21-9b42811c65c9", "comment": "Malware payload (Formbook)", "value": "d8589f1436441eed380f4acb6ccbd1db593f6fe637a51fc8eb24ef976399e713180e71d200a95f652a69e88ab24bc014", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102662, "uuid": "01864840-3c48-4591-81cf-49d8a7fbb590", "value": "T1023412657BE0CC73C8531270483B2BB36BEE5A1137688B6B6784A616BD706E1C45F363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102662, "uuid": "18942d85-34fa-4c74-8327-bf5266730a7e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102662, "uuid": "bb1e773f-54f3-4284-b846-48670d486d40", "value": "6144:/Ya6OwFfQ6gSHboaP+zYy2UMNXt2KCGkcAdw3ZXNyT:/YYwG6gSD6MNXt2v3zdwp9yT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692102662, "uuid": "6f7a33eb-b787-46e1-bcde-b69298282108", "value": 244256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692102662, "uuid": "8defcf89-0544-4e17-be89-365646b855b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102662, "uuid": "840fd5a5-922e-44cc-9694-21d3906c69d7", "value": "903d5f8adb6f17e25f419df6db9c6a77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51681d3-3b65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1692101958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101958, "uuid": "51f04da1-dde9-4d9a-89f6-68a7f2c7a36f", "comment": "Malware payload (SnakeKeylogger)", "value": "24c2daf1275fd9679b45b919a7df7a5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101958, "uuid": "8daa2b43-4879-4952-8969-22008bf4ee76", "comment": "Malware payload (SnakeKeylogger)", "value": "1ab3c976c7751f3252dd4b53bdc8eb7a5a6d42006dec7b01da7a72f7addb3518", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101958, "uuid": "ba1479af-5297-4a81-93ef-c4a5a2937630", "comment": "Malware payload (SnakeKeylogger)", "value": "888db1efea5ec2f3af21a4089f7ad9812237cf70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101958, "uuid": "8953c242-d83a-4095-a083-9242321c55d5", "comment": "Malware payload (SnakeKeylogger)", "value": "76187d2e2cde4bcfc98ec64fe452112033ef8521979ef57192cc3ec8074831f104f566ad7d0e78f10bc8654f6fc4b7a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101958, "uuid": "c2b945e8-fd06-4c28-ba1c-363aa20b1b36", "value": "T165F3170BB78F85B2D3451B7EC7AB523003B1DA96B3B3C24B744D23151B027F99A6664B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101958, "uuid": "9abf8f72-203b-4fa5-8d09-f3aaae4611c5", "value": "3072:p0ADW+CcjLpoljCyiTNtHaZM935btdfhAP8tk:zIcjtKV4tHb9pJAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692101958, "uuid": "894e74e1-e821-409f-9d53-63bd349dbaae", "value": 158208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692101958, "uuid": "37b10b4f-9746-4f25-b6e2-d80ee1d0d0c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101958, "uuid": "80355122-a337-4226-8402-fedf62063d7b", "value": "Tkjbas.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "263ba35c-3b66-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692102040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102040, "uuid": "d971bcad-7c5c-417c-8c96-7c93a143f206", "comment": "Malware payload", "value": "6827a70838eef599cbca7b072ed186d2", "object_relation": "md5", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102040, "uuid": "709b57c2-59aa-4f36-b22d-ff15cb36c7b9", "comment": "Malware payload", "value": "1b48e7513cdc33036bc7172bcefbc8b197bb698ca51066d28f15c8478c9592fd", "object_relation": "sha256", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102040, "uuid": "de3dc9b8-bf0b-4a0f-b891-1133cabbc37f", "comment": "Malware payload", "value": "a8bab359dde748e8e7574ffaa4a720df0a2dcd9d", "object_relation": "sha1", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102040, "uuid": "3b876d6d-0436-46a3-b6c8-ccaf17dbaa72", "comment": "Malware payload", "value": "e505ec35233c370a1490f733c2d9a0b2208e2bdbb9842c3fc25d3ad58ee0521a8ea644fa316e0a865bb09d3fd4aa19bb", "object_relation": "sha3-384", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102040, "uuid": "f0f3bf0a-7bd2-481f-b09a-3d08c07484d0", "value": "T101D4120672C6EDCBDC7787389CD381D2150AFC125AA6C5C731C5B36E0AB2DA5C61B3A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102040, "uuid": "2fe21291-2b7c-4a2d-84ea-62453b7de618", "value": "12288:sTV4XiykbvXp7XXXXXXXXXXXXUXXXXXXXXXXXXXXXXzX7xvgerjE4gmViJhm6S6X:0+6bvdXXXXXXXXXXXXUXXXXXXXXXXXXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692102040, "uuid": "7907d2ac-8965-424c-929b-8ee1fe344999", "value": 639488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692102040, "uuid": "4b2f7806-27f3-454e-94b5-cb68a2996e52", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102040, "uuid": "87229ca0-9bba-47f1-895e-609654a1b05c", "value": "Facturas Electronicas.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff1d0d8b-3b1b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692070192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692070192, "uuid": "2d706171-4f6d-470c-ad0c-f4220dd59e9b", "comment": "Malware payload (Loki)", "value": "3aeb4b62649a26ef25196af9c847e1c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692070192, "uuid": "33589280-80e6-4d22-a419-f0ca1a7ab053", "comment": "Malware payload (Loki)", "value": "1c930869dd841eecc220281c31c590deb042a5e0eed2e022dbdebe9514628d72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692070192, "uuid": "51e0b9aa-ae41-4451-8280-532d45284b10", "comment": "Malware payload (Loki)", "value": "8f5ddba03c263973c9190ae9f84da3ec1a906b72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692070192, "uuid": "139d0ee1-b0a3-4c4e-9d96-e4c487ad8889", "comment": "Malware payload (Loki)", "value": "22634549cf9ff493f22b8bc72f9d389ec2b0fd92df1acfcefde414eea0903e48910f9516b420f3df9fe423a323ddd936", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692070192, "uuid": "be717145-5859-42e9-88c7-00922ec5b050", "value": "T172D47D74069AC50BE45B1B34D8F2E3B57FA98F90A2E6C3474FE47CFBB44A15A66910C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692070192, "uuid": "28065ffc-6c3a-4f03-af44-c62440b36359", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692070192, "uuid": "6c2dd49d-eed3-4786-907c-1633ed74cf8c", "value": "12288:ntBipNB27TPpWSZdGS3Ur6f01uakF5uY:tBseAEb3Ur6fEupZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692070192, "uuid": "81fba11b-2f8f-4e60-8f32-eeb8bec13420", "value": 638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692070192, "uuid": "25018ea6-b953-4033-8497-9d403e56e7a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692070192, "uuid": "6158c0b8-6366-46d6-b72b-fdf744bc4009", "value": "SecuriteInfo.com.Trojan.PackedNET.2249.3283.26651", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fee3026e-3b59-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692096820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692096820, "uuid": "e1732a45-e325-42a0-ad04-0430495739ae", "comment": "Malware payload (Mirai)", "value": "7ba1f722bd7b036b5799bf495eb1690f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692096820, "uuid": "fc58b926-2611-4e65-8f6a-9f83ad4b4916", "comment": "Malware payload (Mirai)", "value": "1cdb4afbb7894662f0c6dfc6a9401137329332908850414476aefdfda839b5c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692096820, "uuid": "03d81025-1e80-412b-9bfc-74c108c751cb", "comment": "Malware payload (Mirai)", "value": "5e5f82ee2031f9d8d635f043f1eb638e5df53d2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692096820, "uuid": "5b333d4d-114f-44d1-b63b-14610414ec1f", "comment": "Malware payload (Mirai)", "value": "55094f331b0e7cdd86cdab98878f80a5824a084a7de49b14e9d72389d9cfffa3f253604576232eaa5099d26f8c43d7b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692096820, "uuid": "6add28dd-17f3-40ff-a2a5-73d427868c4b", "value": "T179B3D86A7921AFFEE06883310BF7AF20C7D521D626915386F15CE7585E3128D2C5FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692096820, "uuid": "a5196b8d-daf6-4c41-af87-3526eef95901", "value": "3072:C/4g3Kd1rR5hZmxgA9OKdwwjF9GhsR1Ae:O9anR5hZLHKdwwjF9GhsR1Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692096820, "uuid": "90d171e4-404a-4815-a946-b61e3f9e0269", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692096820, "uuid": "da224169-6be3-468e-b8eb-4fe2bc51a24e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692096820, "uuid": "ae8b15b9-1d86-44cf-86be-d8340f1075d1", "value": "7ba1f722bd7b036b5799bf495eb1690f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e84919c5-3b57-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692095924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095924, "uuid": "688a09ea-69f0-49e6-ab8b-93b7c86f808d", "comment": "Malware payload", "value": "790c308405d4a417ae223ec283a2386d", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095924, "uuid": "998c1ee3-e513-4f5b-ad60-9add38cc8288", "comment": "Malware payload", "value": "1db4e8b86635cf6ae188aaec4634a86ead52c4098868abdd9a2d9f2705a35c5e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095924, "uuid": "5caa2de0-5653-449f-bcd2-6e2278edecd1", "comment": "Malware payload", "value": "1661bc44554986a5cf9639f0b183da79f658b16e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095924, "uuid": "c7553596-0c04-4f0c-91ae-541deb18d957", "comment": "Malware payload", "value": "55e33ef0b2f5472962b118aa91e7e0368190738ee71cc52a8ddc9157571954a736af4585d2345ec9555e40eaaa69faec", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095924, "uuid": "bcbb5939-963c-490f-9302-bb87ddbc0809", "value": "T118D423D6F69D6822C31EE870CA5F8B2A1FB7958252C935CCC4EC6A6457FA5D001283F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095924, "uuid": "de6b8b96-3ebd-4d94-a077-7a49c8831ab9", "value": "12288:Vn4UVS79SMxBWUffhtlWdnxrmR4PMODBckf8G:R4UVW9ZxttKVGeXpf8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692095924, "uuid": "b7dfaa7a-e4db-4735-acba-b9abc0be7498", "value": 627667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692095924, "uuid": "5ffe7752-d857-4662-9b57-7384d169ac41", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095924, "uuid": "a93b3f68-d7f0-439f-93cc-7c3f7da4f088", "value": "ORDER INQUIRY_1.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c902b3-3b3f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1692085311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692085311, "uuid": "7e8b300e-6b64-4624-9707-1cbec5676f4b", "comment": "Malware payload (RemcosRAT)", "value": "8219e1465ea5fd7493b549131ca0c252", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692085311, "uuid": "4d7d0c66-be4a-4509-9f82-0279f2019806", "comment": "Malware payload (RemcosRAT)", "value": "1dc956e63de5d215affd069b51583b48ef32a0632016c5fbce6482b8fcc3e877", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692085311, "uuid": "c9ed63f1-3972-431b-abc2-f469c50deb8c", "comment": "Malware payload (RemcosRAT)", "value": "3f4ad39c829f9ee919a6304faf439000686f93e2", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692085311, "uuid": "42d0940d-58d7-4905-b394-6023c5a5dbe3", "comment": "Malware payload (RemcosRAT)", "value": "d684eefe4eaffd4e2f5d07e0e1468eb3fe8a7e27ce56cb198d1d13b22b6f8005cf72fca5ede7bab63d45e7f85146b4e3", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692085311, "uuid": "e07f5e78-881d-4e84-ae8f-88c2be6b7d7f", "value": "T1090533EB717DA30EF35EE5BC969F36BC981D2DD2A216DF3C401090429F241F19B28665", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692085311, "uuid": "476920e0-6baf-447d-b711-d1b6683387cf", "value": "24576:1UN7+aLcxhfqyXnb7KQ50skh6OQsL0FvwA:6NSH3BnXK00s1OQsAvwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692085311, "uuid": "a7ce8d08-b3cf-43c4-8e53-c577c40d401c", "value": 862216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692085311, "uuid": "f8ecd6b5-260a-45bc-a26f-34e7d381b43c", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692085311, "uuid": "6ffefd8b-3ae2-47ff-84a4-8ef444a03d0e", "value": "CFR Jebel Ali 1-40 FT FULL.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "114e558d-3b46-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692088261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692088261, "uuid": "a7c11710-a856-4a1d-ba3c-3aa9a5d2d71f", "comment": "Malware payload (AgentTesla)", "value": "29c895fe347e4071ad93a0d7eb0e2758", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692088261, "uuid": "c5da1578-a9a5-4410-943f-6139aa7584be", "comment": "Malware payload (AgentTesla)", "value": "1f3f6661aaf43ce9207addd476cd6dc16c4465060720f32ec81087441d97efd0", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692088261, "uuid": "1270d086-c27c-4c63-903b-804628810a9b", "comment": "Malware payload (AgentTesla)", "value": "d850b12e676d0fb439eddab9ff6239e5f8017018", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692088261, "uuid": "34864909-2fdd-43a9-9ee0-11e80c447313", "comment": "Malware payload (AgentTesla)", "value": "374c8bed943c985a5053444bd25beb7f3b9f9e02c06de6c9005481c218afbf39eb5d2bfbe1b85df694c0658c8943092f", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692088261, "uuid": "47bfd779-691f-4469-ab3c-4b7c980452c6", "value": "T1D9A4238B2A4CEB89E2E8736142673916E33B5170694C77295118FAE35B0D3C3F4ED6D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692088261, "uuid": "cb0ea35a-5f31-4089-bc78-18f7094793e5", "value": "12288:DcNlGHcenqYZqWPsDyLzmSQrgCDL7RsxZofgiJSqI/gf:DcNo9qZWPIyLlegCDLqxKvrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692088261, "uuid": "7734cdd8-4f2c-47e5-bc6e-4c50722653d3", "value": 471466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692088261, "uuid": "187975f9-9333-4e72-92b7-07cecb26ece0", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692088261, "uuid": "17e1a0ff-37aa-43f6-a9c5-ec16280aac62", "value": "PI for project cost PA-01-zipline until June.13th.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "468c7906-3b8e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692119275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119275, "uuid": "0be184d0-3099-4eb4-b46a-795c9815fe0a", "comment": "Malware payload", "value": "722dcf907f429e2331565296b6258b06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119275, "uuid": "7dce965f-b96a-478e-8234-9c5168b18531", "comment": "Malware payload", "value": "1f9c833f136e65fa7cff7a73a14c54b8bbce04d193205aa2d3acdbcc6c8cd2f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119275, "uuid": "fd67df9b-0f99-42f9-9383-72faf06346e2", "comment": "Malware payload", "value": "d37ad4ee39b3be2958b6224b8b9e3a6acf28761d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119275, "uuid": "d593d2eb-4ca0-4295-9d04-3bd5380c559a", "comment": "Malware payload", "value": "d0d0251461d19f20d3f4b8ca6205399b05f490d18a84ea58eb0ccb2745f515b9d3fb9f4714639c0d4f451811de0049af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692119275, "uuid": "ec785a03-8e6f-4ece-80cb-ef285e0f08ec", "value": "T109C1B61193D48737D9378B35EC7387812378A765DE676F9D58C8224A6E313848A63F31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692119275, "uuid": "664fa38d-38d2-4841-9e4c-641df7da5e89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692119275, "uuid": "02d0cb31-5482-4681-9b7c-95a2a725c82c", "value": "48:6D4CQkW6bLGhdfjX/BAKbQ89jNM0LEimgGajgc65sbzNbMGUCtDklj2OYFypfbNM:gbb2vBxpLEipGa8H52zNrMcEzNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692119275, "uuid": "900b2e40-0b82-43e9-b639-89884424b3e6", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692119275, "uuid": "7adc33ba-8a0c-445e-8cd8-e883e5dc5e00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692119275, "uuid": "1ca10024-a3bf-4697-9cee-1c382d56a5e0", "value": "GGsGr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f81ff2-3b7c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692111511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111511, "uuid": "f7a0fdb1-b6ed-4a4b-916d-4c61f34132de", "comment": "Malware payload", "value": "b4d759b172a725c6e18cb6384b999e96", "object_relation": "md5", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111511, "uuid": "84aef43d-92f0-4b44-b583-57570396b163", "comment": "Malware payload", "value": "2002a0e3336e00e4748c5c202c179c40cc426262c3cd5f43d128cb60f4908f00", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111511, "uuid": "ec878634-147b-44fa-b5be-185d81bf2ec4", "comment": "Malware payload", "value": "5d4c766d43d0ff245b789ea451a8df4726591c45", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111511, "uuid": "b10dd8d2-6e1e-4e81-b121-c096f1139471", "comment": "Malware payload", "value": "bac20001fe97b099b7faa809243fa1ef21b45cd29f84d133b097ef4c3fd1ddc490f18336dae5de5d8436d19e0fbb3054", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111511, "uuid": "5ea88d1f-e481-4849-aeaf-49b03fc3a273", "value": "T1C7516329E50FE459A9B593698D87A638FF3B80AB66505548B3CCD22C0F30829037CF8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111511, "uuid": "f69c16e2-52e5-4463-a40d-08cadf45bcee", "value": "48:6heZeWgVTzP4XW4jVuKmc4TQuzB1RVIxdkmm1ml3fkPuN7VL7+H:6hLWqb41rujsnhm1ml3IuP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692111511, "uuid": "867eb25b-6075-4ea3-8356-e6c0219c3167", "value": 2576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692111511, "uuid": "c6ef6968-b405-4668-9333-b2a170b5ebaf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111511, "uuid": "18ea04f0-d334-4cc6-9368-1d71315fa3d9", "value": "XadYaEyD.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db878f2-3b7b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692111180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111180, "uuid": "858a5410-114d-4a9b-b44e-e0107c0690c8", "comment": "Malware payload", "value": "b57501ee6a7cb089d3eb641236aae267", "object_relation": "md5", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111180, "uuid": "1a4083e5-bb23-4aae-8ad2-f700fd695e31", "comment": "Malware payload", "value": "20e6c93e0de25499282bc4aa8525c5c6d5f5c4761e5738b1b3bcf5f370d687fd", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111180, "uuid": "3bb0683b-04ff-4154-92bc-f30ea9b32c61", "comment": "Malware payload", "value": "c10a241e09e69fbf378fbd2efeb88bdb10cb4aaf", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111180, "uuid": "ef824312-4aa5-4800-ab5c-8f84f2e74603", "comment": "Malware payload", "value": "7b72e962c07f312f6d25b6777b994437a0ddfc5887fdf01562a4cb67056359ef635a1ec9a575848982e92430110669fb", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111180, "uuid": "522ac5b8-1c3a-450e-9638-9b38e5ae97b0", "value": "T1B24193BB4382316AA3B30094D782B043A69590CE9C1F69087BDCB60BE7C132A43A7B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111180, "uuid": "654e023f-6825-4dbd-b858-e2d836bbacf1", "value": "48:ruHGC8xjSvb29XY2CQpScoQ+JwpAikSE09TZOp:rBC8YT29XfScx+mpAhL05ZOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692111180, "uuid": "981e57fa-f4ed-4a5a-a248-82e80798da4d", "value": 2015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692111180, "uuid": "1bd3b16e-3e6f-400a-8d2e-bc658fce567f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111180, "uuid": "0d021e27-8cbf-479b-b323-b6afd8732530", "value": "wrj4MB6C.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06fde89c-3b36-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692081372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692081372, "uuid": "9ffde292-0bc9-49ae-80a4-0d9a01d84fb3", "comment": "Malware payload (Loki)", "value": "b4ede3be28a02d4ad6033d5e8021e2f4", "object_relation": "md5", "Tag": [ { "name": "2-59-254-19", "colour": "#753BC5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692081372, "uuid": "f225b373-2522-4245-a71d-8bf045df159b", "comment": "Malware payload (Loki)", "value": "212e4c51115bebfa69d6d30e01d9cbfcf1546419d776cb906f7afd0219c61499", "object_relation": "sha256", "Tag": [ { "name": "2-59-254-19", "colour": "#753BC5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692081372, "uuid": "c8f7e29c-c3cd-4847-9510-6f77cbcc183c", "comment": "Malware payload (Loki)", "value": "f1ca92cadf1ec74db2599909987f4bb0fad77e4c", "object_relation": "sha1", "Tag": [ { "name": "2-59-254-19", "colour": "#753BC5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692081372, "uuid": "02a1a664-5a0d-4b87-9aa7-7c1ac0523b7b", "comment": "Malware payload (Loki)", "value": "feb39d11232fd6342a64516916db52f37e63d3624fb2fbdcee88c457cea799f1f8c74c05d5e6d4628e58ca5579e670e2", "object_relation": "sha3-384", "Tag": [ { "name": "2-59-254-19", "colour": "#753BC5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692081372, "uuid": "2331de58-0964-4675-b9e4-c21204058c72", "value": "T171D46C7406AAC50BE45B1A34DCF3E2B57FAD8FA092D6C7474FE47CFBB44A05A6681090", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692081372, "uuid": "1ea3fe7e-5ce0-4015-8a57-4e62cd4ed143", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692081372, "uuid": "8c19058b-0434-4314-a346-a3a3dbaabbb5", "value": "6144:1tT+iT++TksVGd0WF/eQPc/Rexbp+pEW1wzIJb+B7HAHBJkPjUyp1I2Rg0cGqT+:1tBxksId0CeQc/MfaE0wEJwAipNDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692081372, "uuid": "5292cce5-2684-4755-a8a2-ab4459777069", "value": 637952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692081372, "uuid": "c078e684-320a-422c-832b-4fb5ed224ba1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692081372, "uuid": "bcb573f0-e4aa-419c-8c4c-b0bcefb28a9f", "value": "svFG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb220a50-3b68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692103257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103257, "uuid": "7166e3ad-d394-4eea-8f59-65d31684d593", "comment": "Malware payload (AgentTesla)", "value": "de215cdbd095d57d1b6a321da4d0d99e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103257, "uuid": "f546dfba-7121-4a67-86cf-c08f5546061c", "comment": "Malware payload (AgentTesla)", "value": "21483170e580b7ac7455583b9c8232e88667cc1da02d3dfa8e443b821bda607d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103257, "uuid": "03c33d25-922e-4186-b2dc-5f39593d0041", "comment": "Malware payload (AgentTesla)", "value": "42b8c9ee61af9bc1bcb995842c5ae1849b57e90b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103257, "uuid": "639bf567-3d85-4e56-8623-f62c51a0fd8f", "comment": "Malware payload (AgentTesla)", "value": "9f76936308bbb0727db74991d59e0a43485b58f98e00b66e72baa08fe2f44ee61451560787264e7f2072201ea722016b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103257, "uuid": "fdfdbcea-a712-48a3-a36b-ece19e6e8bec", "value": "T1A9E42311051F680AE218D93F08217A163BD6F63D46A5278CF9353E9931BB6F70A91ECF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103257, "uuid": "fd5e0ccc-3bb2-4091-8a04-6b93cf31d381", "value": "12288:Su4RWAt4cfrZtdD2maN+FvknujWbHb48A/S9iB+oPd0pJSArywW9y:LQ35rZcOsVHMrjYNJSArH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103257, "uuid": "9c832213-a828-4687-b03f-eb3de790b6c7", "value": 670172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103257, "uuid": "136e51ee-d0b9-4b25-a553-ebf425328a8b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103257, "uuid": "8607f49b-6b7e-45b7-9bb9-7f9785c8ebd7", "value": "PROPERTY DETAILS_561T816188.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e73258-3b4f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692092113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692092113, "uuid": "4cb68b4d-e84c-4a3d-9ad0-77e084451354", "comment": "Malware payload (AgentTesla)", "value": "a5e45bc5619fc8e0bb1188f7937d09d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692092113, "uuid": "bdb9776d-ac95-462f-890e-ccc59d5b0771", "comment": "Malware payload (AgentTesla)", "value": "2151303192cbe83ed143e84e10c0a01e72522f472859d216a5820ba5abdedd8f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692092113, "uuid": "f5656f1e-e3bd-4d11-aef6-b7aa5decf3ca", "comment": "Malware payload (AgentTesla)", "value": "d38051dc87eee538e9ce628d4f7b74a1458425c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692092113, "uuid": "24531ae3-d0c1-4c1f-80e4-ff8a6d3ed2eb", "comment": "Malware payload (AgentTesla)", "value": "4c678efce816fca81368933170df9e6ac88790e3fd320b1f1b6f7d83db3a1ff526ce11c759aa9c3daea7f44fc6e2446c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692092113, "uuid": "9ab4bf6f-a78f-42b7-803a-26149be20e95", "value": "T1FD55CE067789CF71C10F0675C8AB82F41327AE40EE52D7CB768DBF1A3AB27A95911187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692092113, "uuid": "144cd263-1cf6-4efd-9a2e-8a55e2f81d75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692092113, "uuid": "47315e19-bfed-49d5-9d24-42d282621167", "value": "24576:tFuYrMOGLh4BtOVTx7246A6SNaGK+ofFDAVkyc2DQP9Yn5AMK:O4BtOxx7MA6SNaG0FDAV4Un5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692092113, "uuid": "419a3211-86e5-4cbb-8fc0-b642d2b36ff6", "value": 1337616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692092113, "uuid": "4597339e-c560-42aa-bbea-03a625ee6bfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692092113, "uuid": "f11864d5-dece-4316-bdf1-5f11e3f30f9f", "value": "Fxquxn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd8f09ef-3b7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692110992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110992, "uuid": "eecf0381-e6d0-4bb0-8227-b2fa27a772cd", "comment": "Malware payload", "value": "1e5832634011ff2a36dfc81eb1d946af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110992, "uuid": "66cae786-8cb6-439d-ba03-89ebb1294ce3", "comment": "Malware payload", "value": "23417e5b6358aecb85303f8d1f72a37135379083031b05bb9146f39e4a8a0617", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110992, "uuid": "09876e06-1cd6-4de0-8a8d-755aa10cbb28", "comment": "Malware payload", "value": "b6d49fdcca48b8af07cddf7d6e1166b873c65f70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110992, "uuid": "98c12484-6ddd-4a2f-8a4b-6c0484dd30ad", "comment": "Malware payload", "value": "7cc034a3aea660e3e8eda80ef5ea97ced5225d8bc5de589aa55df7801b0719bc135eaa92ed99aacd71cbdc9f093349ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110992, "uuid": "d3f1701d-1220-4494-8ff1-534478995600", "value": "T14F236D4037988136F6FD87B4ACF392418679D66B2D03CB596CC811EA2B13BC596136FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110992, "uuid": "30545de6-ac89-4c62-9a0d-3a70199c7a89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110992, "uuid": "00b81a47-48af-4cd7-a404-3fe0e17a1d4a", "value": "768:BOEuILWCKi+DiPa/6oDXsijHR8YbPgQYYvEgK/JrZVc6KN:BOtm3oDXrxzb4jYnkJrZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692110992, "uuid": "2a37bc84-c223-4aac-84df-4ba7545217fd", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692110992, "uuid": "85cc8cf4-0705-46f7-83ed-484b57468786", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110992, "uuid": "7422e49b-d649-41c0-80f1-22514c3d7d94", "value": "decode_72747d1f4a59552a9d17009c89172a9603b7da18218927fbd4c32bf1786ef645", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0425b8d-3b40-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692086058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692086058, "uuid": "91e91798-e8ec-4d82-8b7e-b07712172efb", "comment": "Malware payload", "value": "dbc429c42f2310c86dddc48e509928fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692086058, "uuid": "1efc14ea-bff0-47bf-abef-64b5f435b839", "comment": "Malware payload", "value": "2371d130dc05c15b9671bbc90d6de78634eb680663013508d40876b49f1f903a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692086058, "uuid": "aa18e5ce-1398-40df-a435-4754fdbe3ec8", "comment": "Malware payload", "value": "bc5acd0604d04653b5e95d40a0fb547ac514c3b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692086058, "uuid": "278def1b-643b-4a67-8ad8-6ab0cdb66b79", "comment": "Malware payload", "value": "a2f961e2d9b0eff50ad5bb08b1ddb9b2802570db5e4814a2881313417d615f11f790566087945e425f5c88a0b2625b5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692086058, "uuid": "5e677dbd-534b-454b-b727-590b5262b07f", "value": "T1D2E4022973BD8E23E67D9AF5D4F5A55803B1681A1D3AF2EC1CC135CE21F6F481901A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692086058, "uuid": "34ab157b-e426-4e43-9935-58b12eec768e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692086058, "uuid": "2c73ead4-28e4-4bb1-bdc2-7b99d3006d2e", "value": "12288:cnjOMxnVhS1r0zAagvubqNycfQDP+/QGsaFUpnZvqYD0quvm3hSbH:cjOMxVhSBaW3QDG/QNaSjvr07z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692086058, "uuid": "55117b98-df7b-4411-b899-17d636d008aa", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692086058, "uuid": "d106b6ae-bc8c-4b96-a51e-58157ec4ceb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692086058, "uuid": "34127758-b10e-473a-962b-baa75cf05cdd", "value": "sjx8l2eeWUxhCoo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3b2f40-3b8f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692119717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119717, "uuid": "a9695e32-75c3-4bdb-a417-0254c8e65ad1", "comment": "Malware payload (Mirai)", "value": "2bdc8dc683140a38af54be24e8fa4a86", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119717, "uuid": "734f161b-bd0f-4b7c-98a4-b4a678d711e6", "comment": "Malware payload (Mirai)", "value": "2394d5a0413035000e072bd88e7e9dd35843ef8412bce7bd35606000db267232", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119717, "uuid": "2d0a09ba-ae14-4061-b86f-1da531135e0b", "comment": "Malware payload (Mirai)", "value": "a6db54bee9c43e708657288ce07413f30b5eb531", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119717, "uuid": "cb2f3bd1-219a-41a7-bcd1-4420634814f7", "comment": "Malware payload (Mirai)", "value": "3bae303f0c8d8eb128caa49ed3bd2cf32c7e391472f217799aef89a3ae4903a1a0fbc3306d849ccff555ea693953b3b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692119717, "uuid": "497fbde8-587e-4a6f-b749-7c6359ecf440", "value": "T1EFF3C70AAF610FBBDCAFDD3746E9070139CCA41722A53B753674D528F54A60B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692119717, "uuid": "55e28525-018c-4e65-95b3-df5f8c69397e", "value": "1536:71dTIi8lZqpr8RDYo1AE4fIBwvs9zLQivzRQlIhrWzG/1fKkUgP35uV:71dUTZOQYCcs6orWzGtfx35E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692119717, "uuid": "e804deef-aab8-440c-af56-8569e87ec939", "value": 169268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692119717, "uuid": "25d4e343-f43d-4f68-aba0-b9ec355231ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692119717, "uuid": "60f6d7a9-8927-4bde-9bfc-880d2b39842e", "value": "2bdc8dc683140a38af54be24e8fa4a86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "721af984-3b65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1692101738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101738, "uuid": "7558d33a-3b57-42d0-917f-19ecfabe2448", "comment": "Malware payload (RemcosRAT)", "value": "4b59ae832c87b58a2f198f9bfe8d92fe", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101738, "uuid": "e028f4ed-6105-48d4-8971-6ddfd9852c5f", "comment": "Malware payload (RemcosRAT)", "value": "2470f5cd9fcdd5fee479668698bb2b5d09e8319caf8ead338a8c776dba14064b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101738, "uuid": "83d9ccb4-cce0-4218-bc67-943b70c716ee", "comment": "Malware payload (RemcosRAT)", "value": "3b4b248083d2b190e7cbc5e772f324d2956045e8", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101738, "uuid": "ce82e736-190e-4c31-b84c-56227035eba4", "comment": "Malware payload (RemcosRAT)", "value": "f3b34bab5db2ac886369c05096dfd80e6b63ef3ad0c8b64c9bd8b563d4b8078fdcb2b36f23411b31f1dce336bf0f0d5f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101738, "uuid": "261d5fcd-8633-43ec-a8d2-6f99c455c2bc", "value": "T18B35367CFD227663CA9F0D734DD3D47686340E12775B98F400DBB2D6BAB866895002BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101738, "uuid": "58c7b036-5bfb-496f-9ec7-33f40517a301", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101738, "uuid": "15042d09-29c5-4f4e-b84e-a2a9b3b73b78", "value": "24576:zHeuWCXd1UNe9aepFenMQGsvZT+mQdYWEqUkpn5WN4iWkx8:B1UNewnMQGKU19UWwxP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692101738, "uuid": "e01773cc-603d-4282-a522-4b66c288135e", "value": 1115648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692101738, "uuid": "317b8bc9-2172-4960-8eb5-1389ce43d83e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101738, "uuid": "546cb902-375e-4d49-a2a0-7938035bba88", "value": "Kopija za plakanje_ Stopanska Banka_Pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15794797-3b46-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692088268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692088268, "uuid": "15567389-07ef-425e-b5a9-5448976e8968", "comment": "Malware payload (AgentTesla)", "value": "af7de1d044c1d002cbdd3540c03a83dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692088268, "uuid": "6dba619d-db79-428f-8701-73ccddeaeef1", "comment": "Malware payload (AgentTesla)", "value": "24f72de47dc358a8ee0f81402576425a5bfc70e54b653484deedab40da7f93a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692088268, "uuid": "d540635e-d451-4d73-9292-31275674203e", "comment": "Malware payload (AgentTesla)", "value": "24d17486e7398e7bd2aae69c842ab028f7706b25", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692088268, "uuid": "de42fbf5-4b06-4251-b27a-f48c670cb3cb", "comment": "Malware payload (AgentTesla)", "value": "c063174a76849e8ef141d9e4423075bba7b965744599b6f62f7604fa764794bdc4d60c40a20890073495d1f4be32822a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692088268, "uuid": "3fc859ad-497d-4172-8438-2fe156b61873", "value": "T1532550B1D7379959FE04A6FCCADF80313BC788B0E0A1C48873F26B0A5D92F5159296D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692088268, "uuid": "303b8a4a-2ef6-4f88-9be4-108b4ad36f8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692088268, "uuid": "f6d7179a-7613-445c-829f-456f1e8e7453", "value": "24576:QOguuZZiIbW/ecCDLDx0O7Rs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUO9:4uAZ7W/ecC977Rs6CE3jLbO9Rs6CE3jE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692088268, "uuid": "842eaa47-e38a-428f-ba1f-15c9ca9b24e7", "value": 966144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692088268, "uuid": "f670ed73-d32e-42fe-a104-6d37bbaeb780", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692088268, "uuid": "34f72e68-78f2-437e-9f08-6d88873df11e", "value": "PI for project cost PA-01-zipline until June.13th.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0898c05b-3b39-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vidar)", "timestamp": 1692082663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692082663, "uuid": "22b7fb14-a1a9-4cb7-97ac-688e6b5a9281", "comment": "Malware payload (Vidar)", "value": "3656380b872547ff69f460c90328d257", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692082663, "uuid": "bcd1879b-bef7-43af-8462-856cbb0aa979", "comment": "Malware payload (Vidar)", "value": "25418f9accfaa84b3ea5ef662fc2b24f9782d1e2e00c1303f879f11afc2eec7b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692082663, "uuid": "4281c68f-009d-4755-9eeb-ecaf7edd77ec", "comment": "Malware payload (Vidar)", "value": "d9669ed63561e3419900c72207a66f9443e26075", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692082663, "uuid": "7782edaf-613b-471c-9244-ab1d52b6ae60", "comment": "Malware payload (Vidar)", "value": "e3dc37d7bfa77711ff211a135a22480822ccd9131d57ddba8ae45fcd89b5fde6fbb11c01e2038a38f55882dd32b8373e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692082663, "uuid": "9c6a5c99-123f-4ae6-9894-f7b6419a292e", "value": "T177747C26B644E031D5A210FA8E79F7B2147D7871271694CBFBC41BA96CB01E26B7630F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692082663, "uuid": "1a5920ee-9bcd-406c-89bf-aea0c18f8944", "value": "ab80a09718062de1bfe3a2139595aff5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692082663, "uuid": "b2b66239-289c-4ba6-b8b1-778a3c42a17b", "value": "6144:h2+XqGAdyvA944aSL0g7SLjxhDOfeNROhXkO6J5+UUZfA:h2+XqUvA92/gGLjzDqeNROhl6TQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692082663, "uuid": "d6d1121c-d05e-404d-ba27-3cf34a9d6d7b", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692082663, "uuid": "0835c995-211b-40dd-8978-2d86cd424d6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692082663, "uuid": "b92678ff-1519-4cf0-804a-31c828ad9d71", "value": "3656380b872547ff69f460c90328d257", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b8cc49a-3b72-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1692107257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107257, "uuid": "3d17b21a-7aaa-4710-8999-c5e42ff9207b", "comment": "Malware payload (GuLoader)", "value": "b3e817a2fc2c92a6368a8db0b6510f2f", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107257, "uuid": "e05c8c73-ddad-4c86-9a0c-2d2888f27406", "comment": "Malware payload (GuLoader)", "value": "254aaa073b9d696cbed5bdefb0d2a079645adc4f244bad6a99abd69dda3b35ef", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107257, "uuid": "5b3338e9-a009-4f44-a0db-d3be8dcb32c1", "comment": "Malware payload (GuLoader)", "value": "9921612e87dca6106f1916f68c3ad7f4a9c7a74c", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107257, "uuid": "e0a37105-8198-46f5-9157-eca929f47fdb", "comment": "Malware payload (GuLoader)", "value": "324f2b67ce225d5a039916fe759119665265c8d206c3c6405aa7be007b8db4167e6ef9e04c2afbb1bc387c2850a46b16", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107257, "uuid": "07b5c109-0adb-4fc8-b62d-0b2441750d5f", "value": "T150C4E08D7684D846CC024B326172E1B26A73BC6A09FD851EB23F7E6377B3681764D784", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107257, "uuid": "dbd93fe6-5268-42b6-a4ba-7eddc36a1442", "value": "12288:rUIW/llrrG1nMyuBHKISEtjuej6sP/KX:rUL/7rGxBCHKISEtiejI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692107257, "uuid": "f8a18d3d-61d5-4719-9a95-f01f5de5241b", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692107257, "uuid": "b50b9893-42e1-4af7-b8af-f4fef345d3e2", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107257, "uuid": "9a3b30bd-bc9f-48e6-a94e-d54422bef3b4", "value": "nOrdine API 19102023003410880561.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba9bfac3-3b91-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692120758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692120758, "uuid": "ab8aaa35-c978-4ea4-b180-4c757ee8bdc5", "comment": "Malware payload", "value": "08731ea5211fe9f98c01dbef4af91016", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692120758, "uuid": "3cb4196c-d14f-4875-ba88-ae511229ce22", "comment": "Malware payload", "value": "25a5ac30178379348ec47ac7f66bb28d7ccb9a67f370ffe740f93b15288c7454", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692120758, "uuid": "ad957969-b7be-4faf-8cce-24769c2bf53c", "comment": "Malware payload", "value": "a0a02519765954ce70f90c915b892024de044da9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692120758, "uuid": "86957b85-4d89-40d1-9f30-96f2f563f485", "comment": "Malware payload", "value": "e770277d8edd262b91d70f913d7ca7c07e3890c0a9fd757aabe74d661ece8a44c059f82047df6c7760913c3ffc367f2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692120758, "uuid": "7c9c3a1d-4033-4137-8a7e-b27583e0c3b9", "value": "T1EFA41E063344CF25C11F05B5D9A7C2F81727AE00DD1497CB76CDBE2A3AB32E96A61687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692120758, "uuid": "c4830c75-1e29-4f6a-a9c2-0f1b2ce0a296", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692120758, "uuid": "5837b95a-df89-4796-91e9-777010c5bf16", "value": "1536:zzGGfn5NE9qWtp408/dl5PAaZ/Sv93Q28FHYqSjpPEg:zz7fHE9qbJfhAP8tY5FPEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692120758, "uuid": "9c3488a2-a4c0-4e55-ba6f-325655d642bf", "value": 459024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692120758, "uuid": "94394ced-f3c5-4f58-8f1b-52888b9951e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692120758, "uuid": "4f434983-c01f-4b43-83f7-ec9b756dbf25", "value": "SecuriteInfo.com.Win32.PWSX-gen.28355.32402", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff4b8c4-3b71-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692106808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106808, "uuid": "0b85589c-3324-4160-b826-1807a0719e6e", "comment": "Malware payload (AgentTesla)", "value": "d1ab0f2e1d947093d162b10bd91f716c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106808, "uuid": "120777ce-85e3-406a-8683-1fb6a97fbef0", "comment": "Malware payload (AgentTesla)", "value": "25de0c1d22cd9175d2770082b96d7c12a39af93732293d4b164b2e3865a3a9e4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106808, "uuid": "641845ce-a4a1-46db-881a-bc7f6505c613", "comment": "Malware payload (AgentTesla)", "value": "aa4b17ad4fd5925e381e8b3336570afe43a3e2d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106808, "uuid": "78486c42-571c-443a-b92f-5937ff13b9f0", "comment": "Malware payload (AgentTesla)", "value": "e1b6e7a89e4a2e5e0695237622778f93a6ff3146a446645672911f513f6e121bb759f790041b28cdb02e03d7a527f5f2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106808, "uuid": "fde6b724-9d23-4075-b179-f8162a13d580", "value": "T1E4D4232A37F5123AF93DA2FE2760C9AE177059472F12DB8C4D89B58D0BD2B941F0075A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106808, "uuid": "7dd09c2a-8a2c-4c1b-9b84-ac99a15c6e1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106808, "uuid": "b23b4652-d1ba-47b8-9950-e41deeff2203", "value": "12288:HPV/O9w18gJ6LaE4apr7eYKzO+glZulo10q+qJ9T3+m2ffvubzFzhQwlhJxui:4C1eLcax7eYeO3rl0qHpW2ZBhj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692106808, "uuid": "73b95e93-98bf-48d6-aba6-1a77a11eb12c", "value": 610816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692106808, "uuid": "ac143696-b85d-4601-812a-1a590baa587a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106808, "uuid": "a6412941-4c90-45b9-b35b-70759ac4ad86", "value": "PO6608003 Rev.1 - Kohler KD165 Quo 2329-201222103937.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdad41f5-3b60-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692099718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692099718, "uuid": "c595734d-f7e1-437d-9ca1-f8410e7446f6", "comment": "Malware payload (AgentTesla)", "value": "c95a1304a0b69d9e0c099f3bc6eedcca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692099718, "uuid": "8a4ace65-b5bb-41ad-b944-43d3af506473", "comment": "Malware payload (AgentTesla)", "value": "2830c2aec7bdb7e9090c79d6d95b422cbe875bd5a7ec1f55fb54a9165be1e48d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692099718, "uuid": "0e014f94-fc5d-4819-96d7-0c158ee93320", "comment": "Malware payload (AgentTesla)", "value": "7747eec83327a902d966b82507e511b43307991b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692099718, "uuid": "8d08abc4-97c7-4d1f-b1ca-35ade6869422", "comment": "Malware payload (AgentTesla)", "value": "5b40606418701e04b005f163c042b4c06f57bcc6c1332c5ac4d514aac8dceb29684047221111ad8f1f37becb05432579", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692099718, "uuid": "27f07271-1a4c-4f34-9e1f-d9958e8e81bb", "value": "T1C2B3F16DD34F02A9CB62633B971A0A4942FCBB3EB34512B1346C533533EE82D51666BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692099718, "uuid": "c59a05ce-bc86-4abc-b77d-5d721f9e6b8d", "value": "768:awAbZSibMX9gRWjX91JIajk2XLUb5mM+fS459w5nQ7FEktfobQsR:awAlRo9/Hk27Ubj+8S7m6fo0sR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692099718, "uuid": "4ea9db82-0b96-432b-be2f-726b2d112ff6", "value": 113991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692099718, "uuid": "b1ad59fe-a6ef-470e-85e3-7825495595fd", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692099718, "uuid": "40708a03-86b4-47aa-9300-c43b43fae009", "value": "SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.13938.19416", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b521a2-3b68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692103036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103036, "uuid": "5d527ebc-8a2c-48bd-b009-58ec34aa7dec", "comment": "Malware payload (AgentTesla)", "value": "a200e6e91dbde3bbf1e48b7e98475a1c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103036, "uuid": "43a147e1-5e31-4d04-bf65-91b9285073d3", "comment": "Malware payload (AgentTesla)", "value": "29304a9db113f249f6a24f0671b2656a3693287c70af4266c9082abf4139f8b4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103036, "uuid": "a22a4bb9-73c5-49c9-b6b9-2022148e37db", "comment": "Malware payload (AgentTesla)", "value": "f54e162c53c457c568b0e36a554c5d8e6ba82814", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103036, "uuid": "d9b2469d-e23c-45b2-832f-da1192758588", "comment": "Malware payload (AgentTesla)", "value": "1aebcf283a2890d2176429a600f0342715e8af09ae7619237bb43ee2b4b795cd4b70c2f37908a50a53986eccc517c75c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103036, "uuid": "1c2465af-b91b-45c6-b189-db88defe58fb", "value": "T187C4236425F17DDA3243AE432CD41601C5DA30EE1741D2A4FC64A66D2B9FC593FFA3A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103036, "uuid": "f7d62bd5-5c74-4e24-8b75-7dec96fc15c8", "value": "12288:8v/fhme3RaJfMmOgaFBektBmgmakdKIe49e5uZU7Uq53ixu4Hb7rf6Zc:8v/Jm1DOgkjkfc1Me5yk+7rfMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103036, "uuid": "f8ffbe12-3ca5-4379-ac82-ca2fe52745aa", "value": 558334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103036, "uuid": "d7360ef8-ea41-4d48-936c-f9627b536188", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103036, "uuid": "ee9a90f8-f946-45e7-87aa-cdf4ebd0ec96", "value": "JUNE-JULY SOA 2023.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ec3d35-3b34-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1692080880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692080880, "uuid": "cad6c8d0-7125-457c-8230-276d47d03840", "comment": "Malware payload (AZORult)", "value": "f12be02d35c80df4f18942e29f8d4147", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692080880, "uuid": "544433c8-410a-4082-844c-bc9f11e214b4", "comment": "Malware payload (AZORult)", "value": "2973ab4895596e9f896559c9f32aa7264a06d0c71d339da5a1303d05367b7fce", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692080880, "uuid": "4ce65170-0777-4253-a74f-1360d1f7597f", "comment": "Malware payload (AZORult)", "value": "cb86ab4e22bcaacd13f352c87d15fde0b8a9a391", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692080880, "uuid": "d1382707-e66a-4d8e-ab54-4be34df10ad7", "comment": "Malware payload (AZORult)", "value": "ab8fc2fa4b43433dc4a5b7a6671ec2e3e78f980c857aa9d82594e7139075c9cf05570be714e83bdccd9b8d4d59a0d538", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692080880, "uuid": "c46e437c-06ef-438b-b004-d4c052f6ed28", "value": "T1C1C4BF226E2DF851C50CC4B3A72388CFA9B06D6413D46993766BBA3F817C357EE0E519", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692080880, "uuid": "4e1867dc-5fa9-427b-9ddf-f915cdc74a9b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692080880, "uuid": "43560cad-1f0b-4541-be37-c47f40131503", "value": "6144:GYa6WgLW7wnfBISNxZ0KENaC1YnGuzSTg1WG8EJo+8AoObr2oaPeF4J9JA/:GY44WeImE8C2Gu+6WG8EJo+R9Woser", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692080880, "uuid": "9bce0c14-d143-4244-a670-006995835368", "value": 573387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692080880, "uuid": "3ad69fb3-f771-493b-a9e6-b4bcc54e7e4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692080880, "uuid": "0a908299-7f84-4646-bc59-46ff3a44c046", "value": "customer shipping details.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50bba915-3b6e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692105548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692105548, "uuid": "9720dc46-6b5e-49a3-8a26-4c6c0c715e8b", "comment": "Malware payload (Loki)", "value": "3333fe1aabfb8bdfd7ad0453b532976a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692105548, "uuid": "5de31359-d264-421c-960f-e1fab8dff7b0", "comment": "Malware payload (Loki)", "value": "2a94af793a2d827d2239b6694948506f2b292c5573f5eecb4862e072ccff3666", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692105548, "uuid": "164f73c0-3fff-471b-8096-54b65ec8f242", "comment": "Malware payload (Loki)", "value": "f283bd997755981e5507018f95e60451bdb5161a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692105548, "uuid": "fd518cde-fc2e-4bec-83e1-3d0381bc3a6a", "comment": "Malware payload (Loki)", "value": "9b3b36d88ffb7af94b098ef429f403c9b234cfea5157f35ec23ab056f501a1918ded0d465f474ab025656a2d2fdaa725", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692105548, "uuid": "221c8ff3-dae2-4b17-ba85-7ba96ebc0139", "value": "T117446C1373E17C62E5228A329E2EC6F8771EF9254E597756122BAF2F07B11B1C263341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692105548, "uuid": "0c6ecf14-250e-4698-acf7-def46e9a69b6", "value": "1e9f8c80f7736eb1ac6d7b21abe9e53a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692105548, "uuid": "165fe37f-34f2-4125-8683-2e05186b5f92", "value": "3072:ogvNUha2XKKOcSNd1BTe8KKTlwRqvY5VyVLMIw8MUOgY:7NKOcSRvKKcPryNkP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692105548, "uuid": "eb2b3a6d-4b74-4b9e-9339-9355d865f447", "value": 256512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692105548, "uuid": "0ae69d0c-bdf5-4301-9519-ce04aca6b353", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692105548, "uuid": "52402cb3-eb22-4664-8a60-0a96622dcc65", "value": "3333fe1aabfb8bdfd7ad0453b532976a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "880e9df9-3b6a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1692103923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103923, "uuid": "00c1c9d0-a430-45d5-aeff-17b280233d9b", "comment": "Malware payload (Fabookie)", "value": "eb241c86278652a08f432e46ffe7d1f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103923, "uuid": "37e767f4-6620-44fa-858f-dd1bd0533f2e", "comment": "Malware payload (Fabookie)", "value": "2adc17f082345821c06aea0d9be4980db1b9c147070084bbf7aca14126b229d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103923, "uuid": "69ba7751-c89f-4ed3-8052-e45ca248bc41", "comment": "Malware payload (Fabookie)", "value": "305fae8c65f3fa0919f88f40654e1eab2daa3bdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103923, "uuid": "9d928505-b1ca-45db-8e3e-d2fa4059cc8d", "comment": "Malware payload (Fabookie)", "value": "8c55a34333fda389eaf1d3c1954cef196abe3b85bae76740ead2d08fc907b78c667fc3a2cdbafe646d71236761f16b9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103923, "uuid": "ed6d5d75-170f-4a45-874b-f1434c942c70", "value": "T14FD47D51E2E44096D066C13ECA63D766E6707C585B209FCB0250EA6E3F33BE1F936726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103923, "uuid": "802b8b90-29df-41ee-9e05-380626317433", "value": "20a03a21823d3b586003fbd55dedc73d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103923, "uuid": "09fb763c-d8b9-4248-9db3-9057cc156484", "value": "12288:TeE9CKmx1yjvivHTNBxPTXzGODJciMuGEPnW:qE9Vmx16uNBxPTjGOSiMupnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103923, "uuid": "a1bdcb64-5a8f-4438-b893-e83bd14e0a47", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103923, "uuid": "b497f366-91dd-43fe-a1c6-2324ae17cfe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103923, "uuid": "49dd525c-e0fb-4436-b909-d4847b21a1a6", "value": "eb241c86278652a08f432e46ffe7d1f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84dc022d-3b6a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692103917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103917, "uuid": "8ea4e572-2f6e-4a9c-ab86-a10ce4169f41", "comment": "Malware payload (RedLineStealer)", "value": "edcfa609a5bd062c3044e3b96f3545dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103917, "uuid": "e5ee9df4-618c-4bb6-a1f0-b2b5527ae002", "comment": "Malware payload (RedLineStealer)", "value": "2de2eb6efac18999983c337647f07b8dd31ebef6953f25cffa8b3b5ecf1a61a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103917, "uuid": "f0225422-5d42-40d3-9fbb-cdd80843d693", "comment": "Malware payload (RedLineStealer)", "value": "ee1a895908015b9e9aa2c44fac1488f4398794cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103917, "uuid": "6a110c96-1a3f-45a4-af06-ec04a8f29237", "comment": "Malware payload (RedLineStealer)", "value": "1bd678024607024ec0912b86fe6b7ed1f41d44a2173d37eb51c2c9d0d63929f6dd6d009fc50efd900723bd99c467a429", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103917, "uuid": "32cebb0b-f597-4f4a-867c-911fc1d7b700", "value": "T13B15234A96D94173E8B96B715CBA03E3093E7CE229B4D76E3342E58558334C42D3277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103917, "uuid": "0d42bb60-b558-4abf-b700-3bfeb6fd6fb0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103917, "uuid": "cbe14123-6ffc-4b0d-aa2d-2f82e4b0ed14", "value": "24576:oyjoerOeepOyp80qBS5HElPefTo2fe2H:vjlazj8zJofT7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103917, "uuid": "c0776eb4-499a-409d-92af-31dd7c905a65", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103917, "uuid": "2d510858-f8dc-4627-934c-e1afa387c594", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103917, "uuid": "437c0223-ef11-4120-820a-ce45ecd703aa", "value": "edcfa609a5bd062c3044e3b96f3545dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b486786b-3b3e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692085099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692085099, "uuid": "0fbd0e49-da18-4f7b-baa3-32089888a79d", "comment": "Malware payload (AgentTesla)", "value": "90c250d0460b6df095a0ca8a65227ad5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692085099, "uuid": "408bd58e-7890-4df2-8c7a-e62f5ee3c4a0", "comment": "Malware payload (AgentTesla)", "value": "2eaf94da95c7c5bfeee85e0c9b2eeb4203bc708e8538061624082b61866bc3b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692085099, "uuid": "9738b02e-c944-4556-a17f-69bf63a7ad8e", "comment": "Malware payload (AgentTesla)", "value": "26f43d575148b54ec6e39a143a5d5c414d69f47e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692085099, "uuid": "9b60ddbf-7dc2-4133-89b4-e13857b5d876", "comment": "Malware payload (AgentTesla)", "value": "c20fce46f3ae04328561bf427c0b54cc4c1e66f0b5426981ecea80cb258f9f9e2bc90567027b1a339fe64b61a9b19c21", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692085099, "uuid": "c1b460af-807e-4f24-95f1-4d3821d56a71", "value": "T114E4CE9D726079DFC86BCDBA8A982C64EA206477431BD203A06715EC9E0DAD7CF145F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692085099, "uuid": "5bdbe5ac-5ecc-4492-b61d-7e791381b0b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692085099, "uuid": "5c5c57e2-b138-4067-8ec6-2c20e3c58af9", "value": "12288:DGr7nV/Oug96Ef0K25/pVaoMmqzpF3nyXgUSb7XLQr0wK4eJJ/dbbUuWkqUYnHPJ:cEB96OwhV2mcpV8SbzLY0wKRRb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692085099, "uuid": "95df584f-a50d-4f78-8488-74c6cf6c962a", "value": 716288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692085099, "uuid": "0af13467-3480-4062-bb03-85a0cbe77e9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692085099, "uuid": "ee47b701-5256-4fa8-8d43-a37efc178d2d", "value": "index #98000443AD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a96316b-3b89-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692117107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692117107, "uuid": "430471eb-a971-4348-b050-3413ffd99199", "comment": "Malware payload (AgentTesla)", "value": "17d116c9cad012594b8dc6b9d7ee4fc6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692117107, "uuid": "6934e902-51ff-4155-b6ae-fbdae97cedad", "comment": "Malware payload (AgentTesla)", "value": "2f545a7da6e843f42aaf2ee4a32c18247de0193acee11b6cfc2f7ca74ff9ab66", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692117107, "uuid": "d60fcc5e-ac33-4e6c-9b79-6475f59560fa", "comment": "Malware payload (AgentTesla)", "value": "5ccfa1f955fcbf16a4b77dd8c8ccdb5d15c4f7b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692117107, "uuid": "e92ffb81-d2ab-4fc2-ae1f-3f00269e25e1", "comment": "Malware payload (AgentTesla)", "value": "c2af89d42056f23eeb90c29baa911a9db9ffb7ac59f5fc5c926157dd3f578f8808ca1eb6ea4d248510ec9a88f32e3c34", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692117107, "uuid": "bb41c70d-8152-4ea1-8682-b0f6a63d1f10", "value": "T1B015F70059750052EF3E267D1A63573DB8BC1D53A2F2C5E96B2726D38DD3012CEA8BE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692117107, "uuid": "053187ca-a126-45b3-9790-269e827c8691", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692117107, "uuid": "f713bcfe-9a99-4623-b4dd-b8116ad574c0", "value": "24576:qzw1lXPIepppXpppppCOopppXpppppCOrrq3bWhHjW7rxqv:7vItO/Or23bIWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692117107, "uuid": "49bc2b91-a967-42f0-8bce-c87c69bc70e9", "value": 950784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692117107, "uuid": "1c563d64-e636-4265-b58b-c8d697484a33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692117107, "uuid": "affcf7fb-fda4-4941-9806-e45fc0827963", "value": "SecuriteInfo.com.Trojan.PackedNET.2277.6420.22862", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6cf3608-3ba7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692130200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692130200, "uuid": "3cd22f9e-6a20-45ca-a452-f7219ec7ccf6", "comment": "Malware payload", "value": "8dd6774752312e3671f04a6d1b3198b6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692130200, "uuid": "c0cf30ec-366c-46b5-84e8-9d6059163f91", "comment": "Malware payload", "value": "31f73090908b52bfd810589fc8d6a6212edda8bd2c378e3a6d556221b92922a2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692130200, "uuid": "1e3301d1-4b08-4b7c-96c4-76f70ac4fcd8", "comment": "Malware payload", "value": "d38559958cb0893d79e3fd702d52f505098f6343", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692130200, "uuid": "bcdac11c-63a8-4a1d-9bb7-59d5f07da412", "comment": "Malware payload", "value": "6a482689c8367f9ea6544c65c01cfcfcabc75b13cbb36eb6292a7f8ae6c06d2709f8be889e77a31d84383303c21ea7b5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692130200, "uuid": "34e21bff-d26a-4556-9468-957f397eea97", "value": "T118D44C40A2E140F7FBF794742882B2271746E655AE4CEFCBD1041D6A80FE6E5E7F8606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692130200, "uuid": "a6071b1e-dae2-48d5-834f-11e5566ba39b", "value": "200837451ab93f60d17a2df6526cee42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692130200, "uuid": "25614ab1-1a59-4fcf-b5d6-b30ccd7dbed4", "value": "12288:CQCNN6VpMweY/pjUvEYC9DNiDyNAFx9bFU:7kUnMwPpjUvEYC9DNiDyNAFDxU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692130200, "uuid": "988c54d0-e21a-44d8-af69-08b6de060eec", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692130200, "uuid": "519198af-9201-4a5b-8a11-e3be03313896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692130200, "uuid": "d2f8a7d6-a6b9-4b0e-8342-77494e7da59a", "value": "data.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e42d2e-3b69-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692103271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103271, "uuid": "779d63a5-f3e6-490c-b65d-4f30b5d3ddd4", "comment": "Malware payload (AgentTesla)", "value": "edefeb7b415f825eea5d631f8c84e59e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103271, "uuid": "f3a382c4-b561-4a36-8498-6142196fb3d4", "comment": "Malware payload (AgentTesla)", "value": "323b5378ce4ca793cebf61e42b0cdafe14256bad9ff2a4d64e5daaa8991d886b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103271, "uuid": "858a7573-6f97-4b08-a5d7-845d4510e77a", "comment": "Malware payload (AgentTesla)", "value": "080c46d60404dc70d3c08268ce26099b7f453eb7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103271, "uuid": "a75fe17d-de56-46f9-a112-d221dc1db9d1", "comment": "Malware payload (AgentTesla)", "value": "e80488ed8983f673891764f6832e99384eef2d79f1b6d9f59d56c388760e135934e37cee79227f1aa04184bdc580dbfd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103271, "uuid": "43849411-ddfc-4c63-aa60-31a90a27559f", "value": "T1E1E4235C0CE48B99F64735E512071D7268767C3101E9AE835AA3FD6CBAC8DE21F63B02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103271, "uuid": "c0b05424-b7ae-4b3b-9647-e9dea5811e96", "value": "12288:rH5ITpVTMufBQWeNE9uKZMH2I/yak0M8Fs5qUkVxouJ2Cj5pMIQe7siKwExZELbV:rHAiuOCQKgn/yjZ2sQhwuJ2Cj5j17sip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103271, "uuid": "c7f98483-5d68-4b08-8914-6e2202e353dd", "value": 703121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103271, "uuid": "dab562e4-6acd-4e24-be62-570224469417", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103271, "uuid": "7c10f4aa-c241-4ab2-8385-76bc125ec1ed", "value": "MNX5860-PR12722-AG2204.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dee514e6-3bbb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692138857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692138857, "uuid": "5d9b56de-5e57-4243-bc9c-0dbe8ded4cf7", "comment": "Malware payload", "value": "59059fe28a539c3aae1eda4964374c57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692138857, "uuid": "bacb3051-7cee-40f0-b6b8-c7f3355262f4", "comment": "Malware payload", "value": "324eb8521bba09aae9dba89f50598f773952e02d95d56e52000f0297795e44a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692138857, "uuid": "38c0b08d-2dab-40c1-9ca3-ff1f0f06d778", "comment": "Malware payload", "value": "850f9f980f2a220c49379a61d51766f84c8dbda3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692138857, "uuid": "698053cb-9b52-4795-95bd-19816a998715", "comment": "Malware payload", "value": "eb542468c7c17a803ff3db4ca6250e98be56177755c5be609bc6d97cdfc3da2b8bb55309922d79bfc9f225887138f6fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692138857, "uuid": "39751d5d-3f4b-4464-94c6-3bb00be19305", "value": "T11D031A4D7BE18568C5FD457B06B2D41207BAE00B6E23DD0E8EF564AA37636C18F50EE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692138857, "uuid": "1a74f8d2-f797-47ec-93ef-67eae7a3ace1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692138857, "uuid": "50b615b0-e9ef-4b49-a653-99909a5ed423", "value": "384:JLIcWqi0JXSYOI49KylT4q6BPhysGGD/rAF+rMRTyN/0L+EcoinblneHQM3epzXA:NXc95lTd6BYlGzrM+rMRa8NudMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692138857, "uuid": "a2a91ae6-3e00-41cc-bed3-897f2e2542f2", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692138857, "uuid": "85b7e64d-8a73-4bc0-af44-cd6fe9413309", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692138857, "uuid": "0c57bb0d-fe71-4e26-aa9c-a224afc0b3f6", "value": "qweroaoal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4822f636-3b8f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692119707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119707, "uuid": "f6277b3c-4dc6-43fb-8238-19b0827cae89", "comment": "Malware payload (Mirai)", "value": "2aef90273df8d00e92b95adeae39c454", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119707, "uuid": "41a68df0-5a6a-480d-822f-4b2eaaea48a3", "comment": "Malware payload (Mirai)", "value": "3402d99e4bdf973fdca047a0215fe7eae59b5d904d4326e65db084e31eaf734d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119707, "uuid": "2852338f-9468-4046-b620-3df379d5ace8", "comment": "Malware payload (Mirai)", "value": "34086fc87ec9eb4d657e220256cc62be722a613e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119707, "uuid": "731394a0-6eed-46a7-8dc6-a39bb55a3cc3", "comment": "Malware payload (Mirai)", "value": "135fce17950f89282e7437ea00d1ceb63be18707fa4e7b9b474b850ed14bc96746141a26faec25ebe7f34b48bd67798a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692119707, "uuid": "96ce76c7-052f-45ab-9cda-9810f0181c41", "value": "T137C33B06731C0947D2632EF43B3F27E193EFAA8121E4F644355FAA8991B1E324585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692119707, "uuid": "fb087c17-70f7-4080-9d1b-c9d93b64bf17", "value": "1536:Mlr0RHlsFi/2/B257+Gxd+vLsYrNi2BTGVp9Xj6TnvAJ9mYPF4t8wqAqUhnNWAgP:uiFt+GxkjL42UpZj3JcNWAggq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692119707, "uuid": "20cc8859-6b26-4d5b-9b96-e80a031004b1", "value": 125444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692119707, "uuid": "310aea6d-2b39-4cb5-90ea-97e5dcf10620", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692119707, "uuid": "56126cea-a1f0-40c4-b117-2c407c65ba3d", "value": "2aef90273df8d00e92b95adeae39c454", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ee67c1-3b25-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692074416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692074416, "uuid": "47e37d0e-aa4b-4ff9-80fe-0e9a10684435", "comment": "Malware payload (Formbook)", "value": "58d6bf92b3b5fdd8a7e6f78aa973ee05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692074416, "uuid": "20eb0d29-a3b3-42d7-9262-1d2afe1e8661", "comment": "Malware payload (Formbook)", "value": "358659e950dae1b469fca25fb75167cae886174d21a9226fd8081fbd71d5abbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692074416, "uuid": "949fe9b8-3a15-4457-9cf1-fff2f97ded96", "comment": "Malware payload (Formbook)", "value": "f6e10a4f997535094654791419cc1f3d30def63d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692074416, "uuid": "b8553e57-a0c6-4f46-a7e5-ace9f70c5026", "comment": "Malware payload (Formbook)", "value": "c820e90cbeb37da7f01cb9fe7f6a45777ccdd35806c94ba2190d1572c06b5106311112b14e0e75718313c9c5d049acc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692074416, "uuid": "b7dc9c3e-9fcb-4693-9e5e-c1f6cedd5fd8", "value": "T135C423523FAC5D2BED5FD2F619204A6E437452176266E7C4D9C9218CAAB3FC107C0E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692074416, "uuid": "251fa212-f837-441e-b9dc-811fe0a596c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692074416, "uuid": "2fa0c159-5384-4c4d-9710-1a795772a982", "value": "12288:pPV/OxmGz0PKRIoiEl5K+9+IVxjIAasmDixV3WMAbZcVQAT/ol:mgXPKIoiU5ZfVxjF4+xVnIYXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692074416, "uuid": "dabf0b02-b299-4697-a460-213cfae0dbe0", "value": 578560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692074416, "uuid": "b843a90a-71a8-4055-9ca9-6ebfde89d71b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692074416, "uuid": "0c3c0da5-65fd-4f89-b5f6-cbd4d16500f5", "value": "SecuriteInfo.com.Win32.PWSX-gen.14895.32221", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4baaf14e-3b6e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692105539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692105539, "uuid": "47c0258a-3dfd-4ed7-b195-a796667cfb4d", "comment": "Malware payload (AgentTesla)", "value": "c1ac31ebcbfb8dc95d4eea6d4c95a474", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692105539, "uuid": "42fcc52c-6a6a-4f30-b768-86a61b16d0cc", "comment": "Malware payload (AgentTesla)", "value": "36b17c4534e34b6b22728db194292b504cf492ef8ae91f9dda7702820efcfc3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692105539, "uuid": "4848a113-0bec-45b6-a559-77e4302db61d", "comment": "Malware payload (AgentTesla)", "value": "e2437078fe7f3abd635dacae65cf6ae2d10ef98e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692105539, "uuid": "2d29e542-d32c-4038-baaa-02c5b8bb9baa", "comment": "Malware payload (AgentTesla)", "value": "9e531f4e78d251fca3e055d9132f272904f4adada92985eae33d7f037b2a8d1e5edcc732c6940726118c24aacd771b74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692105539, "uuid": "30d132b2-7fdd-4018-b0cf-5960ddb9d5a4", "value": "T130251821D7BB144AFF55A6F88E2F8431B8D9D980F0F5D589A3E6281394C2311CE25BF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692105539, "uuid": "d055826a-e58a-476d-9d11-827155cdebe9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692105539, "uuid": "ac5ad719-d89b-4e4f-8eec-e3754cd36b1c", "value": "24576:jT8NawpBRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOZYBfaDf3VLynNa8:urRs6CE3jLbO9Rs6CE3jLbOuYDf0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692105539, "uuid": "bcbc8a74-e260-4494-acab-ea658c938c72", "value": 978432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692105539, "uuid": "921015cc-0fe4-4952-89d2-bf31388a3456", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692105539, "uuid": "bb5b1396-de14-4fcf-9e2b-8875e8fc81e6", "value": "c1ac31ebcbfb8dc95d4eea6d4c95a474", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf435b1-3b7b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692111016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111016, "uuid": "f83e478a-5d9a-401c-8e56-fee5a5efe812", "comment": "Malware payload", "value": "373ba4d5aa3715d4b25e38535c8c2770", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111016, "uuid": "2cf559e3-f773-4920-a2a1-bf25f4cfd63c", "comment": "Malware payload", "value": "3715bda3dfc636dedef91b1c6935a44b7ae2bd5b7ea72bd80ee9fa0e2902bbe8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111016, "uuid": "e808ce06-6178-4973-a05a-b7b271bd6ab0", "comment": "Malware payload", "value": "7840b292e47ff234cb5d9304f27139c85775ed1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111016, "uuid": "b43dbf53-0df7-41da-a452-a4b5c7aaf7a6", "comment": "Malware payload", "value": "b4cf164e97ac1877ea3532003ca8fc0030b314f841835082616a7c81b81b42a717989b1de0e3fd812eb27fb8f382e286", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111016, "uuid": "68c96c77-5a45-4584-9459-cbb1365f1e98", "value": "T122234C4037D88136F2FD47B8ADF2E141867AD6676903CA596CC814EA2B13BC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111016, "uuid": "a3acbb7a-fff7-4ec6-ac2e-cc9eb280f59f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111016, "uuid": "0fe00059-c0d6-4d3f-b335-15d8e941ebba", "value": "768:dOEuILWCKi+DiBtelDSN+iV08YbygeJKvS0vEgK/J9lZVc6KN:dOtmBtKDs4zb1270nkJ3ZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692111016, "uuid": "3ca1ef34-0776-4d01-84e0-86bfb519db20", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692111016, "uuid": "9fa17d56-a2a4-4e9a-b7cf-93365577ed72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111016, "uuid": "3d264aeb-e5dc-41d1-b30f-cb2f77f3f064", "value": "decode_ca08f960ebaf96c0f4da903b557af0079cc38e20e4795b16d742bebff04c64aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48759534-3b68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692102957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102957, "uuid": "bf40680f-1d55-4052-ac34-86c93c5ddd57", "comment": "Malware payload (AgentTesla)", "value": "0410acdd7cadb47870ebb5b370e89d22", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102957, "uuid": "d599e134-830f-43c1-8803-a7090017fe70", "comment": "Malware payload (AgentTesla)", "value": "384a89d11f1925380d0ea644e7b8ab44867182e73aea1628552f93ac0e76c949", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102957, "uuid": "38b35576-51fc-4555-b52c-3a5ba6004fc7", "comment": "Malware payload (AgentTesla)", "value": "920d8b018652b6da7e699ebcced7b740de2472c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102957, "uuid": "481df2c4-816c-4195-a9ac-cf071682662c", "comment": "Malware payload (AgentTesla)", "value": "f6caaa74de81d9d9f4f1b63c11264f97734551a9d4d612fe81ad7e2872ea529961b51c5acd0efe061acc4484f6767a10", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102957, "uuid": "d0b6083b-75db-444c-83eb-5f3f8d5a643c", "value": "T1BFC4236425F17DDA3243AD4328D42601C5DA30EE1741D2A4FC64A66D2BDFC593FFA3A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102957, "uuid": "ce82fd30-43d5-407e-b799-bb34c465a306", "value": "12288:lv/fhme3RaJfMmOgaFBektBmgmakdKIe49e5uZU7Uq53ixu4Hb7rf6Zr:lv/Jm1DOgkjkfc1Me5yk+7rfMr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692102957, "uuid": "5af3afbe-baee-4a53-bfbd-7d8a40ef5c23", "value": 558314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692102957, "uuid": "6bd1911b-0fbf-4bed-9c8c-309bdbaf4838", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102957, "uuid": "7ad77150-6b08-4ed6-902a-f02312e126bf", "value": "PO H0001.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a52ee8-3b4e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692091832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692091832, "uuid": "14d336b8-a087-44fb-a073-a8225adc7e56", "comment": "Malware payload", "value": "41ddf10747e14890df75b10f8cd48a66", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692091832, "uuid": "1d4d129c-9ff8-4929-8708-2dad7c22a492", "comment": "Malware payload", "value": "38b2ce7071de654c0b50c22fd5fa18dce6add7b17631d6f0be926520f23f5e75", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692091832, "uuid": "fe86286f-76ac-4034-a489-facdf7d9dc01", "comment": "Malware payload", "value": "3b819381b137ef0af1ff4d8cb21651756e8088fb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692091832, "uuid": "d7262c28-a91c-4bb0-9efb-115f7f41f2a9", "comment": "Malware payload", "value": "b298d1cc81bfcf7d8b0e9998d45295e3623f138ae5ae6fcb75d513acc46253b822212258b59bd411d7261b8954274209", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692091832, "uuid": "014b38df-92db-4fd8-9086-870f690e903b", "value": "T142937C01B6D1C471E9BE19361820D9B54B3EB911DED0DEAB7B9906AE0F302C1DF24D6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692091832, "uuid": "0f522d8e-2193-449a-a5a8-378325b298fb", "value": "9de2c5f4e7412eda6daeaef638405b83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692091832, "uuid": "38b84a5a-6467-4085-bc20-9ff201bff27f", "value": "1536:nN/SnqpFxn09e2LFUQKsKLjxkflHlX8/S0ElsWeWcd+ooLOgoeiCbW:N6GFxnA1LFFOLjKE/Lv+ooLOaDbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692091832, "uuid": "d6d0296a-9d12-4983-860a-67c71d6b993f", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692091832, "uuid": "29ba50be-8c14-4a2a-9645-eab452c30a58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692091832, "uuid": "76ad7fa9-edfc-4daf-a0c2-c23937565427", "value": "SecuriteInfo.com.Win32.PWSX-gen.20061.15487", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9fdae57-3b65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692101966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101966, "uuid": "ad0ca77c-b135-42a7-9fe8-6d614d17ac3f", "comment": "Malware payload (Formbook)", "value": "dd80924ef01d631fffb4eff4311863d4", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101966, "uuid": "decfe331-09c0-4978-ae11-c554b0da29be", "comment": "Malware payload (Formbook)", "value": "38f7c5656140ebaed0b9ba69f1696576fff3d9ce5a87f77f1b2096277a4a0df6", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101966, "uuid": "af0e28cf-5069-4dad-82a2-0bf605817fce", "comment": "Malware payload (Formbook)", "value": "834921ed2647cde9d783f073f4208b692489d27b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101966, "uuid": "9ddbb306-cffe-4f36-9a33-a2447d28aa29", "comment": "Malware payload (Formbook)", "value": "c321b661dcd1998f8f6705b0abee05fa3ceb1f37c53283c430189bf621c6b9d3429ebd94eb76d990f07dbd29c65ec3b5", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101966, "uuid": "58835ae6-7e8e-4fd0-8e19-f698087a34b7", "value": "T10D55F103E900DBC3D41D83F87E530EE90F0A6F19E99569DB14667F9B3B70A72099A12D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101966, "uuid": "abf0e3e3-f5fa-498c-a680-29abb1a27a75", "value": "24576:qaZy0w6VgjKaWlEzp7a0Zyaw6VejKaWlEzp7akzdXwyb7QAFQp5E/Qwrx:qE86VgjKjOzJy6VejKjOzDdB7/FX/QA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692101966, "uuid": "b1ded185-4263-489e-a8df-7649fecc329f", "value": 1329664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692101966, "uuid": "9b1ba9f2-daa7-427c-a9a4-62da116d72a6", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101966, "uuid": "22a4dbc9-4e9d-4fb4-98a1-4a9c09ed027d", "value": "specifik\u00e1ci\u00f3k.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "222e94de-3b69-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1692103322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103322, "uuid": "d6569f79-1989-4797-8608-7dc4cf386b90", "comment": "Malware payload (GuLoader)", "value": "d39e1739cc39c9c8126adfddedc2f5ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103322, "uuid": "b2041d2c-b4dd-46a5-959d-26ac7a7f382e", "comment": "Malware payload (GuLoader)", "value": "39b52b00b3cb705ba28231ca967470baa776eb494c50dff7988cefbf536977e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103322, "uuid": "a7b1648d-36dd-4ecc-a85e-004d988ff99f", "comment": "Malware payload (GuLoader)", "value": "8c2cf38e9564b32af38c6ddd19116c54c22efaaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103322, "uuid": "81db39a8-53f1-475c-8aa4-b0a99ca6b9d6", "comment": "Malware payload (GuLoader)", "value": "ee169cd5d2af94243b5bfcdc1527a50bbb06590ed77742cce74ebed5b337248802552e160f4cf4e60bc81aa7c44d6a82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103322, "uuid": "c006b19e-052a-4b7a-a8f8-b7036fc8e776", "value": "T18F5412124A20D8D7C9E78F762E7CA67A8EF5D223B850870F27141D196C227D7DA4DB2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103322, "uuid": "21ce5d2f-3617-4534-ba4d-e113eb5d3241", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103322, "uuid": "e6bb602f-9170-4d86-b668-d7c486d9cccb", "value": "6144:DmOPEJ0IhJR3xU6DWOv+rKSlYbnCkK3/dvVTbI4rWGVVWojU:QJ0IhJ15Poc2NT/CjoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103322, "uuid": "e4563b74-36be-475e-a955-cf766632187d", "value": 299328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103322, "uuid": "316ea331-a7ce-4505-8119-308b19af059b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103322, "uuid": "12bc23eb-271e-4f8a-8636-2b47000b00d0", "value": "Outmarches BACH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab6580b-3b6f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692106262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106262, "uuid": "5c6a7cf7-6631-4875-9d79-d2843e6cac33", "comment": "Malware payload (Formbook)", "value": "678ec9d698f72ce4ecfcf670eb91201b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106262, "uuid": "5aa31e62-be55-42a7-b76f-f2078695e380", "comment": "Malware payload (Formbook)", "value": "39cc1cd072be2976fc1654bdead4ac7f03efc8e59a74368a0b5d4945ce2c5544", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106262, "uuid": "efa6e944-eb78-4da2-afa4-317176f412c7", "comment": "Malware payload (Formbook)", "value": "5e00f89f2003a2cb8832f0ea636a08a0b58012d2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106262, "uuid": "3ba52191-30e7-447f-acf3-d57aa60399f2", "comment": "Malware payload (Formbook)", "value": "3e4a77c1be94300a3a1b9ecfd0d6c859691c718ca7be1fbe97c5e6d102707be95f18c50eb294f260642dfa34ae074c35", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106262, "uuid": "aece03d2-a34d-45b4-8e9c-2772c3e37af2", "value": "T1373423820BF2E5A0B50321E70E1861D25B5F3CE3555D6779E302A72F99B1AC06D2673F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106262, "uuid": "d6b687ad-03d2-43ff-8704-b193520a075d", "value": "6144:etDFU/5UuDkGkg9PiLjCwuM1xJWT6c/eiUXpdANlx5+c:etDy/5UuL9PiiwuM1WTb8ANL5+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692106262, "uuid": "6402c182-8b5c-49e3-a512-275168014aba", "value": 232355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692106262, "uuid": "8a31e3d1-c918-423d-b0a9-0f2d0db8a122", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106262, "uuid": "6be7adc1-dac1-4502-a743-c5cbb50c937e", "value": "order #6122-001.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8202184f-3b6a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692103912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103912, "uuid": "c0c06ddd-8fa6-4f82-995f-8cf4d628a61f", "comment": "Malware payload (AgentTesla)", "value": "8015b614a71eff1e9bae0deaa1439436", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103912, "uuid": "fdebf5ac-926c-4d29-a85f-c929b80d83e1", "comment": "Malware payload (AgentTesla)", "value": "3ba3a8e73d48a132f63802324e31098024a16b19fa4669aa04589bdb12382f5a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103912, "uuid": "2af86ff1-55df-48a9-8134-f1413e915516", "comment": "Malware payload (AgentTesla)", "value": "cee267871d47ea666fc1519d00eca2043884b66c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103912, "uuid": "1e5eb76d-d360-4885-a7c2-4e523fb7a03f", "comment": "Malware payload (AgentTesla)", "value": "14c553c0688e91c97840313cf09322112345d062fd98e51cfb9f1d941f419f46641595f6aba03092798bd2788708e9cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103912, "uuid": "d25e1907-ee83-4acf-8f7c-6b3d7d2cd51a", "value": "T18DB42216B3DE1D27DE7CEEB019218D174738EA850763CBDE4CD662A12695B1207A0BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103912, "uuid": "969bf712-2802-4c30-a82e-d9217c82025a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103912, "uuid": "7d958cd2-8019-4273-b026-2811fc706396", "value": "12288:UPV/OXL8LgjoSmD/aTRX6o20TPKBKtZ/bA7nka7eNyxtc:N7uIUQ6UTP8gZ/bw/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103912, "uuid": "312ed0f2-d078-4dd4-877a-f4a0bf4e45f9", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103912, "uuid": "1aafa026-9579-4efb-8960-39d625e9a886", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103912, "uuid": "b032ca26-1be0-457a-98dd-0ad7da1010a7", "value": "8015b614a71eff1e9bae0deaa1439436.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e24ba9be-3b57-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1692095913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095913, "uuid": "f212e134-beeb-4418-b882-387c9dd3688c", "comment": "Malware payload (ModiLoader)", "value": "f4a22575b07f7b4f54d2e2feda6a2717", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095913, "uuid": "b6be53ef-5818-4aa2-8730-cf58787f068b", "comment": "Malware payload (ModiLoader)", "value": "3c02e09cd54775bce77b8168dcea023a40f510127ff3ca5cae5557a82597b48f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095913, "uuid": "82b2c7c9-a206-42c7-b775-bc04ce06a123", "comment": "Malware payload (ModiLoader)", "value": "3392435e6c3001174b48042da6a511d2f8b45bbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095913, "uuid": "e188876c-cc70-42a1-b697-0c1603bbcec3", "comment": "Malware payload (ModiLoader)", "value": "951beedbcd7f100688bf132d3337ff68e174f44adf9eee829178f12ab4198bc2b47ec660cf919fdb20122548941ee4c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095913, "uuid": "3df08088-046b-4a4a-ad89-6f910e360260", "value": "T1A5F49D2AB3E07473D4E6237C8C5787B89816BE662F58B1897BD3390CDB7558034293A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095913, "uuid": "7e8baa2a-b92d-40c7-82c3-a485399ecd2a", "value": "ea5ae0eb30ecb2270f4a40ff7bdfb891", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095913, "uuid": "f3e27b29-ebff-41fc-9e3b-f8fbfc7e6f9f", "value": "12288:HHLE4rSOHgTxpMrC2zR4othaTEU+rxFVOt3FYe64QPIOhO1CYuhP:HrKOANKrCzaaT4VuVNQIOhO1UhP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692095913, "uuid": "0a77957b-6c8c-4925-8719-9c20d7521c51", "value": 761856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692095913, "uuid": "f2b0b0eb-7883-49cc-bbb4-cb019cc34218", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095913, "uuid": "af8c2ca1-148b-4171-b7a0-743b82ffdbc1", "value": "Gqzfnpjnobzwyu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b40df1-3b7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692110983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110983, "uuid": "f25ce07a-5108-45c7-afde-a8e013a66a83", "comment": "Malware payload", "value": "e0dca0a68e382852884e0cea0f7e9d0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110983, "uuid": "4d1c9f1c-536b-4e1f-99bc-9deaa7638a28", "comment": "Malware payload", "value": "3c4df2d02e4b6f4acf7b19238211892db501ee6faa04065dd11b25b56483f9c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110983, "uuid": "e3275bc9-78e1-493d-b32a-8889feeb7ff2", "comment": "Malware payload", "value": "65698c61818075f3a4b957fa5b102d92bdd0f70f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110983, "uuid": "20600248-8187-4a23-9ecb-1b1ffe57a0ce", "comment": "Malware payload", "value": "f47bb5f1dcbfb027e931294e840adbddd6ba403761e4be868787448d0fd4a12af71f3a40d50eed963c7eb376de6698d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110983, "uuid": "f1afbd74-cfec-49f6-99b2-358dd871610b", "value": "T1A2236D0037A88436E2BD4BB5A9F3924187B9D2571A03C65D6CC815EA2B13FC6D7136FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110983, "uuid": "8fb55059-8535-4100-954e-50734ca20138", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110983, "uuid": "42f10756-32d8-4667-b5ff-52431e21611c", "value": "768:5OEuILWCKi+DiZzCidMGvGiMu8YbAgeS7V012XcS8vEgK/JTZVc6KN:5Otm5lMGZzbn1+gcS8nkJTZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692110983, "uuid": "554e6d1c-39d3-4a33-abfe-813639271ab8", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692110983, "uuid": "56954177-62d8-4249-8412-eb0a3b859148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110983, "uuid": "8ddaa606-f921-4cd2-8f8b-e83cfb74504b", "value": "decode_4cb9571dc033ff7c0e878ed1f1954b7b0656cdff2af9a51c02707a1faa6165c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b941450d-3b5a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1692097133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097133, "uuid": "0c5cc99f-0341-49b1-8bc1-e4d6ab322e96", "comment": "Malware payload (Gafgyt)", "value": "df40805750f44ee6ff4954bd349ffde0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097133, "uuid": "3aa69722-7bd1-40ff-aaa1-aa5e4ff09cb5", "comment": "Malware payload (Gafgyt)", "value": "3c9519ae0c1b184037a4c4a036e093b0ec9346b3f1a6a89d911bce575dbf8330", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097133, "uuid": "97a3f08d-c484-4ce3-bd69-867198e884f5", "comment": "Malware payload (Gafgyt)", "value": "fc23aa133223635d6489c4c60aa58c6952dafa77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097133, "uuid": "4b3ee823-0818-4e11-b613-08dee841525b", "comment": "Malware payload (Gafgyt)", "value": "52df857e84cc122b96cff43f2d3ec6fc8e666010e8007a1b4bf8038d58a6902789b0bfa06993c1efc67abac01c1546f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692097133, "uuid": "57d9ed3e-016e-425c-8563-409ee8c50a68", "value": "T131933B07B71C4F43C1DB59F029BB2BF15769B9E112A36181B91BAEC05B33A781523F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692097133, "uuid": "350bb655-4c25-4402-a6b5-09762c859119", "value": "1536:T3oCu/OcwUBvPsTbwHH3P6zMSIHsiO6aRv/lz5s5hLg6wOFO6V6qDjjofSee:T43/qUBvPs6X03IHsi2/Q5hL7wOFO6Vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692097133, "uuid": "652422d8-2876-47ed-9600-14d13260144b", "value": 92720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692097133, "uuid": "03408a13-7cb6-4ce0-8b93-bc51a11fef98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692097133, "uuid": "71dda8b2-ad1e-496a-815a-2a8c2df16a10", "value": "df40805750f44ee6ff4954bd349ffde0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce7523e-3b70-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692106696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106696, "uuid": "4e252342-bd90-44b0-a93b-68523cfcdb17", "comment": "Malware payload (Formbook)", "value": "c87aa2e90e3b94f34595aba30bb6ae1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106696, "uuid": "a46ad961-50f4-43b4-a695-4d4063e3f7f1", "comment": "Malware payload (Formbook)", "value": "3e07d75e18bdabe5880fe8e4dbd5fad1b9d2c111ee6f43b35ddb5ff8286fd2e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106696, "uuid": "7733c6c4-f6e1-47d5-a57e-76ae55d79fd9", "comment": "Malware payload (Formbook)", "value": "2a057504a2ff5872eed0bb0e5f325ee77148ccd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106696, "uuid": "88a00404-a9ec-4970-a55c-dac7b6c7e6d1", "comment": "Malware payload (Formbook)", "value": "e346de241941c60a9a7a1a932246d8ec2879270503dce592c78458bea4f81ca554c1bfb39556d0c7e9198a8f464e3ad5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106696, "uuid": "f02bdf56-4e46-45c1-b937-f08cf952a95f", "value": "T19FE4BF60EE399D83E18F0AB8408FD74D82728C953516C67A5AAF50C6D4873C216DE7EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106696, "uuid": "ded34b5f-b837-40b1-b59c-fd8bebbf2e40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106696, "uuid": "9831e046-fc94-4dbb-9787-2885442fd690", "value": "12288:UdcoUFNq+Isf/PqghCPJgCcRkZ61RlqTj6q:htFpfaQCPJS0TjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692106696, "uuid": "7acf3859-9e3a-42fe-a5e1-8f948b68b5da", "value": 689664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692106696, "uuid": "ac9f67d8-3421-4ad0-b84b-a7c97c3b504d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106696, "uuid": "6c589b9e-ff88-49cc-9429-645ff2b09d1b", "value": "rOrderConfirmation11082023EMPACARSAOC7802.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "633c711a-3b91-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1692120611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692120611, "uuid": "c8425c8a-bcc8-4e31-b763-dc210d29a180", "comment": "Malware payload (DarkCloud)", "value": "e31b955623e2c260d64ecd239fc3198e", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692120611, "uuid": "721693ca-5dc4-4111-bdba-c343d75b1c7e", "comment": "Malware payload (DarkCloud)", "value": "3e4c08f6c576544f406c83ea2361fadddc27361044b615e391fff3d9bf4e4ca2", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692120611, "uuid": "ca2f8ffc-66f7-479e-9e30-83a0e63851bf", "comment": "Malware payload (DarkCloud)", "value": "f9598812dd9ae90c1b5cd1df02931b06905fa637", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692120611, "uuid": "71424311-acf0-43b4-a882-8428a662be98", "comment": "Malware payload (DarkCloud)", "value": "16bb230b1e90a5378ce07b78f9d4c7d5cde6a4e3ee333b5f16c33667347807582d00da5b6936e5fe42da8e3e61235eb9", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692120611, "uuid": "d9f52aec-bf12-4604-8533-215d8d1e5cec", "value": "T15DF42311BAAE5B26E439C3FD1C605585033979AA2753E3BE9DD230E72631B1117C3B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692120611, "uuid": "312378d9-4ec4-402a-a9e4-1746c2b8d4d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692120611, "uuid": "b81ae07a-b1e4-4fcc-965f-736afc080a9d", "value": "12288:ZyJV/ODaCj00t0ZHt/CX0HoddDRKRt3Sz7g//hVvR2lggdyI2jMVk:Zy2eh0t0Fto0gDERMnc/rROdq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692120611, "uuid": "906e44f2-d3e5-46f0-ad08-b9dc109f604c", "value": 772608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692120611, "uuid": "cd689fea-1a03-4d8e-a89c-b4afac7e99f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692120611, "uuid": "c615c1d4-dc47-4386-ac4a-db285a8bbc59", "value": "08152023 List.eml.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0591c7b0-3b7b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GurcuStealer)", "timestamp": 1692111005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111005, "uuid": "abf6755f-390a-439c-b4b2-b11d958bc73a", "comment": "Malware payload (GurcuStealer)", "value": "4ada7696b8883818370e9b2e8951efb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111005, "uuid": "5be318ac-db4b-4f1f-8885-cacc22c573a8", "comment": "Malware payload (GurcuStealer)", "value": "3e669a963f044d98047963a38c2553cd57761b9ac2cec040894eb5cf8ceebf84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111005, "uuid": "40ab84a6-55bb-4af2-9eab-5edd47769bb4", "comment": "Malware payload (GurcuStealer)", "value": "05522150659a979f962818fa9ab85a64d6b73bcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111005, "uuid": "ba42e5d6-a958-46c9-ba08-78c8c281ceae", "comment": "Malware payload (GurcuStealer)", "value": "f3e19aa01775d3d5e55bc911159beb23cf96e26e44cf4bbed904707da85e05e494a581a201007379136d52e6a4c4081c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111005, "uuid": "4b458d3e-9594-4fa6-9e7b-32419e711756", "value": "T11FB3392DF28AF902D1EE5578A0D1522453B1920B3805F3553DA6D0A1DAB2BC47B4BFFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111005, "uuid": "9f778c2e-68e4-406f-aa7b-050186b5b8ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111005, "uuid": "a8515a2c-b2df-4a72-b4f2-1bc58f6e3070", "value": "3072:r5hA4V5tuUN1seflEHk9bUYyGRyY8lk2V9okk/TEdGOxT:LNIHk9bUeRy7lH9Lk47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692111005, "uuid": "8bc3b607-f81a-448d-b3c6-41c87b9f13f7", "value": 114968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692111005, "uuid": "dd9766ae-94b6-4f61-b02c-22a44de2eee9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111005, "uuid": "5ce647ee-5e4a-4d43-a5a1-27f649a36dba", "value": "decode_b22936fab1c4c60f4dae61b2495ddfbdd31b789abe777391c0813179aba2c411", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "907d17b5-3b81-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692113815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692113815, "uuid": "8535e136-ecdb-4885-b579-923a876140cf", "comment": "Malware payload", "value": "e157091bfea2836717af4c4b704d6b4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692113815, "uuid": "8739f835-ed75-4e1f-b456-ff1c7456c385", "comment": "Malware payload", "value": "3ef2c2243023bd5b8ebd4b0ab7ab2d94a6af633c31126b3f254984cf8eba3907", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692113815, "uuid": "37acb18e-a657-4f9c-b814-d05c1349d945", "comment": "Malware payload", "value": "f5619f890519f88361ec93353bf10f936a97606d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692113815, "uuid": "a410cfef-e21b-49b4-86ab-4ce3bb23fed3", "comment": "Malware payload", "value": "63fada03dc80ff9ad6f1a75b8409d49cfae5600667c878d7be0fd7757cba8f522098533fffae5b89b956ff46bbe8e87f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692113815, "uuid": "777a3274-ee1d-4666-9f71-6c4597dfea4c", "value": "T12FB41213F7D85072DCB653B098F217C31A377DA19974C72B2742E89A2CB2694663173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692113815, "uuid": "c7a7a430-58a3-4c41-b009-27f582978861", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692113815, "uuid": "32dd7e44-9f36-42c7-8c5e-b5aebe25734f", "value": "12288:oMruy90VTdNPpeQCFPjmwrzGT76C8j47TNnbf8E1:my+dNRqnC6CIWNnoE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692113815, "uuid": "f61a92b5-b86b-4d4d-ab62-6e1295541190", "value": 516608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692113815, "uuid": "b64b6004-514d-40b5-b14c-2fddf3d63be0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692113815, "uuid": "90c0880c-ba93-4032-a850-9fedf79b90eb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2aa89ac-3b6a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692103994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103994, "uuid": "21ab9de5-897c-46da-a368-fc7df8f671b1", "comment": "Malware payload", "value": "d36abeeaca675f821376869f1f8ad325", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103994, "uuid": "85cf7693-dc28-4d9c-b66f-0bb3ebaefd3a", "comment": "Malware payload", "value": "3f0ea4cbfc887b2413ca62b2776aad05466ea05fdad4ae48f3ce58064d192837", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103994, "uuid": "e469f6b4-fc89-42fb-bab9-38aae48c4f0a", "comment": "Malware payload", "value": "a1680989c15f988fcada60a387bbc2ebf60cf727", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103994, "uuid": "3e865143-967e-452f-a34c-f88613cdd060", "comment": "Malware payload", "value": "1bd84491d2f31e3b3e883f53fbdcc62b520e5fa1d3f472e38884cd7dd11f299209544d4d0025478233e2b09e6b1a97f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103994, "uuid": "5a44789a-0708-4a74-a761-6d9b8d159a0d", "value": "T1BBA5233317662089D4D8CC384A37BCE975F5036B8A92A977E8EA7DC121C64F4D623B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103994, "uuid": "34f4b044-bb58-4690-9ef8-7d925076b7b4", "value": "49152:KJkglx0dhs2ZWDt41rdnzOlplOgK2OTtvAlCsc4cT40Ksd5BQ:KJN3yGmwepnqHrmv6XPB0KJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103994, "uuid": "f5654827-dcb4-4846-b54d-9ec745cb49b6", "value": 2258064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103994, "uuid": "392a8054-adf1-469c-9fec-f61c32d8f4f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103994, "uuid": "5fc63a03-fcbc-4cb1-b481-61a38f912089", "value": "d36abeeaca675f821376869f1f8ad325.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b102ac-3b73-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692107668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107668, "uuid": "d3e57640-2dda-441b-bc21-9efd61a1b2b7", "comment": "Malware payload", "value": "dfe07c5771a222e8342907604510c267", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107668, "uuid": "33e11a36-9fa2-4428-b035-7018391f6ef4", "comment": "Malware payload", "value": "3f74fefc1a037778053587de73509934054b94bd6ece95d4bb4f34e240ef2c9f", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107668, "uuid": "08a78e10-eeeb-4f5e-abf1-2372a78330f5", "comment": "Malware payload", "value": "e265929065c49aa7cd5310503db8c3e1481a03be", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107668, "uuid": "fe023867-fbac-48ba-ab1a-06956c8760f8", "comment": "Malware payload", "value": "3ff6d09bcc236abd6f6293fa5209eee00b37ced7a756dd36567f9262a67667e7cc2983945bd06060bfb4de1b12235e46", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107668, "uuid": "074eb7a8-95c7-4ab3-9c37-254794f0418f", "value": "T16AB41D063344CF25C11F05B5D9A7C2F81727AE00DD1497CB76CDBE2A3AB32E96A61687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107668, "uuid": "e0d4e266-b2ee-4f70-9632-cc88b68d78ec", "value": "1536:+zGGfn5NE9qWtp408/dl5PAaZ/Sv93Q28FHYqSjpPE:+z7fHE9qbJfhAP8tY5FPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692107668, "uuid": "6420215f-0002-4abc-aa44-6bc0b01dc4f8", "value": 518144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692107668, "uuid": "7bdadcf0-c19b-469d-a53c-f336039e2b4f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107668, "uuid": "bcb91aa8-d3c2-465f-9ab1-41c0a80245f9", "value": "nQUOTATION_AUG7FIBA00541.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1038540-3b7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1692110971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110971, "uuid": "2721b5bf-c0b5-404a-954c-41c0a792ad20", "comment": "Malware payload (RemcosRAT)", "value": "f85baaa7de06627183143f2d157eb9be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110971, "uuid": "f089a1b1-9279-4c49-bbcc-81ccb38fa4d2", "comment": "Malware payload (RemcosRAT)", "value": "3f9772d59aa3dbdb843f8ab898860be5f4170046bc2a0f527e1b33d3c415bd9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110971, "uuid": "4dfb9ff4-baa0-4c0d-b487-b686e2b9fe98", "comment": "Malware payload (RemcosRAT)", "value": "00d6a8069cba8ecd133a7344138f5c1bcb760170", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110971, "uuid": "c7e00666-7ca4-46de-84b8-a40fa3edb0be", "comment": "Malware payload (RemcosRAT)", "value": "9a0a55c7b8053726c639bd28bce72621d4ccaebd4e1031e62b65a2a40943becac21547203ce942eb030710edb328428f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110971, "uuid": "dea530c9-b1b4-4253-8d3a-c743c94d8d43", "value": "T15FA4AF02BAC1C072D57651300D2AF775DAF9BD20183A457BB3DA1D9BFD70190B63AAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110971, "uuid": "68bb8001-3325-40ab-875c-32ad91726b27", "value": "04d77d421b8e5297898a3fce39d74267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110971, "uuid": "b2b548d7-ce9e-4f23-8cd7-7e271c38303d", "value": "12288:tRXxReZj3WZfj/2eSseWFaIe2+f8CL47bs/ZO2yDU:tx7cyF2eSsewS8W47eZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692110971, "uuid": "d13b9051-626a-41c1-8ada-9994a0440c70", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692110971, "uuid": "387fe815-9a88-4fad-834f-e5f7ad1c6062", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110971, "uuid": "ca3d22db-2af7-4b7b-8860-88d5b0133bb2", "value": "decode_2ab68d8e08d88165c09b83d3638069ab7fd4cbc15df49b5f5691239d5023f9bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04577dfb-3b71-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692106708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106708, "uuid": "72624331-1ef9-4ab9-847f-77e8353bb93b", "comment": "Malware payload", "value": "853d8fb290bfa01eae9e089691a58730", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106708, "uuid": "ef6d60d4-f831-4518-95eb-a856028db830", "comment": "Malware payload", "value": "406373334a8fb865e933f0eb10437b7f037421f262a147d8e6d05a807e0f9c45", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106708, "uuid": "a542d29e-14ff-4ef7-b710-6773e36a2c68", "comment": "Malware payload", "value": "551b7657a94eb494a717df666651893a70a4941d", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106708, "uuid": "2d8f2866-1b90-4b0e-bdb3-a098cbf7bedc", "comment": "Malware payload", "value": "465341ab47440d2f3fc5fc2b29c8a597b490bb5e89457412a015d9ae526540a6b3714dec1e05609beb3f9c09e46429fd", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106708, "uuid": "f0057b85-ba20-4258-97e0-965d6969aca5", "value": "T1CFA02475DF004003D41011F0503743451C334C0C0510C1711F7170504C43D30F1C1150", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106708, "uuid": "2b8a6877-dda8-40a0-a37e-f2df3021c817", "value": "3:ud3FGlvL1Pt3yCW8FW9igzSLkl:udVyvL1ASFW9ZzS4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692106708, "uuid": "050fe461-3884-4260-8e92-63fddb929511", "value": 82, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692106708, "uuid": "94bea658-9556-4f24-bcc4-30c1a3b1f180", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106708, "uuid": "f58f277b-2bdf-4ad1-a055-9cb3bea229e2", "value": "Purchase_Inquiry_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad8829a6-3b13-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1692066619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692066619, "uuid": "7f4d0214-ea92-40a0-89d5-bec9f8af0be6", "comment": "Malware payload (njrat)", "value": "1ee3243425927a385b006110185f20f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692066619, "uuid": "418b1038-188c-475d-a728-3178a45eefec", "comment": "Malware payload (njrat)", "value": "40e7d21ac30faf402ddd621a4ac302deec0dec1a3f44be66184b540009f55b83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692066619, "uuid": "43f4fbde-6669-48be-8b4a-94dbe6a1b499", "comment": "Malware payload (njrat)", "value": "56efed2f45d68698fa851f81919c5e1df664d5c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692066619, "uuid": "e21c7d2c-31cc-4909-8649-6cc9da8a387c", "comment": "Malware payload (njrat)", "value": "6f78c6a55982debeef5ab1a4fa43157f808b662e93af79c4f046af57c707d430d04080a11aadb3fae44c06510dbabeec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692066619, "uuid": "df22b149-bc5a-4fa1-b2d0-f74f63dc0d75", "value": "T1EB033A4D7FE18568C5FE0A7B46B2D012077BE04B6D23D90E8EE564AA37636C18F50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692066619, "uuid": "decaa86a-3f08-46c2-80a1-078fda7b2b22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692066619, "uuid": "6fe8ff25-590f-4ec7-a36a-5df36e7bb44f", "value": "768:57rtsKADtOHiR4akrYBQWlly5rM+rMRa8Nu1et:57r8tVSkBQWlEa+gRJNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692066619, "uuid": "f6c71691-7d1c-47e1-b021-e42ce2edfc0c", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692066619, "uuid": "a64742ae-1a8b-4514-9711-4c5930126abf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692066619, "uuid": "ae067ad1-7a2d-42af-b74c-cc47b5f1c222", "value": "1ee3243425927a385b006110185f20f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf9217a0-3b71-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692107022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107022, "uuid": "881bab64-6f39-40d5-b4a6-ce9acba33240", "comment": "Malware payload", "value": "4f17f4aaf012836d761fe441705d06bf", "object_relation": "md5", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107022, "uuid": "88e1d71e-84e6-4d32-bbe8-fd1f4ed58f56", "comment": "Malware payload", "value": "431a2c1a50bcf37f7fbd1c938a7db19ce8cc704afffd9dd1f16da237f8006130", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107022, "uuid": "203fac88-c57d-4ca8-b88f-099a629bf38f", "comment": "Malware payload", "value": "7e991fc9814cca5258d2b87b12ca10208f4507ea", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107022, "uuid": "7ceb924d-8ac3-45e5-a5d0-f78140b68538", "comment": "Malware payload", "value": "7ca71d0e6b9d9e980e7dd7876618e1bbc19449336affef14ed7473c45044497759e9377cd0c3aa44c9b9bde30f546083", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107022, "uuid": "7ae4fc9d-3f43-451d-9c58-12f4721f6609", "value": "T1B641759F52033427A1F322A4DB82AA1AEF6540CF881867047ACCE14FAFD152D47B7F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107022, "uuid": "3cd180aa-cf3e-4616-90ff-0a89895e7fa8", "value": "48:h5JSS+nfC6oYabY2RfpXY2CQpScoX+pQikSEDAKUIPOP:zJ/+f/0YMXfScA+pQhLDA9IPOP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692107022, "uuid": "e2cf7da6-bee8-472a-8c81-74b05d8b9859", "value": 2323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692107022, "uuid": "b8b9792e-64b9-4576-b1d1-21d4c1b30542", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107022, "uuid": "98616def-2f06-4171-a354-440e745992be", "value": "gv1qm4Gz.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc4e974-3b3d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692084496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692084496, "uuid": "ce02909c-48ca-4265-9b27-3adaee2ace69", "comment": "Malware payload (AgentTesla)", "value": "324d206783a13d934c746434dd9fda58", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692084496, "uuid": "94f282fe-7058-4469-b740-2b1ccb6bb5d4", "comment": "Malware payload (AgentTesla)", "value": "43ac3a21c7bfe1b8e7f7a1761d493993d432dc8dfab0cea684730944c06d0d7e", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692084496, "uuid": "cc3cfc3f-484c-400a-a133-dddc94d0d7ef", "comment": "Malware payload (AgentTesla)", "value": "4f7552455616994a19c49f40b209ca2f971a230a", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692084496, "uuid": "1c37710d-86f3-45c3-87a7-913d5d417441", "comment": "Malware payload (AgentTesla)", "value": "7396c911e69d3dc387ebf5a6516a0e44bb5b9660e3617ed074a4b91f10dae914751533e56eef6f5ff6a1db0e0fea3ead", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692084496, "uuid": "d44ee7a2-0c05-407b-9c80-c8bedf0cd099", "value": "T13EF433F2BB3BF6E3B723CAA9A20952742102A745F905172705F0CC6613CD25B9D4676F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692084496, "uuid": "31b37ade-dfbe-48e4-8995-a5a028383e4c", "value": "12288:2nbPMUl/KSS3X3caNrmVRFpVKKBPQHvHJtpyDyWq3j2kepgBqf3pOjRtXAbKQKEl:wbP5lxSskrmVbpVKXvHzQDI3eDeRGKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692084496, "uuid": "dd4ea7a4-084b-4285-b697-66cffe433668", "value": 754824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692084496, "uuid": "c114d616-ea75-4170-9431-614f683fda5f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692084496, "uuid": "96cb9377-43df-4305-850e-8c85bfbaa2a1", "value": "Overdue OA payment.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd216db1-3b68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692103260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103260, "uuid": "79a732fd-79f3-44ef-b3d1-8b1480751059", "comment": "Malware payload (AgentTesla)", "value": "83b0dfc062ae26043b4a1d77c5bb0ecf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103260, "uuid": "64b6791d-42e9-40a7-abe3-7fd7dbce7da4", "comment": "Malware payload (AgentTesla)", "value": "45be2740870ebe4272e62da02cbb6097ae4d4802000d50e514f3d5970b46eb50", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103260, "uuid": "f3ff67f9-a130-4872-84f6-ab8624dac72e", "comment": "Malware payload (AgentTesla)", "value": "33398ca86be5c6166af66442b92daa9f27b68ae3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103260, "uuid": "2c42140f-dbc8-4378-9566-9b327e601ad0", "comment": "Malware payload (AgentTesla)", "value": "5ef63caae40bf1906e6482a4cf0f8099288ebfdfd3e40be2a597beae38f4390261f4e0003cfc8825c1110824cc7cfa61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103260, "uuid": "b38a84f4-e6b4-4923-920e-586e9284c1dc", "value": "T131D423837B4E3056E158418F2E0B4392F8857C5A7A4E39BDBA06FE8D479364F4E831D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103260, "uuid": "650a83cc-d04c-480e-a9a5-807382c18b1c", "value": "12288:c7d6G+Z81BWWr5rzfUWfghIEEhzWI5l2cJlm21u0cI06yve:c709Z8DtlsvIRWI5cOmFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103260, "uuid": "97399d4d-ef87-421a-b8d0-34eef3fe69f3", "value": 597633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103260, "uuid": "fc41cd59-f666-4a01-8800-8521eac274f4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103260, "uuid": "6b0826ab-f7ee-496b-8fef-3b1f9118d64c", "value": "Levanto - PURCHORD39220.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01353cd6-3b66-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692101978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101978, "uuid": "c6786f07-02fe-4179-99a0-6d0b713a3952", "comment": "Malware payload (AgentTesla)", "value": "db99b8955cdbd95f533b554bb6f184ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101978, "uuid": "66b411e3-9236-4a39-a0f6-307eff23d7f5", "comment": "Malware payload (AgentTesla)", "value": "4624672d7b51d9a170730560ae4b3075c084a3b756f7452d33a630916c4ae7f5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101978, "uuid": "29bfe34b-1514-4b6e-a781-eaf4f8d623fc", "comment": "Malware payload (AgentTesla)", "value": "591ce6c6fb1cd652c536a98f94b394d38a19d1aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101978, "uuid": "63622a72-b06c-4245-97c4-ded6fff9b88b", "comment": "Malware payload (AgentTesla)", "value": "3f561fbfea44c1e61d7c86aca5898bc6096163a3e29574a4670d5a55263aab341594802f231ed237ac1d83cec86da07e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101978, "uuid": "8921e499-2e12-400e-a4a7-f6c7b3c182d9", "value": "T1044523083989449FD1E6B13459C2A8D7858CBC32AAC1C64770CCB36D5B70FA6C75E7AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101978, "uuid": "c3d9daf3-ca5e-463e-a3e3-001961a2cc25", "value": "24576:qu5/bJT+6bvdXXXXXXXXXXXXUXXXXXXXXXXXXXXXXiDmGwJNr+XBVrcdNEx/d3T/:x5/b86aP6xVrc27P3OGm/Twm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692101978, "uuid": "dc6433c5-5686-49de-a7dd-40965e9b957b", "value": 1222656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692101978, "uuid": "a59db15e-8fb3-4c07-9bfd-9be6703dc3f7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101978, "uuid": "301c04f0-fea1-41df-b89d-fef638a14f17", "value": "EXPEDITII_FAN645732748249924.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e98fbb-3b8f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692119695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119695, "uuid": "40153e4a-b78f-438f-904b-3fd85dde5b81", "comment": "Malware payload (Mirai)", "value": "1dc76b306b472445937b16c0643ed8f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119695, "uuid": "74fb83f2-19d8-44a9-8f9a-a492450e5a87", "comment": "Malware payload (Mirai)", "value": "46a913fa7fc4d55700e8708e895eb64285e48f5d87e16e7cde09597e3e872a4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119695, "uuid": "e1258b54-044c-4961-b1fe-cc5c1476af19", "comment": "Malware payload (Mirai)", "value": "b29614e350a505bc92406f8fc64557f1923fd253", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119695, "uuid": "a18f1e26-dd46-4cca-ac7c-251a1c1a2299", "comment": "Malware payload (Mirai)", "value": "4223a5f559c2016ad31cb0909daae0e7fb3e3a57d1c97802a6a6a68ceb0858ea9dbc411bb364f70e6c53e9ad7450931a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692119695, "uuid": "8100044a-9e8d-4730-8ff6-b8f11335f673", "value": "T1B7D30946F8819B12D5D111BAFE1E124E37231B78E2DE73029D246F707B8A9BB0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692119695, "uuid": "ea8c9c05-f037-4875-b183-41bf6323b9a8", "value": "3072:BfHAMOUXpSKxXvWXcfVGauwRReU4LGom:BflOkVxXeXcNGanCLGom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692119695, "uuid": "e0a0c827-fffa-4eb2-8931-042732301889", "value": 137680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692119695, "uuid": "47764e78-c23f-4d6e-9bc0-2142e1d6ba88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692119695, "uuid": "21cf47aa-ee88-4dd5-8fd8-824fc6c3bed2", "value": "1dc76b306b472445937b16c0643ed8f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "922b53be-3ba3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692128421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692128421, "uuid": "c5c584a3-4c95-4222-80a4-3bbed9325970", "comment": "Malware payload", "value": "c07105a8e092bd25c1e26e701c2c024c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692128421, "uuid": "7097c727-8a01-4506-bcf4-95ddf88af24c", "comment": "Malware payload", "value": "46bbe7c1608376f14a27f164fc06627609697ff9dc8bb1d10003a616dbb3eecf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692128421, "uuid": "308d94d8-7f78-4a20-8bf1-b86fc6e16872", "comment": "Malware payload", "value": "b3b9c678101ad565e98828b54c801cdece21c5d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692128421, "uuid": "2d14a70f-31d6-4da4-97ab-fd25d8e76a02", "comment": "Malware payload", "value": "cf1b3a145ca2fb96db6a8fcb57c1ff99bf7c3e238dff6b801ddbe820d01016e4a74e008d92a7bce4ccaf010d249cf963", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692128421, "uuid": "3b61b948-8caa-44d4-a67a-84a986a2fbf6", "value": "T1AB92D93FE71368E9C106D57845FF7732DCB17DB385A6932E1724D2B42E105A42EAEA10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692128421, "uuid": "768e70d0-ef0c-46ca-a074-0b9e7db233a8", "value": "147442e63270e287ed57d33257638324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692128421, "uuid": "f80012a5-4d37-46f0-8bd9-b8c54db90ae2", "value": "192:XV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2uKdYWF8qa1Dojjgi:BqaCF31cix+Dc4zjeFF46gi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692128421, "uuid": "3d1e66bf-2c6f-4f0f-a4a3-cb181507231f", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692128421, "uuid": "cda3c4e3-5daf-4098-946c-74f609efd6e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692128421, "uuid": "2e89505a-64e7-4d63-8cdc-f664bc6ed4b1", "value": "artifact_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b4e88fc-3b73-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692107659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107659, "uuid": "2382671d-f714-4430-8aa9-083e46a223fc", "comment": "Malware payload (AgentTesla)", "value": "0e2cbe105ed1d1166222c2863ec868bb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107659, "uuid": "1f6338a8-02f6-4970-911b-d66a3642a4e5", "comment": "Malware payload (AgentTesla)", "value": "46dec447edf772e1511ac2389736f3f4fbbd26f4873994c64e899292dc86d54b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107659, "uuid": "cc5e5e65-c380-4560-a3ae-08b8558e11df", "comment": "Malware payload (AgentTesla)", "value": "81a1dd2816a7a98507df2cbe8c11266b5f79a7c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107659, "uuid": "d855ccd8-3585-4383-abaa-e9ed70b9c499", "comment": "Malware payload (AgentTesla)", "value": "c7852f1fe338668de47b899ff91e77f9a3214014d31791030b5fb0a67b90188340eb2bf3bb9e1539163cdcb146613191", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107659, "uuid": "e7e7961b-d48b-4d5b-b784-f9d539e3e22e", "value": "T155E49BD6E8BAD6E3C46597F8609124049F387FDA3469D1980CA630D67AF1B043397A3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107659, "uuid": "1aa41f8a-125e-41df-8c1e-0c512b0b6c32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107659, "uuid": "22f07ea2-8b3b-4689-be5d-a6f067ac6410", "value": "12288:TMaa4lrr/r/kK0DkOB9n5/zdYHseavXqQWlW:TMz4lX7kK0QOB9nJzdcsf6QW8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692107659, "uuid": "0a288821-8d09-4c76-b014-6bd899d5a3e0", "value": 714752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692107659, "uuid": "5562a8e1-b501-4214-9d01-eb55fd26dcac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107659, "uuid": "fbf1b967-a26f-4cd3-bd3c-a0a88a7af2ce", "value": "z46eKpNczsvsrg2wHR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd440fe-3b3d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692084608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692084608, "uuid": "43843673-4bc9-467a-bb98-b8a93e49258a", "comment": "Malware payload", "value": "7aef7114f73a39a73c0586b49235450d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692084608, "uuid": "be01d9a6-1ad7-4aa4-9a7c-865b1ee44f18", "comment": "Malware payload", "value": "47280c5cf11e7393ff8f4be97e78911fca4365bddafa4d43c67c53610a9dc6d0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692084608, "uuid": "0434d1e7-e849-461b-b148-4e57cc648398", "comment": "Malware payload", "value": "dd24b8963105aa0981b511b28b12e82c3cb31446", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692084608, "uuid": "4f4896ee-dbfb-42ce-95f2-88b2a4375cbd", "comment": "Malware payload", "value": "f72065c8f5f8129bc81ac935504f6ee2b014f96db91d4e6809ad9a1de5160fda80e9729703db4543d6ccdc308b429570", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692084608, "uuid": "a1e54b2b-16bc-4dab-ba92-4841bc6c0665", "value": "T1F5F29E6BC205491FE3425E3385062208F2EEF216F52B7393767C8B9D4DAF5DA2A50B4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692084608, "uuid": "e5e7fd06-487a-44f7-98fe-e6f91774a882", "value": "768:QIPf5f4ZyQlFnAktIgglgUSms4O6TIfiAMe368R0BmG6fiAA4O68fiADB4O6v5G:QRA05ftIRPs4qKad0B4Kp4CKAB4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692084608, "uuid": "fefc91f2-524b-419f-80c6-25debad21711", "value": 36170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692084608, "uuid": "8ed934ff-4707-4e05-9b2d-9f18652bbd5a", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692084608, "uuid": "567628c4-c599-49fd-80ed-27f30381f6d7", "value": "SWIFT COPY.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "099a9208-3b7b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1692111012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111012, "uuid": "cafb835f-6f12-4a89-9929-45649fe6aa21", "comment": "Malware payload (RemcosRAT)", "value": "61a01779d1734e6e1a12b31832d4a9b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111012, "uuid": "724232c4-2868-4637-84c5-d2fd84e61c1e", "comment": "Malware payload (RemcosRAT)", "value": "49342179b439a993b69af1a4b07c0adc03bfbdb1d96c65698e78249bf3022c77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111012, "uuid": "accdeabc-a2b3-4005-9fe4-f98896d698e1", "comment": "Malware payload (RemcosRAT)", "value": "b1b514635f4f2290cd6ade46a71e31efe393776d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111012, "uuid": "c55f22a5-af9c-4be7-be4f-d68b7e168925", "comment": "Malware payload (RemcosRAT)", "value": "90d7d1499466f8bfa162e14e6c0e74ced08dd1880bb54fc93aad9bb384fd009f17d41c2b408ea99e49ab8e0c35738d94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111012, "uuid": "ff8e4562-53f5-45cc-9d89-909f294f2226", "value": "T1D0A4BF01B9C1C072D57261300D2AF775DABDBD212926497BB3DA1D9BFE30190B63A6B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111012, "uuid": "1e7a646b-d9a7-4761-b9b8-673305d1552f", "value": "3f3d4ba55ce3e8f736704310c56bf5aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111012, "uuid": "0864c16b-6af5-4754-9d2c-9e1d28859e5f", "value": "6144:S1EwL0xQk9VdeLuVnQs8QLgt8cBvnkCX/3Rde+A+DdsAOZZiXXPcNZ2OhX:S1EZT90uNQzYgScBvnn/XpTs/ZiJOhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692111012, "uuid": "483104a3-5167-4084-9d60-03b1d0b9c168", "value": 489984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692111012, "uuid": "f3e6ca24-267a-4f8a-84fb-ca3646311691", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111012, "uuid": "b3bab16a-b627-43f8-8173-f58d64fbe12b", "value": "decode_c6ec09228523b78eeb028dd6c36403d58ccb38f87b1576ec5071c8f0b9415558", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eecfaa4e-3b7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1692110967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110967, "uuid": "765ae782-aab0-43ce-b020-43254071c7a0", "comment": "Malware payload (njrat)", "value": "ce2894675ad1697ee58f744894d6b896", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110967, "uuid": "1bd7bebf-1ed6-4b5a-803c-fa468de22b32", "comment": "Malware payload (njrat)", "value": "49561ba535b0ace7088275850c7226178f964937f30a69455513034e5ffb9bb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110967, "uuid": "7625c7db-1fe6-4bab-81f4-b15cffb8a62f", "comment": "Malware payload (njrat)", "value": "d62b6119a51430d9588970dceeafc19111177603", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110967, "uuid": "81b53e6f-dc3b-4e58-b27e-43de62ce6927", "comment": "Malware payload (njrat)", "value": "1a50af3023ef9c3ba1466bb5f1c13b6b442c175e5e63262393d7b9a938eb3af2fcd12bc458111f75ba920b725911029b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110967, "uuid": "38ecd1a0-4f05-48f2-86db-2cda1313fdfd", "value": "T120E2184A7BA58225C6BC1AFC8CB313210772E3478472EB5F5CDC98CA4B676D44285EED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110967, "uuid": "caf94157-6965-4de2-b67d-1b0051e5896c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110967, "uuid": "65fa0dd7-d5b0-426d-a877-eb49a4313fb2", "value": "384:M0bUe5XB4e0XPOdv3pixEpfnWTatTUFQqzFAObbC:ZT9BuG13pieGbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692110967, "uuid": "6cd64242-30d9-4675-a8ae-d74255081c63", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692110967, "uuid": "eb6abb3c-0d49-4993-9cbb-3b08d2b6a5ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110967, "uuid": "704acef1-809c-4b6c-8310-b22d513c49a2", "value": "decode_26514e06ea4c004f478c5e5448d2009e00b23bf64e4cfc4e3021a6c0a0ce1853", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad75d69e-3b7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692110857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110857, "uuid": "4fc504a3-d87e-4491-9042-13ddf903f4bb", "comment": "Malware payload", "value": "c3ef56f85d330364b9872017c0a4ecc2", "object_relation": "md5", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110857, "uuid": "5b9cab28-2020-4ea2-b920-7a6063bd2c18", "comment": "Malware payload", "value": "49908fdafcf020217397a1db7fba74fa1163b08c2ba1b1b97a568dc4d32b622a", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110857, "uuid": "2c3a442e-322c-45e9-a43c-710ec3f18bfa", "comment": "Malware payload", "value": "b66fca057b6ffb12b9a914e7514f6ab5e880cc58", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110857, "uuid": "4fbe9c54-d9f6-48d1-8ade-96f70651c728", "comment": "Malware payload", "value": "aa06854b0f9c3868143ed2226257f7f07f4ce38c5ff80a0a5ab589db4bbc6eba18d4bc2ef2dc8a1284e30b98d5a50889", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110857, "uuid": "4a86ee4d-2747-4c99-966f-b727b049dce1", "value": "T1894176F2F727C1D44476A7779CA7D089AE78806E002115097ADCCCEAE7B1D606271F87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110857, "uuid": "ee8e86a3-5f40-4452-8cea-e9b4ff2df852", "value": "48:8c05oxSCr1Vje11Z9IYb19Z/cPFFpgfqpg4:895ogCrLGZB191C5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692110857, "uuid": "b263612d-c2b7-4b75-923c-3fb2c5049eb3", "value": 1952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692110857, "uuid": "f44c060a-86ef-485c-9a83-34ef8be875fd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110857, "uuid": "a07a6c04-d684-49b5-b619-61739b70f7a7", "value": "NNvv6kKe.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5db9ab-3bb3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692135120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692135120, "uuid": "6b8ed97e-99c8-47d6-b7dc-124e755d5374", "comment": "Malware payload", "value": "f06d347d154b33354624607216867cad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692135120, "uuid": "33eab26e-6ea1-4508-a592-cfeb58a3f193", "comment": "Malware payload", "value": "49b99281ff759b1dc7bcb969e72d88ecd59b897cb4f0f8c1158fcd1742d75e96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692135120, "uuid": "df953f36-e83b-4ce4-a267-3f4a48db769b", "comment": "Malware payload", "value": "cb5c507f144d60e0015c96af98a397082868398e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692135120, "uuid": "05385843-597e-4d08-9eeb-c6ba7f67b571", "comment": "Malware payload", "value": "bc82daf150784523f5dd3af1001893bbe816f6bc8a0215a760a8d0a2220bf34a28ed00d61dea1526dcd36e7ffdccbf21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692135120, "uuid": "94aa077e-689f-41fa-a74a-5aead8871593", "value": "T1A4D423AD15A804F7F2350A38E2BB6BAD853AD7C17C444B7ABAE0855F04E15C3C76BD42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692135120, "uuid": "0ca482d1-58cc-4ffc-a438-588215e05dc5", "value": "12288:sn7Abl43Ufy1ZBR/Od4xoT+e0wiW+Sb+MO1+SRnpafGCO87Y:5l43j7bxoivwiVy+g9h7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692135120, "uuid": "9263b938-fbbb-4c62-95bc-60b230c09df4", "value": 599552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692135120, "uuid": "26eb5e35-7dba-4fc0-a9c9-df282e50878f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692135120, "uuid": "309e44fa-bc6b-45e8-8110-66d9bff3af05", "value": "SecuriteInfo.com.Win64.DropperX-gen.666.31422", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f0c7609-3b7b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692111155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111155, "uuid": "cc33ebab-6975-4929-8070-3917b12394c1", "comment": "Malware payload", "value": "febd92703ab25ea0e51fc2708878500a", "object_relation": "md5", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111155, "uuid": "2f41a56d-9a60-4eb6-8b82-3e58835c62c5", "comment": "Malware payload", "value": "4a56f5692ac3d97cb86adb210449d25a48026a666331807a707bee1c6c9fc753", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111155, "uuid": "65cad931-a99f-4b59-a8fc-f0c234388efc", "comment": "Malware payload", "value": "b9cecbfc1a8e8c5eecae923b501c6a9aa5f730bd", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111155, "uuid": "e60db8dd-9dd1-4212-96b8-80a31f68f6c7", "comment": "Malware payload", "value": "e3ea7ff8f61bd4e2af12a5e578c9587ce471e17deacfc8b07b99d2502b80e9f4ee31718db62015e9985f4c6ec096e088", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111155, "uuid": "621098b5-5326-4634-bb60-7467ef15b157", "value": "T15A41A87F4291313BB7F221569281B107F995808E5C1B39047BDCE25EA7C536683ABA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111155, "uuid": "e56e9d7b-9e7f-4f6d-aa7d-b33a14802a18", "value": "48:rujc+yjody2xjSvb29XY2CQpScoQ+JwpAikSE09TZOU:roySYT29XfScx+mpAhL05ZOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692111155, "uuid": "213d6ecb-1f27-4031-b4ba-882ac5f50dbf", "value": 2099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692111155, "uuid": "9b95bbbf-9f50-48c5-af46-3a87e2ba980e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111155, "uuid": "1a3143f8-c83d-46d8-8da8-a64d7fd9003e", "value": "sykbswPw.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb52bb9-3bbc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692139288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692139288, "uuid": "84583624-7f2d-48e3-9e6b-8b0022d09550", "comment": "Malware payload (Mirai)", "value": "94824d694fd1400d8e3e3166da346cc6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692139288, "uuid": "fdd8352b-e8d6-40da-8717-fc607f4b38a9", "comment": "Malware payload (Mirai)", "value": "4b029afa612acc7fa95357800c4d5a9844a9f8198dba10f84471977bb5a8cbac", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692139288, "uuid": "341f8a36-92f0-489f-bc45-5b9e7d68bf2f", "comment": "Malware payload (Mirai)", "value": "08a4edd9c20f154843cced5c1409d253bb39ffe1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692139288, "uuid": "0ea279de-359a-4a73-b42d-90acb0665719", "comment": "Malware payload (Mirai)", "value": "dac31ec6c0ed5f9d3b7e0fb76bc6a02cf15c9b3597f3542bc7d0d11c8e8284bdbd9d698ce379cce6f5ccac7d5d37d928", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692139288, "uuid": "88d8ec5f-0402-4531-b540-c64d71aa0e9e", "value": "T1B8D34B1BB6C190FEC4D9C1B44BDEE536DD32B0AC2134B16B27D4AB362E59E206F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692139288, "uuid": "9155d4ae-197c-4a81-b887-c2d29d85a094", "value": "3072:ok3qvanRTD61Avn5+aogUMkHhGxz1cUFQG3B:ok3q171he73B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692139288, "uuid": "83c77e2b-3e87-4a1f-a5f2-5144e192250c", "value": 135480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692139288, "uuid": "c48083ed-443c-4162-89ff-90bc7c2b5cae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692139288, "uuid": "0c25a6f3-60b9-4d05-882d-80c58739f115", "value": "cundi.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acff9e72-3b6f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692106132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106132, "uuid": "5465f6f0-2c88-41bc-9939-9facc02486b2", "comment": "Malware payload (Loki)", "value": "f272ac4f0c0fb9717638c1589432dcce", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106132, "uuid": "0d5bdade-4108-4cbd-aa83-de02cea82b9c", "comment": "Malware payload (Loki)", "value": "4b306de0d2157ecef919d5470ad2432c919f0a8dbf3decae53e9cd80887a9f47", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106132, "uuid": "8aa155e9-62fa-4376-870c-c2ae5f03cf4e", "comment": "Malware payload (Loki)", "value": "44d00c4d2e9cd64db898021de9b0a38549cda9fe", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106132, "uuid": "af1a10df-a0b2-4660-b201-902b6fdfd4b4", "comment": "Malware payload (Loki)", "value": "0f78228ddc3d7605c2409743c87280b70537bffd640fbe168abfbf10eb83a9dad758dbd253ec3a96adea13040ea3615d", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106132, "uuid": "28081a9d-9973-4ec0-bb57-546202f9dc84", "value": "T1468423332AB9C24AC816AF4E4A51C252ADE0E5BDE8DFF54467BC5939CD103C3DA0617B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106132, "uuid": "34fe0fb5-5957-44fc-972b-9130c680dc9c", "value": "6144:bs2/tdjz+mlPB2rsN8zquR/qP/Ieotbmk/TAEpmJHe9VzOO+D6Ztg/avoS:lzLSpqlP/XotbmcpmMOB/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692106132, "uuid": "b3a15408-a2e7-468b-93a8-c010a29c445e", "value": 376516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692106132, "uuid": "66522303-bed7-46dd-95d3-e923fc08f481", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106132, "uuid": "08adce49-ecde-4687-a3ae-84c4ce9e00ca", "value": "INVOICE.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edcd640b-3b7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692110965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110965, "uuid": "718b4a0b-4c83-4500-aa2a-8ef2f58a1000", "comment": "Malware payload", "value": "743bbc56f0367a3f1658bb15ec191bd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110965, "uuid": "35f2d038-3ee6-47bc-ab51-fa58d36cc901", "comment": "Malware payload", "value": "4c4ca989022737b17b65e04956d30ed7d9a9865519d591f8a897784e1545d316", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110965, "uuid": "3ef91411-879b-4716-9642-72b787836e0d", "comment": "Malware payload", "value": "e8aae00c174c3c49b186fcf85bbc834fb5e19aae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110965, "uuid": "03f95649-5dc2-47ef-889d-13cb3bbf20ed", "comment": "Malware payload", "value": "fdaa61abecb1605118313797f7b294f321ca7eefebdbfe34de6d6347e2094e0994f251fec71b25e425f1fe29bd2191bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110965, "uuid": "e5141072-2937-442d-9eb5-01910cf5a892", "value": "T188235D4037E88136F2FD47B9ADF2E6418679D2672903CA596CC814EA1F13BC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110965, "uuid": "157045c8-318a-4433-a501-5ca6156b1506", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110965, "uuid": "0815c464-62d3-47f0-86f0-b76de80f692b", "value": "768:dOEuILWCKi+DiBtelDSN+iV08Ybyge+RkWtJ13x3/vEgK/J9lZVc6KN:dOtmBtKDs4zb1JkWxx/nkJ3ZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692110965, "uuid": "7d38ab3b-9072-4b4d-ae38-4a2588861190", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692110965, "uuid": "7b56f8cc-8184-43fc-841e-7a4a3a0d6aa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110965, "uuid": "38289143-3c9a-4040-9c6b-a3f82ac5ec2e", "value": "decode_1fe7aaadc807fa4823f7fa5d7be254e8ae27fdb540aa79d3d149ea9a19d96bdb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "104252d0-3b87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692116177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692116177, "uuid": "4abe1e88-0729-4413-bcb8-3d4826046885", "comment": "Malware payload (AgentTesla)", "value": "30eb517464cabd2db114e04ee21f78dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692116177, "uuid": "f6a88ccd-847e-4334-8ca1-2469cefd5e8b", "comment": "Malware payload (AgentTesla)", "value": "4cf4f2da3b0b5148df4ee70b30009314a1b3a47dbec4607b5643c043a0582445", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692116177, "uuid": "1727e884-05e9-4869-b446-f13ce29c20df", "comment": "Malware payload (AgentTesla)", "value": "054aaefcfc142b604f13e28e22f82aa869a17bc7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692116177, "uuid": "80f70f1f-f470-4d35-bad5-8a9d5d17e5fa", "comment": "Malware payload (AgentTesla)", "value": "eb40600a816fd0324b7cc19694aff938b6c7ceeafdb88b8af3e1766124ecefe7a81f40eba6ac4cc8f9e1c1e8be8ae538", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692116177, "uuid": "61193ecc-b8a0-41e5-8ccc-106a3c92f2e4", "value": "T14B25F70058750092EF3D227D1A63573DB9BC1D53A2F2C5E96B2726D38DD3012CEA9BE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692116177, "uuid": "919d1f93-c09e-4fc4-a583-238fcf11f135", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692116177, "uuid": "2c318dfe-2065-47d5-afe9-2ef763fc8457", "value": "24576:bj4m9zPIvpppXpppppCOopppXpppppCOxJf2W+ANO8wumpTC5/Mpwxqv:IkISO/OWQA8PUlB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692116177, "uuid": "2152de71-b84d-4ad3-a102-e2d959740e80", "value": 970752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692116177, "uuid": "6246c486-e4ae-44b4-8160-9d6e31afab6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692116177, "uuid": "89bdc48f-34cc-41de-849c-58647d5dfe23", "value": "Remittance Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e21478-3b40-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692085798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692085798, "uuid": "a6821e02-7bc9-4cbe-854c-255e3d354c21", "comment": "Malware payload", "value": "3315b6a12d21c085535df4f2b4a17652", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692085798, "uuid": "465a3594-dbdb-4b3c-80d0-7812a7f6e961", "comment": "Malware payload", "value": "511aaed4f89bbc99d1a7f5b2332fdca9570e28a13f95508495dfdbf6c4b2df29", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692085798, "uuid": "1c7eb030-cf6a-448d-b5e3-2320443b2100", "comment": "Malware payload", "value": "6fc8f51c0051933062c215373406d553522bf5b2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692085798, "uuid": "434b71bb-ce54-4f48-a458-0ed3c10e0c31", "comment": "Malware payload", "value": "a4a4d99a2adf7ccf31fce85246ae9f53d740f34693077bfccb6f2a1ab579538daf46eda7bce693acd55dbd5b4a4e3640", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692085798, "uuid": "d0e03ce6-7d10-4dd4-b2b6-c17274536aef", "value": "T19AE4235DA5AF5204A7153FD3831AE3EECF82A40B1DAB86247E59623D03B24C579ED0D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692085798, "uuid": "84529443-3441-4856-a46c-0d5fc3fd1391", "value": "12288:asiFNDmg1wHkSTbckY2HwGQM8ZC7/t7En2zuzNLKtIXFKmrVJyBa8Q9w+XR:asiFhmgGH1Hl8k7xE7LKS9byBWws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692085798, "uuid": "2f267719-3807-4a51-852e-38838508fb5f", "value": 690297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692085798, "uuid": "3684888c-a4f4-4d79-9f95-267d99e68d0d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692085798, "uuid": "33e2280d-ce90-4e3c-94b7-c31797291f44", "value": "order 4500384851.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add9d357-3b2c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692077357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692077357, "uuid": "9b808970-188f-4da2-868e-97655fbc1755", "comment": "Malware payload", "value": "0c9523a098db6c53c6cdcd2492eef23d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692077357, "uuid": "92226837-45ed-4dc8-ab5f-a74a67da1c33", "comment": "Malware payload", "value": "527a0578f83a5450d857c9fe2f7a03e0eec282a060627c593097b812cb234e4c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692077357, "uuid": "73c08e83-676d-44da-bdfe-9d7af9806d87", "comment": "Malware payload", "value": "73441f603243f9782a527a4f7535815889366dae", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692077357, "uuid": "fd69e976-63df-43d5-9d35-d0bd9d2742d9", "comment": "Malware payload", "value": "e14c75f34c58150064395d521c235ce7e53d57346ac3c1ad93b8f41d1cb4ae25871644836feb2e580109ace9eee74021", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692077357, "uuid": "8b627901-8acc-4ded-81c9-fb8ed178d12a", "value": "T1B3936A01B2D1C475DABE19351420DA754B3EB920DEE0DEAB37A9067E0F302D1DE34A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692077357, "uuid": "b2360b86-4733-4a00-b57d-f577609c8041", "value": "9de2c5f4e7412eda6daeaef638405b83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692077357, "uuid": "bc342e36-b55f-489c-8463-59688d823da6", "value": "1536:ON/SnqpFxn09e2LFUQKsKLjxkflHlX8/S0ElsWeWcd+loLEG3aO8CbW:y6GFxnA1LFFOLjKE/Lv+loLESaAbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692077357, "uuid": "87e0bf94-80b2-4737-ab6c-7cb35937c43a", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692077357, "uuid": "42f04b12-bbe5-4e7f-ab40-03913b27d99f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692077357, "uuid": "49cde95b-4e57-4412-915e-eb5be0bdd772", "value": "SecuriteInfo.com.Win32.PWSX-gen.3990.1315", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a3103f1-3b69-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1692103336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103336, "uuid": "fc6dfcbe-7541-4211-8339-155a7452b8f2", "comment": "Malware payload (SnakeKeylogger)", "value": "70158d16b6c8b004ace08a28eba5fd6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103336, "uuid": "96cb30fc-c4f3-488d-8f59-f3323dfee0a0", "comment": "Malware payload (SnakeKeylogger)", "value": "52c6ffb87121554941e0039dc10e44aff96df0880d038bab6cc736d99814d0c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103336, "uuid": "4e3fb0f0-2efc-4fe1-a654-8eb2d8baec7e", "comment": "Malware payload (SnakeKeylogger)", "value": "5166bb5321ea3448799dc9fce9958ba8cd8b0cdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103336, "uuid": "c3c3303e-f731-4db0-b6ab-c8f8ae5023a4", "comment": "Malware payload (SnakeKeylogger)", "value": "62eaffd08f56530935bf1ee211904821ddfe3e5480e92b05220ae8ab943ed75c9b34eaef5ae8104f6cc4dba28db36191", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103336, "uuid": "93d99739-157c-4fc3-bacd-f120ca51d12b", "value": "T13DB34A07F7288A76D2870B3AD69B53009334E59BA763C78F744E53545B037E8BA72287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103336, "uuid": "a10fafb4-7353-4190-afe8-7e42b98af671", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103336, "uuid": "0ebdc047-5762-451b-8696-6ddd8bbe8d4a", "value": "1536:KfgrNUVbVaGgiA/DY9Q5V2YtPIdl5PAaZ/Sv93Q28FHB6:fqH+bY9Q5V/tPqfhAP8tB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103336, "uuid": "4b1c8a6e-6eb4-49ab-a75f-e4f47159e054", "value": 114176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103336, "uuid": "615b7ca5-463f-493e-b264-741052c6ea2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103336, "uuid": "54526b91-cd25-4037-bc77-e518efcb28a3", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d26bade7-3bc4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692142702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142702, "uuid": "43ff675f-34bf-4579-b763-341dcf1ee35b", "comment": "Malware payload", "value": "603c0d031dce455b0359fda8b8be2049", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142702, "uuid": "ce71610e-93bd-49f2-8d20-e8d68e0b9c1b", "comment": "Malware payload", "value": "5386eec7f63683cc1704ee1a8c036a053b78f3fe304266f82358fc9459f3c0b1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142702, "uuid": "244c2569-3051-4be4-a304-feaf62247561", "comment": "Malware payload", "value": "059630e3cff54f9b58998d0d9a082e6f59db9198", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142702, "uuid": "01cac71e-aca1-489a-8ec3-141006de6fe1", "comment": "Malware payload", "value": "7c2748d30c647e08d838c7359c47f911009ca8f9a3f01744d16f8e96d089cee3210b1dcd2df9c35a0a86de06a41db370", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692142702, "uuid": "7d057083-88e3-44de-b3f9-f917f29a0c8f", "value": "T161130955FC82857BC2E017BABB6E6B8C377663D4C2DF7323982017A1769621F1D22E44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692142702, "uuid": "3ec2ac4d-c1b8-4d38-b111-49207312531c", "value": "768:C0ZROqEjEM+liIR54hzCwG5rZEX8T7TTQWZIEfjPyLzLcpu2DkXohfIDkMPyPznL:lZrEjEmIR545JG5r33fTyL8pu2DkwOkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692142702, "uuid": "e4b5f596-77c3-40f2-a22b-5e0c06521ce4", "value": 44572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692142702, "uuid": "c689ccce-36f3-4da8-a95b-cfaac3c70c7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692142702, "uuid": "a389e1f6-7683-438f-8303-28811ed748fc", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a7f3ad-3b71-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1692106715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106715, "uuid": "e64266ed-2426-41bd-ac78-93708d7aa15d", "comment": "Malware payload (GuLoader)", "value": "1a746c7947ef85999c3f3d4b74c32bc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106715, "uuid": "4e4d6629-b9b8-4fc9-aa82-fdc99332f6ed", "comment": "Malware payload (GuLoader)", "value": "5403223596e6b1c350ba5b90f08a50f8a761c183f5e8dcf195eb43ec901f0ff5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106715, "uuid": "d709ebbe-8815-4a43-b58d-f7c3a88564c9", "comment": "Malware payload (GuLoader)", "value": "630f79a2c05d03fa2a619f09cddd03faa2e25045", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106715, "uuid": "3e055d16-050d-4fe2-95ec-2617c8f720e4", "comment": "Malware payload (GuLoader)", "value": "a04fad669fed42b98bc88f6be909b6592f931b6fc0c600ecde466756727ead9f0418411bc60888870b5f253faf9ebab8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106715, "uuid": "f60a9739-672a-44f4-8c3c-e9ac31ecf6e0", "value": "T180B4014A3B48C862CC020F726572D4B94E77BD6D08FE852EE23A3E93B5F7381754A558", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106715, "uuid": "c6b86f8a-73c3-4e81-94de-90095eb2291c", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106715, "uuid": "ce38fabc-5d3b-434f-8001-bc92c9c7d753", "value": "12288:AUIW/llrrItbl4uIIa8dMdO9taXjrC6+75kR:AUL/7rItb3jidzjr2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692106715, "uuid": "3ab6ceba-6ecb-461f-bcb6-da0cf092c1b3", "value": 535536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692106715, "uuid": "b4d1cd1c-efe6-435d-af26-4c4698363518", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106715, "uuid": "1ac09cc2-318e-4bc4-9fe2-779ddaf7f6bb", "value": "rPAYMENT_METHOD_9075987565.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d0dbbe-3b5c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692097929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097929, "uuid": "335b28ce-ce6d-4293-a7ef-6e8dedb3d750", "comment": "Malware payload (Formbook)", "value": "3fe5ee1ceb6eb665fb7a2c76426b0a35", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097929, "uuid": "ffe83be0-023f-40e0-8cf9-78a9ec1012a3", "comment": "Malware payload (Formbook)", "value": "543387a9f0c34a10f58161613263ac045725360dfaaabd7ab5067ecf52b539a5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097929, "uuid": "3e9361dc-6219-4a4b-aeb2-d8948352dbdf", "comment": "Malware payload (Formbook)", "value": "47d507f4ef662c21c1b46b8548702d3bdf1cda48", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097929, "uuid": "79b3d855-e8fa-43f7-8336-94446af26857", "comment": "Malware payload (Formbook)", "value": "37af9f72b4eb998ab65f7ac5806472e9b673368786c640eebc95d6ddeebf77c608d82c663780469f86703dac165df2e4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692097929, "uuid": "6cab174a-1a2b-4ee2-9079-ed6a47b0c192", "value": "T15555F103E900DBC3D41D83F87E530EE90F0A6F19E99569DB14663F9B3B70A72099A16D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692097929, "uuid": "dc97dcfc-b5fd-4f07-9045-ecc063fa8c00", "value": "24576:UaZy0w6VgjKaWlEzp7aUZydw6VzjKaWlEzp7azzd6f/b7QAUQp5E/zwwx:UE86VgjKjOzRJ6VzjKjOzEdU7/UX/zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692097929, "uuid": "c1b6b1a4-147e-4f4b-b10d-fd2f202a2bc6", "value": 1330176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692097929, "uuid": "18d7f5b2-416f-46da-a515-8cbdb3fbae9f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692097929, "uuid": "c341085c-91af-4207-9a1c-ced54a1da152", "value": "orderX#393405.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4f6d0bc-3b5a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1692097153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097153, "uuid": "b7eb9e5b-b27e-472f-86e7-16d92366e8b1", "comment": "Malware payload (Gafgyt)", "value": "7ef37d11775dfe9ea50d1ebb7ae83a7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097153, "uuid": "5b95194c-26de-4147-ba0f-66c884a14540", "comment": "Malware payload (Gafgyt)", "value": "5470594e2dc7825f7941f8d263399b3848ea8b00f2689d444e41d67e8886597f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097153, "uuid": "b94ab520-4ff9-4ac7-a2bf-f9f388129812", "comment": "Malware payload (Gafgyt)", "value": "11fdef1932cbc2c7017e55e4c5a95e5a1f4a2a66", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097153, "uuid": "de265683-78c4-4ab8-a713-3bd5485c37ce", "comment": "Malware payload (Gafgyt)", "value": "59c3baf892f80febcddf7bc9304add3e40338e01a45937f68f8293abdb91b855dcc78a27f4a3a3b57220d21ecad4250b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692097153, "uuid": "72f915a8-8e92-4e76-aae8-7d24f1718b7a", "value": "T1C4B3E857FB11CEB3C85FDD730AA68A01108DA99746D57B6BB3B4DA5CE74684B08E3C80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692097153, "uuid": "f7c14882-ef1d-4105-92dc-7b62a50ed7ec", "value": "1536:Tgz/qzNLW/fMiZIX98U0I/QwErQNO15hVwbfKdwwjF9GhCPR1Ae:Tgz/5f5g8utg55hVwjKdwwjF9GhsR1Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692097153, "uuid": "6cb68319-32ac-4500-b7f3-14c7c678e6ee", "value": 116647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692097153, "uuid": "6d3a11fd-cdae-4c0a-9ad8-5133925a5265", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692097153, "uuid": "91667517-f39d-4660-b18f-7ad9048cb3af", "value": "7ef37d11775dfe9ea50d1ebb7ae83a7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "338e8b23-3b68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692102922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102922, "uuid": "5cfaeadc-a290-4e25-aea9-21f49152f106", "comment": "Malware payload (Formbook)", "value": "d0b5e28ea7fe6421a78f3e73c49ce5e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102922, "uuid": "ab937736-bafe-458c-824a-6a0c692fa274", "comment": "Malware payload (Formbook)", "value": "54ec929ab868528d647d285298b5ab71ef9aad83e1a3594b3d13f2a02f127d96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102922, "uuid": "4407126a-4211-44d0-80ff-1d46cb9662c2", "comment": "Malware payload (Formbook)", "value": "73c172755dfcc9b5762a7410497f4da86264a359", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102922, "uuid": "0bee38ba-6ac5-46e4-a2fa-09505a2358dd", "comment": "Malware payload (Formbook)", "value": "c13497da77d436fb37ceef270e76a2e4e6bf5408cf926febf76a803bbf6189e95f0e64b35cb1c36717a898c770436c69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102922, "uuid": "6a5db3cd-8821-4227-8a87-9b1825693e0e", "value": "T1F2F4AF74069AC60BE41B1734DCF3E2B57EAD8FA0A5D2C7474FE4BCFBB44A05A6642184", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102922, "uuid": "f0ed050e-c30f-4918-a28a-be02f9eeaab5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102922, "uuid": "e44990ae-36eb-4be0-a961-4b49a5d35924", "value": "12288:AtBCeu+x9twSZxex8EmVIXe5f+8xzPFXvpNMW4:UBCeu+5U6IO5W8xzdnMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692102922, "uuid": "cab9d038-9ee2-46fb-a328-c004952e7968", "value": 771584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692102922, "uuid": "ac03d71f-0534-4487-9505-c33404e9f19b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102922, "uuid": "dcfc431c-ef17-40e4-9f0c-4f70c414fb6a", "value": "SecuriteInfo.com.Trojan.PackedNET.2249.18716.5037", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52955262-3b66-11ee-a6f9-42010a9c0055", "comment": "Malware payload (WSHRAT)", "timestamp": 1692102115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102115, "uuid": "3aaca35e-c0b2-4ef7-983d-10d45072c497", "comment": "Malware payload (WSHRAT)", "value": "a1c23f6dbe187a6168eda9a75d5050f8", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102115, "uuid": "d2cfbeae-ea09-488c-99f0-e769256fb530", "comment": "Malware payload (WSHRAT)", "value": "5502c7306e749b3a59e5c8b35d7e3b21e397ac0a98092519a19e1c1de2ce1de3", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102115, "uuid": "95d29e81-54d3-403c-802f-8a2d57fc78c5", "comment": "Malware payload (WSHRAT)", "value": "3969f916dee7b2d658feb1850023257e6986dac0", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102115, "uuid": "2a2719d7-0dde-4556-99d6-34478397b3e5", "comment": "Malware payload (WSHRAT)", "value": "d931ee7e032db98b5d1e900f105208d6db599f9b09a6b05d194e212d079ce2a9513b382855890760f7c41b47c45c8d62", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102115, "uuid": "4525cb3f-8d82-4a5d-b80e-c885a8fb1a46", "value": "T1E3123A94AF22E440B879C647DE7D77909760BDA026F7F3EA18492E411031C6EAFE7B14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102115, "uuid": "0e31edac-546b-4448-befd-14d2c02f0423", "value": "48:NjhD1INdjhDlzDaNdjhD5nqNhIINu1G0NVaUsyOUsfhqzDaNu1G0NVaUsuazD8ug:R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692102115, "uuid": "f99f71a6-f646-4eca-a136-03bb95783ec6", "value": 9637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692102115, "uuid": "e7e3296d-780b-448f-bb61-cd9b512758cd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102115, "uuid": "8019d134-41a1-42b0-958e-cccd6de1290a", "value": "ORDER-230814AF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fde56ab-3b8b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1692117921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692117921, "uuid": "8ec84a48-5ba8-426d-b24a-286fa52a258b", "comment": "Malware payload (DCRat)", "value": "1714e8fc6d3622b9fc0503967cbf0927", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692117921, "uuid": "f338b9de-addc-4130-a2a4-ef9629b925e0", "comment": "Malware payload (DCRat)", "value": "558225c171d20db919c0e7e13902fcd36c24950dfd9860597646d647a56a1ef0", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692117921, "uuid": "4c12437f-a0f5-4121-a409-0eecdad15bc6", "comment": "Malware payload (DCRat)", "value": "187e8f1c5f8558d140659f848e7c4f592d67003c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692117921, "uuid": "20207e8e-c2ea-4546-ac47-3d3c2c922e3d", "comment": "Malware payload (DCRat)", "value": "659b99695789103966d347336540ab8f25226c6214b70a1e019d1c25b0804c8b96823587e51422344ea89d5f024934d2", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692117921, "uuid": "1721695e-bbe3-481a-8efd-d37d1328f6bc", "value": "T140557C027E44CE41F0091633C2FF594887B4A9516AA6E32B7DBE376E15523AB3D0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692117921, "uuid": "e21c938a-dcd0-4b47-b735-841164d31be1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692117921, "uuid": "a1a38b85-e0db-4389-ac14-0598820055f4", "value": "24576:9/qA7GuB37lYFzvzoApCIOM7chXzUNqjajxJqV3JfM10afpJ:IAx37ZHRQ8jC9Np", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692117921, "uuid": "f04b8d6f-c913-4e8b-a783-bf4dd0f91ff9", "value": 1351168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692117921, "uuid": "dd5fa2c0-a67d-4a22-ac3a-5f1c234eba13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692117921, "uuid": "60541ad1-324f-48ea-8f95-6194502b8801", "value": "1714e8fc6d3622b9fc0503967cbf0927.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eff4fa1-3b72-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692107155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107155, "uuid": "24d94611-96a2-4125-a39f-d14313f831ce", "comment": "Malware payload (Formbook)", "value": "0c96a12b154bd20e260582b1c88b859b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107155, "uuid": "c0f76a0c-fb5a-4a98-9a2f-dfe9022153f1", "comment": "Malware payload (Formbook)", "value": "5684da48d589acc2af548093f52ca9b00e43df94120a1503d2120a65b416a59b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107155, "uuid": "93c65205-5d9f-427b-b5cd-cbb2b1525ac1", "comment": "Malware payload (Formbook)", "value": "53705f8c0c8da8698927026d57e42e9c6fa8166c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107155, "uuid": "75fde05c-97a2-44e9-b0cc-a53157bca808", "comment": "Malware payload (Formbook)", "value": "ee545604f986a2c31b9993dcd7c4d175f22f3d5704b11d71f5af3c9865980ac6e61e040425b8e61e2620de0f8ccb98ae", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107155, "uuid": "279752b2-4d82-4694-b6dd-90b731080591", "value": "T1E13412A9C92DBE2E8B44E6332DEFCE52394509D1CF9F9A9361851A0C9A7370ECC55F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107155, "uuid": "2763e8ff-3d6a-4829-a9c8-a1cc224d316b", "value": "6144:XYWsqZ8wA9lQtnM8q/86VlzoUJI0li7eUezHCFJE9Sm:TZ8wAbQtnQr7JikAeUeLC8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692107155, "uuid": "4a637359-8e08-4cbb-9674-fb763ffb68cd", "value": 234155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692107155, "uuid": "e877e89b-fb6c-4e6b-9e62-00fc7523b1b6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107155, "uuid": "8f09a178-d5d9-4d98-973d-0c7bec59c871", "value": "TRF_USD 23,480.25.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d2b88a5-3b6a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692103931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103931, "uuid": "ddafb579-edff-43d8-a385-a8d4993adbfb", "comment": "Malware payload (RedLineStealer)", "value": "d9cc85558d134e556b76368bf54aef06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103931, "uuid": "21182b7f-433d-4487-8f03-6dc80d2d62d5", "comment": "Malware payload (RedLineStealer)", "value": "56955836c8cb4048312c9aff29dd845e6a45df99741f1c6b946a23bf9439ca71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103931, "uuid": "79285dfc-0be6-4d35-b0fd-be0274989db1", "comment": "Malware payload (RedLineStealer)", "value": "456695d1339d707a7a70defda03128f0bbbcf86b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103931, "uuid": "56dd5916-10df-4875-9941-ccfc35439399", "comment": "Malware payload (RedLineStealer)", "value": "46f6c5835f80d69fc4c43902863885e5bfb99f0920bd1a5ec473759613019aca1c4a648d5d27dcfaeddaaf12b1e2b344", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103931, "uuid": "45f89105-0985-4c5c-b201-70df83f01763", "value": "T12DF41255DAD90437EEF41B70A8FB07830234BCE1157883AB3295AD5A5C33E94A97233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103931, "uuid": "006667a2-f2a2-46e0-8cf4-1d452664643f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103931, "uuid": "7557f318-11cc-42d0-b0f0-27a41d4db4ab", "value": "12288:bMrYy906BmV8tP63yZbgK1DKWxtA9b0Kh4K7ne7VeNKRbOX1p79P7H/JdRAyR5dk:PyvEV6kQgK1GWxNMe7VuKROXRuyR5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103931, "uuid": "972b1ef5-46a7-43dc-8880-0147d0c6c007", "value": 748032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103931, "uuid": "1914b2a2-9d1e-4f71-b523-1f573c21eee5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103931, "uuid": "09fda69c-7721-4717-882e-f8699467627d", "value": "d9cc85558d134e556b76368bf54aef06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d41430-3bc4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692142706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142706, "uuid": "2174bdc1-2305-46f5-b3d0-90747b5b7b3b", "comment": "Malware payload (Mirai)", "value": "f95d8696eeb2998bccb89bf1a504ae44", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142706, "uuid": "3698d6f8-7506-4440-892f-8d4d48212718", "comment": "Malware payload (Mirai)", "value": "57db9197e189f7617b84f4192016434dc2185ce34b7560b9e3228dd7fa859833", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142706, "uuid": "c5b59726-f6de-46b1-ba53-564612c1e9d5", "comment": "Malware payload (Mirai)", "value": "7ddc98c1def92483afccd9bd71d410eb0390eebf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142706, "uuid": "84bca02b-ce06-4539-be39-e9caf8529315", "comment": "Malware payload (Mirai)", "value": "850156745fc2d75c618dea12910b077abfa66829ebbbca59db8087e00f43d74848b380d348b4afb98c769d3c1acebfc3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692142706, "uuid": "67b272fe-4281-4042-b474-31318d5161f5", "value": "T141E31845FC418B23C6D612BBFB5E428D3B2617A8D3EA72039D256F20378B95B0E37546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692142706, "uuid": "8366badc-3bd6-4a58-bde7-22eccec301d7", "value": "3072:tLI/JbMfEH3hF3C4c6PYBlkSRF5sd5lh9:tLSMcxdC4cIYBlHmd5b9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692142706, "uuid": "ec044cc5-c1aa-4979-963a-cce803c003ae", "value": 150240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692142706, "uuid": "8598975b-36ab-425f-bd68-e153ce86b3cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692142706, "uuid": "de24332c-e356-49c8-bbb9-642af067454f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51db81ac-3b57-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692095671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095671, "uuid": "29789ea1-ec58-4f43-95fd-3ca7e7138023", "comment": "Malware payload", "value": "d19fbc1ad18313be46c3310cb86cae28", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095671, "uuid": "ce4fc8fb-3719-404d-839e-7a24798153c4", "comment": "Malware payload", "value": "57ff862126ef6c164909978bdd548bb5b1900ad3294fb7a25abc28b807b48614", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095671, "uuid": "79e41236-933b-49fc-828a-5b5f7c21d9fb", "comment": "Malware payload", "value": "82f67a1977e27cedd5ea020cb2d5986fe6140f07", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095671, "uuid": "6d57ee52-3ab3-4dcf-8564-a43df12a4648", "comment": "Malware payload", "value": "9d606b933f5b9395cd9f2268b0281dcc98aed2d0320ff525985514dacdbeba08ac6e679119bea8041c6a920b6554a415", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095671, "uuid": "01374d16-ab02-496a-88c1-dd4a38ef3e45", "value": "T16D937B51B2D1C476D9BE19361820D9754B3EBA20DED0DEAB37A9067E0F302C1DE3096B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095671, "uuid": "00afc962-58fe-4be8-9d00-ad0afb837a55", "value": "9de2c5f4e7412eda6daeaef638405b83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095671, "uuid": "e7afb749-24a9-4ca8-9441-c52dff550e4e", "value": "1536:RN/SnqpFxn09e2LFUQKsKLjxkflHlX8/S0ElsWeWcd+WoL/50iMCbW:X6GFxnA1LFFOLjKE/Lv+WoL/ailbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692095671, "uuid": "5ca4e0e9-ff3a-47e7-9eb2-affbe0168a08", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692095671, "uuid": "8f5c7ab5-e1a4-46fe-ad27-d1fdab45ab24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095671, "uuid": "fa4940c1-fcdc-4325-b83e-163d6484eb38", "value": "SecuriteInfo.com.Win32.PWSX-gen.6628.2822", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2246e0-3b7b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692111021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111021, "uuid": "205a3034-2f02-4327-8552-a3e352cb013c", "comment": "Malware payload", "value": "ca1302a1f4a4618f831366a6df044621", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111021, "uuid": "8e364207-af8d-4856-bbd3-fdf40df403fc", "comment": "Malware payload", "value": "58f831461c8f6baf0ae80f647962ca2878264aa656642569f4653e068662265e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111021, "uuid": "cf8f9641-3a2f-45ad-a2f2-066cd8c256af", "comment": "Malware payload", "value": "129e07589d0feb1f7f226b50f47c538634ec4791", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111021, "uuid": "d3f3817c-8fdc-4aad-885d-c184bf23588f", "comment": "Malware payload", "value": "06fe4b935d41d8f6fad9c0b8f332e1625eb34ae371a517a650d2b43b3d61cbad711c4d4e3a2528a7f0d5d5d2082a34bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111021, "uuid": "ab7f43d4-08b4-4261-8bc9-ac336c53de32", "value": "T17704D7583647A97EC96F887E9C601CD4767C6CA31206AB079D8EF0E47A3B7819F050F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111021, "uuid": "db45a9b7-d43f-4c52-93ec-fea7e0ee24ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111021, "uuid": "327eb775-0265-450f-81af-f67bad220bff", "value": "3072:nPQlw+aEWI0a4qfn8OYnGHMMwLE0GJ+4zItlsj3Jr8e8ht:n4lJWI0a4inYMwLE0HmItlsj39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692111021, "uuid": "2900758a-7554-4c2c-b581-7b36de2fcc8c", "value": 178176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692111021, "uuid": "3c70cbc6-dfa7-4fcb-8ff9-39f73acf5121", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111021, "uuid": "f470bc82-df6e-4241-8670-e5823574e9b0", "value": "decode_d6a722f5dbabcef62e0109dc231fb34b4383938d30c1bc5a8e9cc4fb5ad20d93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fdc3c4e-3b66-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692102057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102057, "uuid": "6a6a9ee5-644f-47fa-b6bc-47d4584bf7c9", "comment": "Malware payload (Formbook)", "value": "273b2d86d6423625471c63d3d1f88176", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102057, "uuid": "459813fd-0690-487a-abae-055f49a1215f", "comment": "Malware payload (Formbook)", "value": "5b511b33d6c8340f6a3a232eadb4186989e41375e412ceace91e8632b159d5d8", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102057, "uuid": "9101d577-b698-4c8f-bf3f-17388fca750d", "comment": "Malware payload (Formbook)", "value": "5566f8dd72161311ee7187cb9c8ef9946547bb24", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102057, "uuid": "2a3086fe-9003-4c5d-9ccf-8231579ef352", "comment": "Malware payload (Formbook)", "value": "063d3d49c2bbdbb628b2545af5d5f3d7a116080f91e2034a0f811a8bb97d45d4046d3b03286e6130de663995a4b56907", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102057, "uuid": "7e2ce4df-4162-4f2d-94df-f96f08554091", "value": "T13555F103E900DBC3D41D83F87E530EE90F0A6F19E99569DB14663F9B3B70A72099A52D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102057, "uuid": "16270128-a60f-45c2-9027-a6ab88fcab91", "value": "24576:qaZy0w6VgjKaWlEzp7aNZyaw6VLjKaWlEzp7auzdbiMb7QA5Qp5E/kwnx:qE86VgjKjOzIy6VLjKjOzXdd7/5X/kE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692102057, "uuid": "8addc5b9-580a-46f9-a330-15fda75cda71", "value": 1329664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692102057, "uuid": "58d0211a-b424-4c43-a4e7-414e2a3d31bc", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102057, "uuid": "dc14643b-a118-4ee3-a0fc-1712f50a2876", "value": "BALANCE CONFIRMATION.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cecd4f93-3bc4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692142696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142696, "uuid": "ce50522e-972c-4965-a5df-a7db69af19e0", "comment": "Malware payload (Mirai)", "value": "a8bd1b23f520727887ecb159d075bd47", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142696, "uuid": "d1613deb-079d-4e72-a2af-d96ebcf7c39e", "comment": "Malware payload (Mirai)", "value": "5d9a70b674141ca750b546a619b6e3d34e66af0f5598130688705667a480c2bd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142696, "uuid": "8468e6c7-8b2a-4432-bc3b-df43f2d05a1f", "comment": "Malware payload (Mirai)", "value": "fbfe635b371eb08ecccf902f84f01b7f618d6ed1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142696, "uuid": "0ef0335d-a71d-4c87-b166-414de97c0111", "comment": "Malware payload (Mirai)", "value": "d09226fba0d86a2ec54dd0e72e367034eec507553172ce10680654dbdd02846963e9578abefee168f03f7e4b83d12dc8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692142696, "uuid": "623b0669-aa38-44ba-bef5-51352a60b28a", "value": "T1BCE34A0BB5C184FDC8DAC1B44B9EA53BDD71F5981238B16B2BD4AE222E4DE305F5DA10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692142696, "uuid": "a63194fa-09cb-412a-ab29-d6706b02b49b", "value": "3072:6VXSryDeKLt90i7D6wYNhva14/U/S9PkMh5ARHD+ldbuiM5n4:6VXSryqQ9mY4zPTNdLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692142696, "uuid": "cca7e2f7-b75f-4201-98a7-f3d67ae0f07b", "value": 155944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692142696, "uuid": "4f837200-821d-4a09-821f-9167fbb78551", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692142696, "uuid": "3950c94e-fe6b-44b8-b229-04c2eb633ef4", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a8b1a2-3b69-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692103269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103269, "uuid": "f112116e-a545-47d0-8cf5-e8a4d333aa9d", "comment": "Malware payload", "value": "a5317ee4fef52c694a22481bb41d1ae6", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103269, "uuid": "a5674251-79fd-4e66-9d12-d213cc03e192", "comment": "Malware payload", "value": "5de125a586b47d88802f23afe26ec83b71fdd54689f17fd27573a737b0b81dae", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103269, "uuid": "9af27855-78ce-46a1-baa5-4dffbd746f94", "comment": "Malware payload", "value": "19e6424882336c6d1e224633e2859e47687c5067", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103269, "uuid": "ea3b8dbd-e909-47e7-82a2-8ba1ae5b75bd", "comment": "Malware payload", "value": "19fe0b00ef5e7d1f1d3da1fe63b713a53b9ea0d4762989d1d2afd0f06699fb4ce9916deec14ed383f1ba174b758c2ae9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103269, "uuid": "6fe36cda-abd3-4080-9664-a6da19d7742e", "value": "T1F4F42371DFBA84FCC39F025975E1E21299E317BA90477202273A7ED81F5C0A8C65EA17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103269, "uuid": "7d702873-9246-4776-96f1-5c173703f0c1", "value": "12288:gz+txUw8Iw/DYiQssRHbKacVDHtMxb172RwSJ+0GqsX/Gsc/6FzVPa2gn3EPxYeV:gA6RIKGRHuxjt6b1mwK+0q/GsyqzVP91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103269, "uuid": "5407f073-1f31-42ed-95b4-4b6b93c29c79", "value": 760526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103269, "uuid": "b56f3bbc-704a-4c83-a3a9-09c1328c0fc7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103269, "uuid": "de09a683-1c64-455e-aa3e-81cf78f44816", "value": "QUOTATION.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db2cf6a9-3b81-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692113940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692113940, "uuid": "1a2c77f8-5792-415d-9945-fca6c2be6edb", "comment": "Malware payload (Formbook)", "value": "7f162aac8d8d2af6c52e87a85a1547e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692113940, "uuid": "75e15a8c-4773-44dd-a5ec-235f90e487ff", "comment": "Malware payload (Formbook)", "value": "5e0519cad57279ab39f475c7ec22d2435a4a69f2378cf2254745e089f5c174fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692113940, "uuid": "d58a6836-070c-4c93-b18e-82edcc4441a6", "comment": "Malware payload (Formbook)", "value": "71ebb043ef3c5bd1dfd8e4ad2b16a49899070ed4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692113940, "uuid": "29c8e9c7-c129-46c2-a56d-1b02724129ae", "comment": "Malware payload (Formbook)", "value": "c49bd922d76e05e59fe00651518dcb3d99977cdb6db584f47e867d19511d4b4565d8e876ae014afce77cefe92d151a5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692113940, "uuid": "2a183915-bd1c-416a-bc48-974ac11b7d6f", "value": "T16915ED2835AA510AF2729E755FFC75B1905EF6F226724C2F19F7030A22529F0CB9C53A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692113940, "uuid": "5b34bc2f-6cdf-4e81-98a5-b260661d23c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692113940, "uuid": "100df973-cc80-4814-8166-427d0f69890b", "value": "12288:yWwNK+LSjMM6I7EjObh43pwlPdO/6jd923a79GNBkrRL74K73c5VDwH:PRjB7a/s23CkAgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692113940, "uuid": "6a8b4d5d-c31a-44f9-95a9-f8961d2382d4", "value": 943104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692113940, "uuid": "0bc4cfca-35ab-4239-8fbf-ff34940f6558", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692113940, "uuid": "c7d5d2db-eb64-4519-babf-2cf1aef6abc5", "value": "7f162aac8d8d2af6c52e87a85a1547e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1caca9c6-3b69-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692103313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103313, "uuid": "3e5c1f46-082e-414e-8144-0e4146d2f73d", "comment": "Malware payload (AgentTesla)", "value": "63b0cbe204c5ae988871d0dc068dcf6d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103313, "uuid": "df31a75d-6317-470d-908e-3905531993e1", "comment": "Malware payload (AgentTesla)", "value": "5ed80b72be6e57973078775a37dbc7a827c3bb7df24c798f3b389edf7fdabd16", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103313, "uuid": "7e5ba4da-115e-4289-8e6c-a5abcf58bea7", "comment": "Malware payload (AgentTesla)", "value": "12e4398deb65326edda837ad3f014995c04ebb60", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103313, "uuid": "30af2f78-d66b-45eb-bea9-ee8aa6dab352", "comment": "Malware payload (AgentTesla)", "value": "51cf09fcccbd7a13f7bbb7f1ca520c9115f66a7628f00345f9feb28274a0cc44cbcf4142935f3bea8f907042c1360f4a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103313, "uuid": "41ca1f56-f21b-4393-8708-fc9164dacf94", "value": "T11FD423DAE9260174EC97B23F1C4493C2A204E4D27A568E7B22D09843CDC7A9F977C71B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103313, "uuid": "6f2dfe6c-e790-46ba-b12d-413f1d344c25", "value": "12288:O3C0zLbd3bYFUMmytVv31PHdRePcsBj6VAFpxM80TwPBeRwHkB8HT:qC0zd3bYKMmytVUce+A/z0MPBFDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103313, "uuid": "5e8b8358-af25-4570-ac33-e216df96ae78", "value": 600878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103313, "uuid": "354ca955-f403-4908-808b-b3b26dccdb93", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103313, "uuid": "3a79affe-6566-4a60-ad1c-931eaee6f57e", "value": "Neue Bestellung 0717R-9.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27051b81-3b69-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692103330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103330, "uuid": "7b5a51ad-9756-4ff4-9c16-b53aa73ae54a", "comment": "Malware payload (AgentTesla)", "value": "8ecc99e8383194278a0daaf9cdb57bd8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103330, "uuid": "69b79bb4-8b18-421e-abfa-a14cded42a08", "comment": "Malware payload (AgentTesla)", "value": "5f4896ab53539a862055102c4433ae9ba78220915a2358552ab7d5ec081a68d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103330, "uuid": "f5b56418-60d8-42cf-9d09-a7f052e9df3e", "comment": "Malware payload (AgentTesla)", "value": "a77a5320071228af3a737dad160f50bee4321dd7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103330, "uuid": "ee4b3325-c141-4058-a86d-60346204f72d", "comment": "Malware payload (AgentTesla)", "value": "027b0186d3b6c171d1d4d3c9af6367f5c4a67907409c88e943eed82733586302cb0ef193531f50892da285399218c37b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103330, "uuid": "298aad84-3c40-4835-ac84-ed2ac93a7d4d", "value": "T109F3390BBA4A85B2C140073AC69B525023B4DAB6B773F34F74CD2375BB027ED966524B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103330, "uuid": "b5330d4c-3643-4647-a459-d5866b7c3b86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103330, "uuid": "683e7e0c-6002-4f12-b943-12e9af820699", "value": "3072:jFXcjJR4ACVbEEZYwtyW1iqb9Cp4I0fhAP8tK:JA/EG+gW9+UAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103330, "uuid": "468ae6b0-2fa7-4b57-84ab-ef1a3f990b4c", "value": 157696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103330, "uuid": "19d7a115-1187-4caf-ae9a-e681cda727ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103330, "uuid": "a05918e3-4b7a-4735-9ff5-34d65550be25", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c2b761-3b4f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (StrelaStealer)", "timestamp": 1692092207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692092207, "uuid": "c9203607-3010-4492-bc53-79a229639906", "comment": "Malware payload (StrelaStealer)", "value": "797b680de851d910b3e506b3c5576670", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692092207, "uuid": "13234219-dfc4-4999-9b9b-ef663aec60e9", "comment": "Malware payload (StrelaStealer)", "value": "5f73ff92e73b924fb7b370c777b63b757833dfa1d5b138db51ce969418d5d7a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692092207, "uuid": "f25f7245-2207-48fc-93c0-88f0afc1ca55", "comment": "Malware payload (StrelaStealer)", "value": "f8dd2f0a7aa129c7c3d269c71370ddc5565c9b0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692092207, "uuid": "8d781a3b-3877-4cb0-9ad5-ff0b33fbe5c3", "comment": "Malware payload (StrelaStealer)", "value": "0dd97f196375aac53f170a44bfacb1388fb7643e834cab971df8243664af603b414e18529843ff153f6a7bc1397855a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692092207, "uuid": "99281129-d14a-4595-a317-11f6c5519800", "value": "T1A1F5C8FF34976548AE326C203FDDF661C7A718BEC96BEAF2469590301E66052FC42817", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692092207, "uuid": "b0a30af9-663b-4574-9609-00ad52bb70fe", "value": "fcfbe5457e76d2ac347d7db113c0ca3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692092207, "uuid": "6a6cf4b1-7e18-4d17-bfe0-ba5ebbd2e7ab", "value": "24576:q0dhNY7Yx3GfKy7th1HZYal5aYBOApJYRSt9We90Fhk6Tx2lgVaSoJsoiUArAziH:Ndx3Gf51hpPJYRSt9bxl1fS+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692092207, "uuid": "ad7f2911-000e-425c-b6c9-de3561f097e2", "value": 3639847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692092207, "uuid": "db59bdd0-352b-4206-bfbc-22d74f1e80bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692092207, "uuid": "e580460a-6736-4da4-b461-a32ed9352f9c", "value": "irritatewaggish.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e745faa5-3b64-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1692101505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101505, "uuid": "0425d863-1d31-4bc6-ad08-1991c7e2faeb", "comment": "Malware payload (NetSupport)", "value": "f4b5c9ae13a841ee97e4a538be4cb071", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101505, "uuid": "f98fe09a-3c4b-4143-938b-bb475f09044a", "comment": "Malware payload (NetSupport)", "value": "5ffb5e9942492f15460e58660dd121b31d4065a133a6f8461554ea8af5c407aa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101505, "uuid": "c6d195eb-b104-45e2-a80e-18d26d2b639f", "comment": "Malware payload (NetSupport)", "value": "456d1563079c29049a318f4c8b95ebe8ffe7b80d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101505, "uuid": "d41fb539-e50f-4618-892e-4fc0720c2dbb", "comment": "Malware payload (NetSupport)", "value": "0e54236a68c752a531b2ed5fed6e2f1fb11b879e0b25243b6a6ed66e2513b6d0a7f658c701b74e552440be0f740b9917", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101505, "uuid": "bf0559f1-d7b5-4db7-b72a-1549bdb1a03a", "value": "T1A30374F95EE345E0150371BF672F7544A0A44A930D48FE25B90DA1206FCC16CBAB89FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101505, "uuid": "d81e4b81-8a8f-4423-b373-dea9b9219fda", "value": "768:OIBVRTuT4qqOCGS+e2YH+p3Esdu/tWnwZWdrqr5JMlpE:1FCTJCCh7wWnwVHCE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692101505, "uuid": "c03272d1-2b53-4a71-bf24-203133b2729e", "value": 39130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692101505, "uuid": "60a5373d-21db-4b29-bf4a-ad46af15996c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101505, "uuid": "91ff740f-00dd-4943-af90-eb3b95aea56b", "value": "nine-life2730.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef94d27-3b4e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1692091720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692091720, "uuid": "c05f4808-5898-4f4b-8a1d-d8a29c184b62", "comment": "Malware payload (IRATA)", "value": "a9e6685644937ba4d5ff6128e35ee056", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692091720, "uuid": "d4ff35e3-507d-42ce-b471-7eae9c03816a", "comment": "Malware payload (IRATA)", "value": "6067131445517c32eceba112dac3b798367cd73fc4f048313a7e3b9672a807e9", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692091720, "uuid": "2237d6ca-32e8-42a2-beb9-f5ce07a902cb", "comment": "Malware payload (IRATA)", "value": "91fe24617835e256a3345efc516ae62373a1e0da", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692091720, "uuid": "551849f7-a43f-4f94-990f-7f0ac46f5070", "comment": "Malware payload (IRATA)", "value": "756a9979e142d8a361834430aa7806b5b5ea13c4c9cf47e375cf176574538a722a8e385187aeac570061803d47c290f2", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692091720, "uuid": "46756d58-ac06-4a39-b983-8d3c1b134b90", "value": "T11F8523C7E620C056CBF7A6F37C36179195371E28488369963926F73CA573B8F8B66204", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692091720, "uuid": "cc67f037-7938-4970-ab1b-85cb40843be9", "value": "49152:OgjbsAX5Xnz/EbdR4OcWn8x8Sv4A3XJJx9tRoiA:O/AX5XnTE7Kx4Kx9tRoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692091720, "uuid": "927e6637-5bd3-41ae-b0ee-aba86339ccf6", "value": 1831047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692091720, "uuid": "318da185-e0ff-460d-8c89-efc5f9e97029", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692091720, "uuid": "bcf513fd-468b-46f8-9557-e59980bb2a25", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8632dae-3b70-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692106554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106554, "uuid": "ae85f446-948f-49da-bf78-b66f1f88816d", "comment": "Malware payload (AgentTesla)", "value": "6b1d1a7455742408ac22e8d243998296", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106554, "uuid": "6e34ff11-afaf-4ff3-b68e-e96edf7e94c0", "comment": "Malware payload (AgentTesla)", "value": "60c6242057a2ed2a102be819922a807139becf6b1cda2fa9eeed873fc6320623", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106554, "uuid": "337589a9-0a7f-4694-901c-8e81dd6ac437", "comment": "Malware payload (AgentTesla)", "value": "99972dd7abcc92986851eb6c3e1f8880c4a2abc7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106554, "uuid": "3a638a40-d29d-498c-a270-fa17e8d2b516", "comment": "Malware payload (AgentTesla)", "value": "d6855365d6deaddc08033cc21b3f200064fe8bee744434c7568c41a1af79850883d16aeccfaa2ad7252a85aef6a6a959", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106554, "uuid": "418a9c91-e2ee-4863-a8d5-fcee2f73d68c", "value": "T11B44BB0025FE5288F1B37F4247BD64E94F67F6A55A3A926D215C034E8BA3D40CE66B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106554, "uuid": "28a251b9-da93-4d6d-a49d-6b4cb71b9acb", "value": "3072:Uzb+2cJ5UbLW+LSBCaiYLzsCODpqbmTt3fQ+KgYnHWiYunk:Uzb+2cJ5UWzsCODpqbmTt3fQ++ndnk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692106554, "uuid": "14966c52-40bf-4d4e-a3b8-78db895334a8", "value": 258606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692106554, "uuid": "5954f5dc-ebb9-432b-934d-137a7c8a1a06", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106554, "uuid": "f66fbfcc-6821-4f20-ba9d-1a82f59eb808", "value": "EGK.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d15297ab-3b4e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (BlankGrabber)", "timestamp": 1692092020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692092020, "uuid": "ce918d2a-34d3-49c0-a14f-6715f92f198d", "comment": "Malware payload (BlankGrabber)", "value": "ee5fdd864fc6acc63d1cc867405d97e3", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692092020, "uuid": "902a6d63-60e1-4f9a-bab8-9332a8adaf02", "comment": "Malware payload (BlankGrabber)", "value": "61a126fc6afd30aef79cd27f704904114969008effee0ac1b88d2b5f9a5d0c0e", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692092020, "uuid": "61f86d69-28cb-43d9-b58d-aa03ca1f91c9", "comment": "Malware payload (BlankGrabber)", "value": "e19a4c3a4ada7ee191a513a56c05c16abcf67b33", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692092020, "uuid": "106caec8-7b86-4cbe-8070-48299114838d", "comment": "Malware payload (BlankGrabber)", "value": "d18bdf01d40061c353851c59a707cabc83118c4d03f240857b83248232c2b47a6de37b7385bc6431e8050e062258b99a", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692092020, "uuid": "4588ddb6-bc8e-41d1-8c50-13839431c1b6", "value": "T15B76335922C209F4D173893AC5928E49EDF5741B5374C99B037896F62F23ED04EBBB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692092020, "uuid": "20fc38a6-a946-4be9-9f3b-99f2ac6150b5", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692092020, "uuid": "6da0ed1a-3ff3-4b4c-9e85-d045b9ca00d5", "value": "196608:98QsGbT/9bvLz3S1bA329OqAiUU76FV+fEb30b:AGbTlj3S1bO29OqTUUS+sW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692092020, "uuid": "767dd349-7458-4063-b52d-b4f93430a0ee", "value": 7381121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692092020, "uuid": "912485e0-cc88-450f-868b-d7897668f839", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692092020, "uuid": "b94c3e40-1a46-4774-b691-1a21ec29155e", "value": "rekeywiz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0314855e-3b7b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1692111001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111001, "uuid": "140e1ea2-d894-4818-9622-92f67303ac87", "comment": "Malware payload (RemcosRAT)", "value": "450b6105389abfcbc35ca57cb1887c3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111001, "uuid": "42d6385f-3b11-4f44-985e-6309e559ee36", "comment": "Malware payload (RemcosRAT)", "value": "61ebcf7f2ea90a057a46e3fd4d9212063639b01b6e5e4c90ae3447b76f52e323", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111001, "uuid": "ea95bbec-1e41-4861-9b20-820f2a12943e", "comment": "Malware payload (RemcosRAT)", "value": "1b79b9053d974ea40b1f1c8a80c6701684e4b2fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111001, "uuid": "55d1f7c5-a507-4455-8384-616a61f1b6aa", "comment": "Malware payload (RemcosRAT)", "value": "e97626647486e36a4044891b507f4074d4b77bd22031da6ff4bc33ddccbfd4aa30a9d1a4e2453d0d840a178da98b311c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111001, "uuid": "0c974bc6-414a-452d-b82b-d63a2eb02114", "value": "T1BCA4AF01B9C1C072D57261300D2AF775DABDBD212926497BB3DA1D9BFE30190B63A6B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111001, "uuid": "11134fdf-ddc9-4455-b60a-e141ff06e5db", "value": "3f3d4ba55ce3e8f736704310c56bf5aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111001, "uuid": "8bb9659e-97bb-43f1-aa82-eadee62d68fb", "value": "6144:h1EwL0xQk9VdeLuVnQs8QLgt8cBvnkCX/3Rde+A+DdsAOZZRXXrcNTl2OhX:h1EZT90uNQzYgScBvnn/XpTs/ZRpOhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692111001, "uuid": "4ce5b63a-7ca9-42dd-ae8d-bf1ca33a5905", "value": 489984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692111001, "uuid": "f41f7dd0-67f3-433c-abb2-9a24e8869383", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111001, "uuid": "e8dffb19-8d61-4f86-80c6-9a1f42a9c34c", "value": "decode_a336be87c58296636db179872386b23a3e4f65de560873cce4ceb228f6d63b82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c3c3e86-3b31-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692079395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692079395, "uuid": "1c7c6382-c921-4fde-a373-62e0243addce", "comment": "Malware payload (AgentTesla)", "value": "35b611cdea14a62de14b1f8471162853", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692079395, "uuid": "0e44cf16-a013-4a3c-9273-469c6bb27387", "comment": "Malware payload (AgentTesla)", "value": "6544731644361dc0564b8286eafbfcc5e57c1a1fd5fbbbcb3f8316f81c6b3723", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692079395, "uuid": "3caa7c25-6804-43f2-be11-7c44a3bba761", "comment": "Malware payload (AgentTesla)", "value": "f138441d6987c1f57d448965bc64f9bc417d3844", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692079395, "uuid": "2f133ce2-759d-4516-8551-26b6c3bcff00", "comment": "Malware payload (AgentTesla)", "value": "3eafc497d012772ab969119d09612473ce8b4d49ceefdc92e288bf444e11ec4ea4c3d8ab82d21837aea91ccba2325351", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692079395, "uuid": "122ff748-186d-4351-861b-380ad9ee392f", "value": "T1C355CF067694CF61E11F1676E4A682F40323AE41EE12E3CB71CDBF193AB33E96951247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692079395, "uuid": "5a43d87e-79c0-4594-a80f-82003e0411c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692079395, "uuid": "fcd1f6bc-293a-4820-bc93-65d4649d44d4", "value": "24576:hGtcJ+P7/Nx4aZcoootnwKDJiBPrMpG0mFmcyNCFZnI9QU3:6D1qaZcH6wGiBPD02mLYbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692079395, "uuid": "dbd15358-c7ea-4697-a04c-988953c2ffb7", "value": 1339664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692079395, "uuid": "7cf1d530-1267-4396-89ff-3966cbe4e5a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692079395, "uuid": "f8576f6c-6a5c-4434-b553-27ae3a0489d8", "value": "QUOTATION_AUG7FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d28beb-3b34-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1692080538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692080538, "uuid": "dec3c8aa-50d3-4523-88eb-ef5c224f7021", "comment": "Malware payload (DarkCloud)", "value": "f01284181b88dfd9ff47c8308c792a6e", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692080538, "uuid": "c608394f-ad37-4fc1-bff8-bbbec734fd66", "comment": "Malware payload (DarkCloud)", "value": "665a45078b6796f4d7e116880d6b56daa965b7a7498da0c8169598177997a9db", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692080538, "uuid": "5ee56519-e4e4-443f-906c-f7d2d15eaa51", "comment": "Malware payload (DarkCloud)", "value": "2e05fbbbcf55c18c0a3d63859b7e59d869578e75", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692080538, "uuid": "2b8b7c44-65b5-4462-80b1-20049a4b7264", "comment": "Malware payload (DarkCloud)", "value": "aac4620188565b70540609bfc3f4ec085ac0928397a1010cfa9c00d92fcdbd7dbbc3c61ef6850f6daabcda6502841875", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692080538, "uuid": "e2a8007b-73f2-4c50-acec-9a7493a2701a", "value": "T1C3E34A07BB8A85B7C2815739C6BB72100770DBD6B37BC34B744D235A0B127E9AA7524B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692080538, "uuid": "2f588c29-db2a-4e29-b37f-c3b9891c4da5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692080538, "uuid": "05871d18-529f-41a5-8433-fc2292441df7", "value": "3072:CjfBmeFUg+8/CKyTef58FrmnpnQnlgzuboUh7RiwomfhAP8td:CjfJ1p/CKyTgYmnpQnuzuboUh7AwoKAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692080538, "uuid": "41737141-bca4-4168-8a1b-8a8b4ac9f8d0", "value": 155136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692080538, "uuid": "d4b6c7cd-da64-4abf-b75a-386258b21fda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692080538, "uuid": "fcb5759e-f659-43e3-b71a-f3dedd0a27d7", "value": "JULY SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f0afec1-3b37-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692081923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692081923, "uuid": "8b9fc7d5-cf0b-489b-a4ef-7d9dbc664702", "comment": "Malware payload (Loki)", "value": "f0cb496455bccd4d06798a9df0c02a00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692081923, "uuid": "076b232b-1561-426a-9f4e-456af964ca4b", "comment": "Malware payload (Loki)", "value": "67434f853750f35f663aea7c2a731961d02557766d0fb6492b86c5e4a155f560", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692081923, "uuid": "c6fa3f4d-8af0-4d9f-9630-11a7cc811f76", "comment": "Malware payload (Loki)", "value": "d670e1ba402a255b11a5844609990001f9a5c592", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692081923, "uuid": "48ecbf85-c354-445f-ab9a-6a4a58a03c8e", "comment": "Malware payload (Loki)", "value": "7074cf959623bf2738538b12584ef9702dcf8771f37b6fe2301011a60d14eb0a9c8b5e5719765cbe991ad239f6737b2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692081923, "uuid": "9bec92b0-80f8-4cc4-9cef-fd12ac189608", "value": "T10AD4AEC5EA8465A0ED59AB306A37CD3596237EFCA834941D29DE3E273FFB2931025053", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692081923, "uuid": "41fe12e2-cf08-4b57-b4a6-4e1eb622203e", "value": "d4b94e8ee3f620a89d114b9da4b31873", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692081923, "uuid": "2589f967-8b8b-442a-8ffb-7e4aac35b2e1", "value": "12288:OBfIP7r9r/+ppppppppppppppppppppppppppppp0YudNUskOrzzMGEIg9ZanxuG:T1MudTkONy9Zanxs4AANR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692081923, "uuid": "9e35848d-806a-4603-b303-d2c864c2e959", "value": 626592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692081923, "uuid": "59cb41b4-dbc6-471d-b1f3-e9e7941de898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692081923, "uuid": "690a45e6-5bc6-473f-86b7-07c7b0ecb53b", "value": "Outstanding Invoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "586d603c-3b6a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692103843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103843, "uuid": "d74963a9-c39e-41e4-af78-59677fcf7f41", "comment": "Malware payload (RedLineStealer)", "value": "2d54131eba773e4ee983ae89f731b97b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103843, "uuid": "eb58810f-c6cf-47cd-a2c8-3924aae51707", "comment": "Malware payload (RedLineStealer)", "value": "677c0682354d2f1ff8a45d6cff5e4c6d6ac423c882ae78c9dbb53f0e3e2b8b99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103843, "uuid": "a9a77e65-fbdf-4cb1-a3ad-5706c3783147", "comment": "Malware payload (RedLineStealer)", "value": "f5247275522b21ef5eebec0f20584f48edd1ba1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103843, "uuid": "dde502d6-9b19-42b5-9c16-07265c662ab3", "comment": "Malware payload (RedLineStealer)", "value": "a50265a1f2e8a37b6c91ed9226438c60dbf46933fee4000e2e43383808a44c8ff00b4c38c6f96983ac28cf400a9546ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103843, "uuid": "8bb5b3d6-99f9-4e75-adcd-26a33b25a1ae", "value": "T1081523536BE88072CD792BB065F716C30A3A7CE13874436B67469D8A0C73BC16A3576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103843, "uuid": "4ce83af6-6790-4b93-aec6-46ff0a3a3f43", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103843, "uuid": "5e72accb-96d3-41bb-a483-075d4673adab", "value": "12288:tMrmy90u6S33hFOfFXBIxVyNhkIzyHN0clUTPwbS0hMuKRr0t4t3nJqLKM7Z4fdk:PyNFO97aLlUTPSect03JquyZ4fdzdY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103843, "uuid": "525da806-526b-4ba2-a0f5-943fce853059", "value": 875008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103843, "uuid": "c9e5cbb2-e572-425c-9292-595c28327708", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103843, "uuid": "d61370f6-3b58-4782-8904-8d9665629ecd", "value": "2d54131eba773e4ee983ae89f731b97b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee427486-3bc1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692141460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692141460, "uuid": "3cd9948a-ef22-411a-b562-a5f1ce33fb77", "comment": "Malware payload", "value": "ad8a6df4344e078c7ca6ad1dc85d14f0", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692141460, "uuid": "1e7427a0-968d-4ddf-b1f6-aac0b0174408", "comment": "Malware payload", "value": "67f7755b38baf0d02e2c7cbb5c552248226a156a900fe3e894b68cfa4de189b6", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692141460, "uuid": "8ef8ab20-5127-4c61-8991-d8b945ca29c7", "comment": "Malware payload", "value": "0b367f9eb0c282c9f7871c493093bb529c408877", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692141460, "uuid": "a2a9797e-5759-4079-b947-9078c46e718c", "comment": "Malware payload", "value": "6c514799def0ff459a45e5edf80c3afed71dcf9e39c5417b880fbe5244b756d65e27e12ca00252a4efe9118cb1aef8ed", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692141460, "uuid": "d7e207bc-3fe2-4003-bee4-51bc53a6e131", "value": "T170F24B03C402AEC3E06597F57E1706C50B0A7F45A5C27AEF322D7E973B246A65E4E16C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692141460, "uuid": "3a66e72c-95fd-4785-92dd-c13e074fbfcc", "value": "768:ZEIg8pQwFoJhaaaaaaa9q4QvOWuKrjRz0if9ZBQ:F9FoTaaaaaaa9qrD6e9ZBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692141460, "uuid": "323e71b9-8b08-4a19-b698-ceace2af0070", "value": 35464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692141460, "uuid": "0ea34a61-a1f4-4d53-b853-45e1e86ef380", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692141460, "uuid": "dfcac443-65a0-4984-a245-3c10722d4fd7", "value": "Payment.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9759c9cf-3b6a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692103948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103948, "uuid": "c2c85dab-0c3e-4d84-8aa9-93a94b28f1b1", "comment": "Malware payload (Formbook)", "value": "bb712012e3d293f7b3fb208b7601be7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103948, "uuid": "59061a95-bfd2-49b1-9e88-904f0563c41c", "comment": "Malware payload (Formbook)", "value": "681b4fb5d374583fa961ba8ad171585c0ba9d2e346c5fbb6fce92392a10a2d16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103948, "uuid": "be4a63e2-a267-4789-b7bd-b417ca2ca47c", "comment": "Malware payload (Formbook)", "value": "c6a1f7ec74df5f2b938afbd628ebf026000fac8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103948, "uuid": "a1c957be-84bd-4c9d-bb23-c94523822450", "comment": "Malware payload (Formbook)", "value": "f04ebe63510c38349d592b5bb901472addb1bcb4de485cc433ad59de594538928068789ac69cb2638cc190a573d7af2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103948, "uuid": "cdc5343e-6ac1-46c9-98d3-dbe9abdcf7bc", "value": "T16AD479C2E9B6D6E3C96587F5609224185F393FE93069C2941CB231D6B6F0B043793A7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103948, "uuid": "763fa586-5d2e-44d3-bbd3-7b41bfd119c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103948, "uuid": "0ae929c9-dee4-4d27-af61-82a3cebc206c", "value": "12288:vcaa4lrrE7cAakbrkpvv0hqjyPuiGYprf:vcz4lXEg3dvMojQSYpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103948, "uuid": "1efd6fd8-38bb-4573-ae66-3c7c43fcf7b8", "value": 652288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103948, "uuid": "e0f877ce-2abd-4c30-aeab-aca39bdc54d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103948, "uuid": "85b9c79f-57e7-4a17-9538-8b09e95b2356", "value": "bb712012e3d293f7b3fb208b7601be7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a335bed-3b8f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692119710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119710, "uuid": "b5fda12c-45b4-4c77-8220-de01f550fe2a", "comment": "Malware payload (Mirai)", "value": "f533801820184c39deff60f2ef84bf0f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119710, "uuid": "97322418-b33a-40c0-87c4-6f5c35faafa4", "comment": "Malware payload (Mirai)", "value": "681c0c8d41eb9315705c75ce0b0dbe625c57e8b819ffe15ee73204e9db339fed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119710, "uuid": "c47c981e-dc0b-4e0c-8cf2-7a566f32bc47", "comment": "Malware payload (Mirai)", "value": "622fd86b82f521f34a3ff630868a762b0123ad5e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119710, "uuid": "b23e0ac9-7c20-49fd-9da6-c4cfb54d7554", "comment": "Malware payload (Mirai)", "value": "5ccf109bb159564f2237d7eb8ef7c241af5d249717557f5396cf9e96f16e6a2a5bce3a1cb1bc13fadf6372bc239f90d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692119710, "uuid": "98051d75-b93e-4d78-a130-51c495014560", "value": "T19EF32A45EA408B13C0D627B9FADF42153323AB54D7AB73069528AFB43F8679E4F22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692119710, "uuid": "792695bb-edc0-45c1-8a92-966748ba2f2c", "value": "3072:N/MpW700CsCDcarbGSS5sn41mxft2w5UoLM/RrpZ:N/M800XecarbGSS5Ijft2SZLM/RrpZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692119710, "uuid": "a0bdc6df-d388-455c-b748-bda8f1916bf5", "value": 171596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692119710, "uuid": "5aca7430-c982-4ac1-ae18-b80acac04aaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692119710, "uuid": "2a70392c-19e9-4375-9384-489774d14335", "value": "f533801820184c39deff60f2ef84bf0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3430340-3b57-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1692095915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095915, "uuid": "a9ac1c58-ccf2-451f-95c1-ca11660b142c", "comment": "Malware payload (ModiLoader)", "value": "fa69f6ff6fe4e85f9f1c009ab3b1bd60", "object_relation": "md5", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095915, "uuid": "3086ea23-e6ae-4639-946f-653b3f66768b", "comment": "Malware payload (ModiLoader)", "value": "691801775de8a4aac3dc93a023cb2535c92d7441915e9b93f6eb8465e8ff4503", "object_relation": "sha256", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095915, "uuid": "6f97cf72-d536-456a-ba02-6efbd7d9658b", "comment": "Malware payload (ModiLoader)", "value": "6a475bdedfd33b02c335440c8974f548b88a6744", "object_relation": "sha1", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095915, "uuid": "15be3a09-3403-46fa-a73d-83a99d495801", "comment": "Malware payload (ModiLoader)", "value": "351ab3a3b0cba4a3342c5f023ab59f963290be4a3caa5ec577b93fcf30a0110f2f375f68c299f303f5810414fd9840c4", "object_relation": "sha3-384", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095915, "uuid": "ae57ce92-605a-4350-9538-70ae4a40eeaa", "value": "T1FD7423A3EBF1F852BC4A55954C2B23B83C5A0B701B49B70DAB1DD2A5E8B90F5143FE44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095915, "uuid": "bcd76e67-b785-4da3-b81f-469b23b1f1d3", "value": "6144:qDgYRffd447kioWK61Bhop1xz8mBECnR6Bxx2SUPRnkbBOrurpBtBlt1SOe2:qceNbBOPxaD2bDabtmOe2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692095915, "uuid": "cd45a0a8-21d2-470f-806d-06ba6d851a6d", "value": 365428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692095915, "uuid": "b643eca9-7a36-45cc-9762-d237e70fb2e0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095915, "uuid": "aee875ea-1eb7-4410-b796-d2ab2cc7836c", "value": "Gqzfnpjnobzwyu.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329d05c9-3b3c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692084022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692084022, "uuid": "4010836a-f967-4147-bb30-11ff57b18459", "comment": "Malware payload (RedLineStealer)", "value": "448a41b26d8ed4728673e733bce477e3", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692084022, "uuid": "f2353dd3-c755-428a-9fc1-a834472b79ca", "comment": "Malware payload (RedLineStealer)", "value": "69c402da411f978713ec188c3b3aa3fb6b9ad1a73875680b2c93bbce25d14323", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692084022, "uuid": "a36c9a23-8963-41d4-ad26-a72d81f67065", "comment": "Malware payload (RedLineStealer)", "value": "efe4b0cc7085919506f9c46e792f4e47f99c4743", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692084022, "uuid": "d4891f90-d46f-476b-9b9d-4dd1291e3a50", "comment": "Malware payload (RedLineStealer)", "value": "15cf81ba8c1b4d2022aec6bc985b5752f6d5f5f5c5e632e16939a5dd628168d44b82e90b6bf0c9423ab73a7a2167b1da", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692084022, "uuid": "db777614-5d7f-43bf-8e47-a908b6f28aed", "value": "T19AE24DA6B2D6DC06D94807754CE7C6D67623FC616FA3834B3289F71E1F72A80890365B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692084022, "uuid": "c48f9242-e1d3-41b5-a56a-8a5dc6d92961", "value": "768:vP1k3hbdlylKsgqopeJBWhZFGkE+cL2NdAJRqQonpxaSJAmci:H1k3hbdlylKsgqopeJBWhZFGkE+cL2N9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692084022, "uuid": "37570b44-f701-48aa-ba8e-744de4d56b31", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692084022, "uuid": "785b5040-a02c-4b7a-a35a-785e7941cd22", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692084022, "uuid": "56d0899b-c6f8-41e5-93e6-dc6c68df891a", "value": "RFQ-#2435.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9667068-3b57-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692095925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095925, "uuid": "fe5196cc-cb88-44ac-b83b-2830e0ebfe8d", "comment": "Malware payload (AgentTesla)", "value": "0eafffc6872890f95d6cd451a6170dda", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095925, "uuid": "8eddbeb8-39f7-4875-bfc2-ec2f43ed4ba9", "comment": "Malware payload (AgentTesla)", "value": "6a43a145806aa6aeef3f5c73d915281a6ea092e254ffa4fa8c2d14b0133eb603", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095925, "uuid": "37b87d44-4568-4bbe-8ac8-0c13d0065f7f", "comment": "Malware payload (AgentTesla)", "value": "cf9cd0611e28434d520f74020f1e0b212f561c5f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095925, "uuid": "f8cad800-4600-47df-bec2-a55f25ab8022", "comment": "Malware payload (AgentTesla)", "value": "18436ed80935433c30e5cabb83ffdd0305ed3b74d5dff7e181ca20eb4f7ce97ed260a9a88700036efafe1698234b611d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095925, "uuid": "419a1a57-4a99-4026-ad59-c6e11d2ec360", "value": "T1DCE48AC2E876E7E3C8B587F8609611049F397FD63468D2941CA630D67AF0B043697A7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095925, "uuid": "6a7c5c24-58bf-40c7-a0e1-e8e05edf948f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095925, "uuid": "d698a5ee-8a8d-4785-96e0-6f46f8e1f3e2", "value": "12288:86faa4lrrQ5Y3oldMXfQW6Q8QTxpngQeXb5i8HAtdtzLhioG:Zfz4lXiYuXJQ/TxqR9qtThzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692095925, "uuid": "bbe07fb2-247e-4ef5-a2fa-03d25a6cc43a", "value": 717824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692095925, "uuid": "e32c1dd2-eb64-4679-b9aa-56c40febd331", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095925, "uuid": "ee03f5b0-3cde-431d-942a-16a1c940e0ba", "value": "Transaction for USD137.000.jpg (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a514033-3b6a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692103926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103926, "uuid": "9cafc8d3-4283-4fa7-9452-8e69e79f6535", "comment": "Malware payload (RedLineStealer)", "value": "c1696750ec33499b4b7e6d7fae84da07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103926, "uuid": "44ff005e-903a-4b57-bf64-cce5d7ed9f97", "comment": "Malware payload (RedLineStealer)", "value": "6a7ba277617d5223e7ff3cf394d5ffaa9ff3d7dda3ff854cd894f79780871c46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103926, "uuid": "ca28b49b-cd07-49ef-947d-661ad16c5a36", "comment": "Malware payload (RedLineStealer)", "value": "0b8dc9d467ce2e7a6f59c48f620a7c33c9ab93da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103926, "uuid": "88d08926-992b-4586-8e22-10ea757dff19", "comment": "Malware payload (RedLineStealer)", "value": "ee52fd0885210f7f4d583bcf484e3b269bc2835ad05ca5d9d17d1a8dc34cb05b7507b9588a1fbc69ce2bfd510aa06920", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103926, "uuid": "592000b7-0f52-4c87-b3ed-937cef076f7d", "value": "T14DF41202BBE484B2EDB9277048F607D31B35BC255878D76B3389B86E5972588E432737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103926, "uuid": "b16a823a-e076-4ce6-8ed1-e4cbb9448274", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103926, "uuid": "9a22338e-3851-4b98-bf8c-6b174dbb3a73", "value": "12288:2Mrjy90wC3d6xz4t4Km2cHuOaVdKgSe7q8tKR1bXgp7WdwTrED+W3NFjau0Wfs:pyRkgquDPOTjzZ7qqKjbI3vW3NFjfs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103926, "uuid": "e3c308dc-693c-4e4a-854e-8a9444b8c11e", "value": 748544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103926, "uuid": "83fe8303-e4e9-4175-8e8c-da6e350eeb37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103926, "uuid": "3e5a398c-ef37-463e-b7e1-43fa9c0c4645", "value": "c1696750ec33499b4b7e6d7fae84da07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b791dc2-3b64-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692101378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101378, "uuid": "81e8933a-1813-49f1-908e-6e1155c5e034", "comment": "Malware payload (AgentTesla)", "value": "747e93d60b3c9892f1513a30776c398e", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101378, "uuid": "e2115dc3-a186-406b-ab11-8c59a500dfdd", "comment": "Malware payload (AgentTesla)", "value": "6adbd2f0f44a76563c118c455e0cf42242aeeb2446c4068b76fa971dc83a1f81", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101378, "uuid": "1338f079-252e-4ddb-ae4e-0eaef9c46f4d", "comment": "Malware payload (AgentTesla)", "value": "6ffd620d9416fa2266cb6bbcacec3aa0e56bf11a", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101378, "uuid": "5dc803ad-9833-4d7c-9c1e-520b4baa5591", "comment": "Malware payload (AgentTesla)", "value": "1193d15450ed0808fb4c5aee80c2a9526491c9515cf8a01047b0b9b9bd5df2079c6426748960f8b842008aa7e3f46726", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101378, "uuid": "e67cf3e4-ebec-419e-8a7f-c2514fa2d38a", "value": "T1E2B42375B742E52FD512E94937BECF6CCDE3C042D22E858941E394E808448FA27B5BDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101378, "uuid": "597e1963-b7cd-4424-b56c-ce76da89c56d", "value": "12288:F0u/bp+keNVUOgaBeeni5l1jWYygLJpqH44I1iYi/ZIumx:Fb6VUOgqi/QYygLf4I1iYWpmx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692101378, "uuid": "8a971dc4-47c0-4365-8f7b-8bbcb9c3f69a", "value": 519339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692101378, "uuid": "6b731e58-deef-4693-a3c1-6e486f6493bb", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101378, "uuid": "492bbe07-e2f9-46b2-8222-1c759fe43d7d", "value": "FedEx Express SZVA3421.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f65b13e0-3b7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692110980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110980, "uuid": "0b17ee36-44b5-4e98-8343-4e54d681636f", "comment": "Malware payload", "value": "f5393c2691d57742e6966960d7d1368c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110980, "uuid": "d7618c58-9fa6-4e30-b18f-7b1ffea51477", "comment": "Malware payload", "value": "6c62f525906410a4e77a16ca86751549b5b1ba51e6a4ff45836419c1835e5200", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110980, "uuid": "575f4aa8-7558-492d-af71-10f402149f32", "comment": "Malware payload", "value": "49b383549d8db45a618deab1d445b986acd23a82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110980, "uuid": "e7e32280-fb0e-4f71-89e3-c95d5aa3ebe3", "comment": "Malware payload", "value": "be24cc3dca7d1e7a4c03785df2fa1119c4d3ce8630555bb8270ba4e7f3c7dd2b5f68679a5560eff82f7b06c17ad19942", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110980, "uuid": "f3541401-557a-4db3-8188-7733320358db", "value": "T1E0A4AF02BAC1C072D57651300D2AF775DAF9BD20183A457BB3DA1D9BFD70190B63AAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110980, "uuid": "559d2eb3-7376-4d59-afd1-a2fe1675dce0", "value": "04d77d421b8e5297898a3fce39d74267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110980, "uuid": "9fcc2032-b18f-44be-aae6-41c484e45ac8", "value": "12288:tRXxReZj3WZfj/2eSseWFaIe2+f8CL47bs/ZO2fDU:tx7cyF2eSsewS8W47eZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692110980, "uuid": "e30730bc-f22b-4cbf-aafa-aa31d34a9857", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692110980, "uuid": "640a1dc0-1e33-4959-bf08-51afd91fad6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110980, "uuid": "0b28bd64-7095-4acb-8fc1-e081f625f162", "value": "decode_4744b6d936a6ff9067a09702a12aa1550f696fe17e3cd09f74f2926234a3c18c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53fa62f2-3b73-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692107701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107701, "uuid": "576ebe38-b287-4955-b5f3-4da1d42e1669", "comment": "Malware payload (AgentTesla)", "value": "6880dd3f016e3bec1ae3cd77db495cf1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107701, "uuid": "978e3128-51ba-4502-859c-ad57d9721d6e", "comment": "Malware payload (AgentTesla)", "value": "6d63f78d42132df4cabeb30eb835bb3ff1a06fbd8326948f2d940d42b683efa1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107701, "uuid": "1d1cadca-2d4a-4d24-9825-5d47c90197f8", "comment": "Malware payload (AgentTesla)", "value": "224c08c7e9c22964f3247079d2ab4bfba8c4dc6e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107701, "uuid": "625a283b-0410-474d-84eb-faa4039ae4d8", "comment": "Malware payload (AgentTesla)", "value": "f958770c51cb777b5c30ba9222347b3030cd764603c07eb9e95c7bb74dfe0b4732be97b16b4d89def6410c110478da0b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107701, "uuid": "ffc216ca-37ac-4111-a7ac-1ff91eabfe10", "value": "T198D402F673F64E51C7B9A5BAE89141081330B78FB0ABE70F248522171F227917647BDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107701, "uuid": "55cd39bf-cfba-45c8-9062-fb48b1850d96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107701, "uuid": "359b9aea-b847-4393-ab4c-af2b6bebb72a", "value": "12288:Y7XL8vGTIYlV2SHK82ET62g4pGC8uOA0zFTocOzbgJ6FUjUnQHLlT:b8IYlVZK6TzpGC8dzgHgJGUGQHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692107701, "uuid": "f7a16ec2-d803-4886-86c0-a42b93de037a", "value": 643584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692107701, "uuid": "22b2daec-7caf-4ed5-8738-c945d169b43b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107701, "uuid": "23903fb0-8caf-44df-a9f0-d36e328e71c6", "value": "z75Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a42412-3b87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1692116419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692116419, "uuid": "56ef3ee2-d718-4c0e-adca-d0a18ac36c7e", "comment": "Malware payload (njrat)", "value": "237dd93cf8dbc052febc48fb11a1dcac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692116419, "uuid": "4663fac4-b3d7-4886-887c-6e4b16152406", "comment": "Malware payload (njrat)", "value": "6f9feff46ec4fb9b411181d99c2defd95ae8871edd784f3703aa19ffadb9119e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692116419, "uuid": "d44cf52d-7ea1-48b6-872b-b418a0e06943", "comment": "Malware payload (njrat)", "value": "7dd960b4021efd1ee9b93c6845aaf3107ba54738", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692116419, "uuid": "ac66ca3c-737d-4709-b703-4934d02d235d", "comment": "Malware payload (njrat)", "value": "5d2d2f8b907502423c851ac5c595b060306436cc60f18eeaefa7e0ef83e23ecffc98ab9e478d16a1d21bd4fbe92f2833", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692116419, "uuid": "07d0a983-8e09-4f04-83ae-be9f8b7d9d9e", "value": "T13193E74977E56524E0BF56F79971F2004E78B44B1612E39D48F218AA0B33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692116419, "uuid": "d913249e-77fb-49a6-a873-12e3131de2ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692116419, "uuid": "8bc7e153-d924-4315-a293-ff49ee685ea3", "value": "768:5Y33C5hWXxyFcxovUKUJuROprXtwNzeYhYbmXxrjEtCdnl2pi1Rz4Rk3j7sGdpd3:ACHWhIUKcuOJgPhBjEwzGi1dD7DdgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692116419, "uuid": "b6422043-b716-415c-bb39-5f8dc6aa0311", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692116419, "uuid": "44d60062-806b-4647-99f2-55cb917787af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692116419, "uuid": "36a5fa5a-ea1e-439e-b5d8-fb95db6327c5", "value": "237dd93cf8dbc052febc48fb11a1dcac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa345d9-3b70-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1692106673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106673, "uuid": "12d59f5b-57c4-47cb-81c3-397551be3ed0", "comment": "Malware payload (ModiLoader)", "value": "cb267cc8ee0f3feeb3478cfe0c3b8e77", "object_relation": "md5", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106673, "uuid": "5b63e95a-a6ac-4266-865a-1b4407262562", "comment": "Malware payload (ModiLoader)", "value": "71530342efddcfa17bd1cf2d2f3277399de24357a8ad8cc4600de93215d28329", "object_relation": "sha256", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106673, "uuid": "a9c43ddb-aa9f-4142-8176-0a37d83db186", "comment": "Malware payload (ModiLoader)", "value": "10a3726e5cbd87bebc37b8315098596922d592d6", "object_relation": "sha1", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106673, "uuid": "d6c82b38-86db-40d2-a1bf-d73d1cd01572", "comment": "Malware payload (ModiLoader)", "value": "453d7d2c669c5087277312fe3fec6cf36b5382793b283d3d84e0c03c148e900adbd3f3d50fb8db4d99013e89528d384d", "object_relation": "sha3-384", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106673, "uuid": "9b937f6d-e73d-419a-b849-3f0a3bfea735", "value": "T1916423D0458394902B4B5E982CF57ACE58865F54B52939D3580CCF4EF70B2BAA23D75C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106673, "uuid": "a59adc9d-4d72-428a-9def-2dfd6b02f321", "value": "6144:WdYX7soRqzfxNjpWKhxdih8G8mpInIIe4LrKnflIkaQiYrOSSm:WdmbRqzfvpnvR2pInIqKflHaLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692106673, "uuid": "683d72b7-f567-420a-b783-cea498076501", "value": 306764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692106673, "uuid": "f601a8eb-4164-492d-b749-2f53e73cae76", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106673, "uuid": "5409f65e-d062-4cd1-80dd-c7eaf2dde59e", "value": "n88044857 jpg.exe.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb63930b-3b20-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692072306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692072306, "uuid": "032aa581-689b-4209-9b33-43a17d113271", "comment": "Malware payload (Loki)", "value": "affe50dd87af8c19ae15d986cfec59a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692072306, "uuid": "2443771e-3914-4cb1-a782-ba37847e339d", "comment": "Malware payload (Loki)", "value": "715f585fbea156c841e4f47a830c56842b01239ad3bc56a0f2fabe269a227aad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692072306, "uuid": "101ede82-43bc-4528-b415-cf324ac1eadc", "comment": "Malware payload (Loki)", "value": "1370639246e8574c4de5332d23cc7901a6299038", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692072306, "uuid": "7e6891ef-74f4-45f2-8c2c-bf524d898860", "comment": "Malware payload (Loki)", "value": "9dfd9355e512f83a92d23e9f1f09df63f4474a43e9269f4c58e4dd0440fe599c8379fae49d62ac3982907455ffd35101", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692072306, "uuid": "4f7abdb2-ccaa-4559-b3cb-29bc22e98f9a", "value": "T1DDD4ADC1E98455A0ED59AB716A36CD3592237EFCA834941D2ADE3E273FFB2D31026053", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692072306, "uuid": "e70638ee-2e4a-4064-8a5f-d753f5638e50", "value": "d4b94e8ee3f620a89d114b9da4b31873", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692072306, "uuid": "66571d1a-240a-4faa-8c61-ebd36d99cd17", "value": "12288:WBfIP7r9r/+ppppppppppppppppppppppppppppp0YuleQFlZnGIGq6nmnZCKQDL:71Mu5l5/GqwmnZCZDgb2YjS9zZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692072306, "uuid": "8ac832fe-069e-4884-9282-e7dcb37731cc", "value": 611600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692072306, "uuid": "0c5df2cd-0b43-4c62-90d6-acc5e895c7af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692072306, "uuid": "6946be15-a7dc-49dd-9d6a-c90491b5f54b", "value": "2023???.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f1ee56-3b91-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692120757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692120757, "uuid": "3040c2d9-fafc-45f5-8e52-eefbfcca760c", "comment": "Malware payload", "value": "afc9661c91e47851309ffb6d42444537", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692120757, "uuid": "aa325410-00f5-4d25-9c0d-177fe3fbc9b6", "comment": "Malware payload", "value": "7243499e498823d1f6db5407ceea0f12e009bfa837f9355fd7bfd94af94b9b53", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692120757, "uuid": "28ac6586-a8c1-4a54-89d3-d4f3a9c7633a", "comment": "Malware payload", "value": "ef3e5acf3a454ae51295f29b03f6c5b04af58c1a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692120757, "uuid": "5b3c59a9-d03e-4cbb-afd7-0c103d41c2ef", "comment": "Malware payload", "value": "4f9841d59f05851364789fea0f830a43a7251f4144c429a2f512cb92af6eff48f5edf14bd4579722c1732ef3b42e7f55", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692120757, "uuid": "7ba61aca-4b84-41a2-a733-439262a8b059", "value": "T1DAC34B00339DCD74F166617E0155AA320DBA7C36B63F899EAFC64C8E4678A807764F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692120757, "uuid": "e7359b6f-52e6-454b-aa32-2fbfb76ebb92", "value": "0b8af3550b5710c15669b5b350fa662d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692120757, "uuid": "777a0138-f173-4286-8814-20b78029b4a1", "value": "3072:a8BP7n0dUfLn8bGRmH8/hRtp+XIosUHqdtSY6:o+fgaRA8/hRtIVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692120757, "uuid": "c8794daf-2be8-470e-834d-e023ae998878", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692120757, "uuid": "06ab781c-47c4-4154-b1cc-72d8473ea6cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692120757, "uuid": "64d03494-c298-440f-bdb8-832fa5fd8091", "value": "SecuriteInfo.com.Trojan.Loader.1689.4082.30490", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "062973f5-3b69-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692103275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103275, "uuid": "1aa77f52-129f-4959-8b18-525662fe2831", "comment": "Malware payload", "value": "d1473976fb342a98715c19180ccf22ab", "object_relation": "md5", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103275, "uuid": "3a4057ce-eff9-4495-88fa-8952611ce381", "comment": "Malware payload", "value": "764b6751adaaf042fdae89bb292b85bffa390f534da3e6e8ceb5c6e6f0e0eb88", "object_relation": "sha256", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103275, "uuid": "8341df37-1878-42d7-a5a4-4eb34111b7c6", "comment": "Malware payload", "value": "c98ad8c84c87dcdd66d20b0ba3495923008dc55e", "object_relation": "sha1", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103275, "uuid": "c37a91de-30b5-4424-a5ad-2f876d2d822b", "comment": "Malware payload", "value": "c329ef090369e4586a84528f816b912d93f593c821586bfd9b9b644313fd3ec5c16103ffa94116469832c35fdcfe3ee8", "object_relation": "sha3-384", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103275, "uuid": "72342d5c-5614-4024-af5b-cc4c1e874e8e", "value": "T1C792BFA8E144EABCC49AD43E530443F764491998824973BE3160E7CC6762A9347AF3FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103275, "uuid": "be7e7473-74dd-4757-9c7a-6303227bcd62", "value": "384:YYQ2nCif4Df9N6/zNQT+ojQ28lf9XLfPVOnHyIvvVEwgH+9tqj:RpDfP/iTolh0HPVEwy+9tqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103275, "uuid": "57f44852-8b7f-48e6-b1a4-9342236668da", "value": 20995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103275, "uuid": "93ccbaf3-6a07-406f-ada9-34f5ca6f0d99", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103275, "uuid": "943b8634-7417-4db1-9c35-142fe4789377", "value": "OR\u00c7AMENTO MENSAL CONSULT\u00d3RIO.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b645fc72-3b71-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692107007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107007, "uuid": "c6333e80-7663-4e64-a6a1-3c66e2a53ae0", "comment": "Malware payload (AgentTesla)", "value": "dfd1cd37fbe2598ec08eaeafc0e1a1a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107007, "uuid": "4e93ac57-6b9a-46c6-8235-d76acc2866dd", "comment": "Malware payload (AgentTesla)", "value": "7809086fd5f63a13b74d52b54f6f5d898dfda6ed72d2c1ba38d42a5d059d02e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107007, "uuid": "d5697e52-ab4c-4675-bdc1-da931c23d082", "comment": "Malware payload (AgentTesla)", "value": "852a401e188fe89063852b034117efb36b78c17a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107007, "uuid": "b1e90277-b87e-4b2e-80d4-a28499c20010", "comment": "Malware payload (AgentTesla)", "value": "23361ab0d7ba93b42220a851f7d825b9323aa49f09a3f1df4258c0870e0f5bbd76a1469ee34fa4641c0882f832fc3536", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107007, "uuid": "1d33ea1e-2bfd-4554-8bc1-8465a40d6c3c", "value": "T1C0C423767921B881F9EAFDEAB270F78F8D3047D8170C5E56CE1C9E0A02924B18ED4749", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107007, "uuid": "e7175328-ac0f-494d-a343-546ca193cce3", "value": "12288:SFHRJ/2DUlpqtwiYOgaBReI3kpKdU7eoUEzoR4jxWYdCmS1uaNELWvCTtqOOBtHq:S7mMpCw3Ogc8z58R4VTUh8cELWvCpJOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692107007, "uuid": "15d896f8-61ea-4a54-922a-c62471aa3093", "value": 556618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692107007, "uuid": "22e09955-7105-4b3c-9a5d-ed405a5d9e43", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107007, "uuid": "61083e1d-950d-48b2-9fab-a74e9ccf8e9a", "value": "Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19cd126b-3b66-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692102020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102020, "uuid": "7c9d3178-5757-499e-9950-686324a901dd", "comment": "Malware payload (Formbook)", "value": "d8ef7922b1509acfad4b11d0aa71987a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102020, "uuid": "45d01a9c-a197-4f01-96bd-ae77c018775e", "comment": "Malware payload (Formbook)", "value": "79760a303d924139c197bd8cb810d63f93d4fc62cd2858dda1e33a1b3b54f197", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102020, "uuid": "a1f32c8a-026f-4b08-9b2a-6f3f34badc3a", "comment": "Malware payload (Formbook)", "value": "843a2aaddd30e4ff7c375f4dc7986d0b110c58db", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102020, "uuid": "e358d6f8-6c5d-454f-99a2-ac38630b7bcf", "comment": "Malware payload (Formbook)", "value": "5cfb07db4c3a4c51c6ece8873046925b4dde21bee98185f468dfb2d5119c95b396df9e663ab68cbbceed4843c625e0e9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102020, "uuid": "8ca5d7b1-de59-4424-ab88-bbff3e876e23", "value": "T10593136D934F01A9CF525237AB1A0A4542FCBB3EB34552B5346C833937EE83D61262BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102020, "uuid": "2048a31c-fecf-4543-b2b8-d1b609d92d17", "value": "768:WwAbZSibMX9gRWj5GqO3xI/GJQb7BE6IEwAvQbZh685EkXYvqN3/:WwAlRoeoE67i3XY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692102020, "uuid": "5ee6b5e7-d0d0-4e56-a934-66fc797cde77", "value": 93472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692102020, "uuid": "aa539fdd-9730-4a83-a37b-d242576ead7e", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102020, "uuid": "528c6661-5faa-4e06-8e05-1527ef1c284d", "value": "d8ef7922b1509acfad4b11d0aa71987a.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e453d481-3bbc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692139296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692139296, "uuid": "4869475b-a857-49e2-ae14-d6288653606c", "comment": "Malware payload (Mirai)", "value": "bd783c576cdb55123ccd812c235bdfe3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692139296, "uuid": "b39614d9-8fe8-48bc-bcd5-ec8ae978fe54", "comment": "Malware payload (Mirai)", "value": "79d3065c2f99898a9f9cff7f9599761c74f174ec2c04cc745ee6ba5f89aa1dd6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692139296, "uuid": "7a61ad60-0995-403d-a222-a0cd13ad1294", "comment": "Malware payload (Mirai)", "value": "537da3b18429ccb9a465ad30a3855b66f491314a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692139296, "uuid": "d2e4aad9-1447-45c9-9d0c-5a24980e0c6a", "comment": "Malware payload (Mirai)", "value": "1fd05c87ded4633ed0660b795bd9e2e9e7c97f97a3ffd6cf7fa7fd132a8259d0ded9d3948003cd60654cb2baec24c8d3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692139296, "uuid": "d1ddd3a6-0244-4db7-a010-af707a11b833", "value": "T10CF3995D6E228F7EF66C873047B74E25976823D623E1D684E1ACC1146F2029E641FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692139296, "uuid": "02840685-46ec-48df-943c-dbeee9d00932", "value": "1536:ulaQfNYIEjUaZRk7Xt84qdRIMHCLNZNmDegJqZC8yuT6zONXE9NfPqti3lbK3:ul/cmd84q/IKCLLwTJqyneXq6ti3lW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692139296, "uuid": "670bf7db-4163-4980-affe-d49aa3512618", "value": 166184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692139296, "uuid": "a399e483-3c6a-411c-9d13-2cbe61af0167", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692139296, "uuid": "2665a9a8-9a7b-4625-aef0-51094a741a69", "value": "cundi.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "144f290e-3b7b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1692111030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111030, "uuid": "764ba9bc-4d0b-4c2d-bdd8-d1a2f608ae39", "comment": "Malware payload (RemcosRAT)", "value": "1917cd7462635ab251ffdc6025db3270", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111030, "uuid": "dc0d0e71-e9c3-4c41-b221-26be29dce87c", "comment": "Malware payload (RemcosRAT)", "value": "7a92cdbe30cd28ca14b2906dd91834501a7801749206664262e5cea6152f52b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111030, "uuid": "6e58cd89-b888-4f5a-b817-ec72ff0e6985", "comment": "Malware payload (RemcosRAT)", "value": "ab798c34a87b00851b413ed128377782aca10075", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111030, "uuid": "ad7a30d4-46dc-4e5c-949e-33bdee534c7e", "comment": "Malware payload (RemcosRAT)", "value": "20b4d2d74ac614f670f4193fce56ab7e18b490e2c7da9805b6dc62226d82a22ff0278c0ccba3ee09017c8a90b802c40d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111030, "uuid": "b5f3bf6e-7678-4689-993e-767a0893f8ba", "value": "T107A4AF02BAC1C072D57651300D2AF775DAF9BD20183A457BB3DA1D9BFD70190B63AAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111030, "uuid": "837dbd7f-0f0b-41ad-a958-3e76eed35427", "value": "04d77d421b8e5297898a3fce39d74267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111030, "uuid": "53336df0-8b27-4217-9fbc-91f8e61f6aa6", "value": "12288:dRXxReZj3WZfj/2eSseWFaIe2+f8CL47bs/ZO2LDU:dx7cyF2eSsewS8W47eZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692111030, "uuid": "baf48136-64cb-4c09-8fa1-206c7ec84fcf", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692111030, "uuid": "9b11bb9f-6b0d-4f46-877a-1e69c5896b39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111030, "uuid": "c229a2bd-9908-488f-a7a3-cd16a1266af4", "value": "decode_ee932ec951d9e99d3a9a078e4ada331c09a40212d91afed375898b9d4129d054", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc90d183-3b70-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692106614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106614, "uuid": "caec7eda-1d5e-4767-a3ba-795c0db485ea", "comment": "Malware payload", "value": "70292225342a4c11378450ee4c398b07", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106614, "uuid": "b7e9a6b3-d193-4488-b066-8a505869e818", "comment": "Malware payload", "value": "7a9886744cfa3a5e4ccd1c6086bd2d043c537ee5e8c47e3bfb4b103cf2200d1f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106614, "uuid": "b84587de-f5ba-4382-a3a4-6b8a3d2b1d92", "comment": "Malware payload", "value": "fa3b54fdd05d24115192c56c1b94960c7a4eeec8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106614, "uuid": "3ce48b0d-b269-4d72-930c-efdea385eda9", "comment": "Malware payload", "value": "f559637f56119d13c0d469a7a87e9a091fa696b94dcc1f5e77fff1258fe69646ccfc359df237515b17c4e3838dda5550", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106614, "uuid": "7a3bc43a-1b1b-4108-b970-e1b131c43fd6", "value": "T1A2424B3A6B830887EA041EB686E745DE6B7D1843336271BFDB1450095E942E3E8D1EB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106614, "uuid": "a073ae8e-3903-45fd-9d3f-b2da3f60b3d5", "value": "f010843a52db470e0d3050e7610f589f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106614, "uuid": "af84a77f-e571-4bf2-b8cb-68a27f3f7eb6", "value": "192:EbrJY1/p1VlAcU7daB1t063rTZlpt3ZqoZonxJcL+Vy8WLz:EbsjudaB1O63Nt3ZB2nxJhDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692106614, "uuid": "05ca3e77-49c9-41f0-842d-e58f04b75b38", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692106614, "uuid": "3e05adf8-747d-4724-b742-83aed9debdf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106614, "uuid": "da2f8740-e561-4392-a81f-389f67429ac0", "value": "SecuriteInfo.com.Win32.MalwareX-gen.19020.24022", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c76f33a7-3b48-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692089426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692089426, "uuid": "a191e8fd-9b84-4349-99f9-53019150c770", "comment": "Malware payload (AgentTesla)", "value": "bbf7edd13ab0ca0c989ff60cf6148dea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692089426, "uuid": "35fcd9e1-0926-4aee-beb8-f5029e4a5ef9", "comment": "Malware payload (AgentTesla)", "value": "7ae9d08f55abb7966be487918cc3bc4ce87771b8a038503b05cb3a72942ea637", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692089426, "uuid": "5a40ca2f-0480-4bf4-8ee8-a4d2676ba2cd", "comment": "Malware payload (AgentTesla)", "value": "4f00f6a02266c0da97dca5aa61e87349902b4cae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692089426, "uuid": "f30a3376-c67c-4f2f-87aa-f52fe2e68f14", "comment": "Malware payload (AgentTesla)", "value": "d0dd92035bfe25e355abea44d6d235c7cad3e9e53566f34d02ea625f3d604eaab52d3f723da9d8511b7accc3a03fe19a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692089426, "uuid": "5ea6228d-d9bb-45e9-8fc5-e593542ed68b", "value": "T1D0B4236F359613C80A83A72E8F6A4391C6A31F013E561807ACC63FD9B0225D57AE576B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692089426, "uuid": "0c76d4e6-5a86-46df-9109-f48223f1e398", "value": "12288:MWbOqgaBBCy+EcceJZw7OGg2iaHHGmZPC2JmqlF2+N18Mb3LI9qEIFPZ:pbOqg++DJCaGcmZaFCFNN18M3mG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692089426, "uuid": "bddcd31e-4d61-4865-93c7-97243aa64cc0", "value": 512313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692089426, "uuid": "85b950c3-9336-4d15-a564-b245785372c9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692089426, "uuid": "fddfb620-ee66-4ce4-a114-81b06404838b", "value": "JUNE-JULY SOA 2023.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "235703e9-3b34-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692080561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692080561, "uuid": "b0969573-cd87-47c0-837f-ff55eb26e7bf", "comment": "Malware payload (Formbook)", "value": "7385c6f13274a8ff0021d17202ea9065", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692080561, "uuid": "9ac9bc84-08d1-47ee-8fa9-aa9e9e916a15", "comment": "Malware payload (Formbook)", "value": "7b58d27c182cc3c04d6d5b2c1901f0e8dd8caf1bbe51c8b17f40b8dac185b712", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692080561, "uuid": "df208400-be6d-4dc7-bc57-3288471c5ab8", "comment": "Malware payload (Formbook)", "value": "f28cc60cb2b4275de2859b320a5a1e22ac01212c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692080561, "uuid": "ed4e20bc-b35a-4552-9489-d426580dd22e", "comment": "Malware payload (Formbook)", "value": "3e29c5e7462f8b17b555bb3c512043ae0e83aa855a5b20c8a613cb2d4a588dd56d1224ae81477496e430700abcd59f6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692080561, "uuid": "f3551328-b926-45ff-bac4-ccbffdd966fb", "value": "T19F54120033DAD47FF69124704AB902175B79DD213C70BA0F63A0AB4DBBB9651E94E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692080561, "uuid": "a8404b2a-f2af-4a92-bbea-403af02df0b2", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692080561, "uuid": "4bb2cfeb-32a2-43ad-ad01-b89a2f8e9b8b", "value": "6144:PYa6TRS/59XcpLXYUNxpv9nm/4TfXl/U4+ojbge6D9nlkJnos:PYB8/5lcp8UNxblTfa4Pjl6D9nlkpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692080561, "uuid": "3e88aa93-d547-4305-a45c-d8d464d74e59", "value": 281534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692080561, "uuid": "9fc475d0-df78-4850-88e9-d3d9793217eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692080561, "uuid": "f0cfd6f2-28b3-4faf-8c20-a1455e665004", "value": "Dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e539de99-3b57-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1692095918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095918, "uuid": "3388f205-4a69-41eb-9c2f-5ed68fb6462f", "comment": "Malware payload (NetSupport)", "value": "8ad464b2cd5e4cff7c12ae53a78c32aa", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095918, "uuid": "0809c236-962f-4a23-b11a-1aef6d7ffb7b", "comment": "Malware payload (NetSupport)", "value": "7b8f96f3de1a537d4f332f7b20fdee504924e815c79234ac3eae445c55c90b27", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095918, "uuid": "4a8dd7e0-e6af-479f-9bea-2e0877fd96c7", "comment": "Malware payload (NetSupport)", "value": "a42f4b59224fd5a13ff912bc5ba2d64c5579a078", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095918, "uuid": "385a001d-c5d6-413b-9e12-1b1b4aaccfbf", "comment": "Malware payload (NetSupport)", "value": "69f112956a1a4bed3004c9a8169be80f987fc5ca9a9e9e604762b6e5ccd1f02788af93806782005834b3541395af85c2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095918, "uuid": "127ac5cc-f440-4b47-a29b-3c0bf7f6a863", "value": "T1D3F240F95AE3A1A85813B1AF472FB404609457A70D48FF25B88CE1005FDC52CBAB96F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095918, "uuid": "81501cbf-6cc5-44a4-b1af-25097ee03521", "value": "768:ePhZUrrkWKpRgu/tWndvMuijHWpy7cf3A:eZWTwWnCjjWpy7o3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692095918, "uuid": "4fcbbfc4-b9f6-46ec-b0d8-e092dc1b3859", "value": 35547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692095918, "uuid": "3e7c55c5-4fb2-4585-b0e3-df39cf8f3990", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095918, "uuid": "27a6d120-ae12-40eb-95c8-a82818bb9b86", "value": "nine-life2990.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de5ec833-3bbc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692139286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692139286, "uuid": "72031f7f-3ab3-4cfa-a5c0-de77e9242891", "comment": "Malware payload (Mirai)", "value": "022ed9729a3154b94e559bb4f016fd18", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692139286, "uuid": "042c15a5-6bab-4b34-afc3-447a20081dd1", "comment": "Malware payload (Mirai)", "value": "7cf279009022a2ff3d3a7ef3c13bc286c9c03db40c8dda3bf222be90fe39006e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692139286, "uuid": "8e0caea5-e5ac-4840-a27d-76c29aa14166", "comment": "Malware payload (Mirai)", "value": "021638d9412b6c2d97e0c0c206dd834dfc19101b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692139286, "uuid": "c529df40-6895-46a5-8b37-8678ab2fac98", "comment": "Malware payload (Mirai)", "value": "3295d7e10ed97dbe42ed80f0e49e9a403cbced4392244641b0224867205bc896dfee87fc4385d1d52b5a515720202096", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692139286, "uuid": "19ff8c31-c8ba-4cc9-9bcb-9f556e6892c9", "value": "T1D6C31945F8414B13C6C212B7FB4E428D7B2A17E8D3EE720399256F71378B95B0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692139286, "uuid": "cc5be57b-aae0-4e7d-aeb6-e18a7d8c1ceb", "value": "1536:/sB8H5JaRiPFYA+Qyz4V/NCqT+c92Ev/N8BGT3/FmlhMZwywtF8IOOmFtK5fKsOB:/s28oFYOa4HDac92Et8Ez/bI153m/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692139286, "uuid": "526ecf2e-571d-4a18-a268-56cabff0360e", "value": 125696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692139286, "uuid": "9cd48a2c-ec75-49bf-a2a4-ccf47c9870cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692139286, "uuid": "38a7aa4b-b235-4e15-afd7-80384095a938", "value": "cundi.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a18879-3b74-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692108079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692108079, "uuid": "7fdd81d6-7fac-4318-b687-4b0b89919147", "comment": "Malware payload (Loki)", "value": "28a8f2dc2c124c9766ee730a91b4ff16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692108079, "uuid": "d10cc826-375d-488c-b199-1a3ef9ad3721", "comment": "Malware payload (Loki)", "value": "7d3f93d0b396775df3aa0693d08c0679968cf34872b6f7340c2f7e96d9f534af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692108079, "uuid": "ca0c291e-6bb4-4cbf-ae81-194f0bd88b47", "comment": "Malware payload (Loki)", "value": "9eb27e156ebebf1788272c49660d27664e7d8ed3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692108079, "uuid": "bc1dae0a-8d04-4026-acbf-d17bde3c7b3f", "comment": "Malware payload (Loki)", "value": "55e6e8436e24465f136bb9af5476dd0de7f7561ae00a8110008a6bec8307b6e33ff36237acdddae10b01603c1e4fcbe6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692108079, "uuid": "7a3cd108-fb28-45df-874a-4c8c6b8643c3", "value": "T198D47D7406AAC50BE45B1B34CCF2E2B57FA98FA092E6C7474FE4BCFBB44A05666410D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692108079, "uuid": "b6e5147e-eea4-4a9a-98e6-c45a698e74a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692108079, "uuid": "a6919f61-999e-48eb-af24-a6efad901980", "value": "6144:BtT+iT+Ayp1I2Rzjh1WB5J4K+QV2gV/FhhLYhHQdhDvkE6z3tJhECIDtT+:BtBCpNXh1K1Vehw7bkH3trYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692108079, "uuid": "41bab77f-c879-437a-84f8-d50b21e5c9be", "value": 631808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692108079, "uuid": "2cd15f8e-f812-43b3-8dbc-2c9fec0429b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692108079, "uuid": "2dac73f8-607c-4daf-b63c-9f13e3013a34", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e64b1c9d-3bbc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692139299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692139299, "uuid": "67e40a99-9095-42fb-aa76-ba24bbdc1713", "comment": "Malware payload (Mirai)", "value": "9208ee973e8b2ca3f0ab8568389f9851", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692139299, "uuid": "f4a4e2f1-7d5f-43ca-9908-4d084f3ecb00", "comment": "Malware payload (Mirai)", "value": "7dfe9d179b8139aa8e5311b6909a322dd6576da9cc3569e05c4badac6f599267", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692139299, "uuid": "6f044e5a-6383-42ed-93e4-9b86609cf307", "comment": "Malware payload (Mirai)", "value": "08f344869bc1359dd1292f4f50bfe3fe9ef4aee2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692139299, "uuid": "6344013b-22f9-4f53-b25c-30cf4dda0603", "comment": "Malware payload (Mirai)", "value": "25646f0ec0f61a4760b78c2992e362e90112a6baa187980f41a59d2059cf707f87d4529843c301af58a8e081e68db8bf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692139299, "uuid": "af73b335-48ca-477a-a1c1-725cfc509603", "value": "T1B3C31945F8504B13C6C611B7FB4E428D7B2A17A8D3EE72039D256F61378B86B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692139299, "uuid": "8edb9f61-0f7c-4bab-b7a3-ea0fe615e787", "value": "1536:YoXQVk1OHojY1KA9Iq4VQW1TVl5KnUGV2ajpChjDOlTiwywcFh5v4lmy9/WdOD1W:Yo6IU1K44/1Rl5KnB2EpCxW13m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692139299, "uuid": "10ca0f58-0eb8-44a1-84f1-977f43d629f1", "value": 121600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692139299, "uuid": "be88c67a-bd75-4ce6-bff9-de6487708099", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692139299, "uuid": "7cc2969b-4205-43f9-8ae5-b1b06147c42f", "value": "cundi.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b56084-3bc4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692142699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142699, "uuid": "361ada1b-af7e-45aa-aa00-82e2d7414ba1", "comment": "Malware payload (Mirai)", "value": "0d5ec13c167a5f460b24221ce7d93979", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142699, "uuid": "d37b306b-4281-4bcc-b298-8c2f7f6a7ea9", "comment": "Malware payload (Mirai)", "value": "7ea2c04a2830c0d40352f6dc13c2cb3d80de9ba488badd04a620e1877ac0ae5d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142699, "uuid": "5444f4e4-4a07-4681-9d79-79d77afc6a0b", "comment": "Malware payload (Mirai)", "value": "28644445dfa8440906b0af392ce34527818b9007", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142699, "uuid": "6eb2a826-c032-4450-bfcb-21458ef0982b", "comment": "Malware payload (Mirai)", "value": "b57737d8a7bc677a5e1efd83db6229609a52ad5a7c8bc67d2bb88249503f4e72a1fed2d4c8486ef9f4f779641c203352", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692142699, "uuid": "6f8823a1-7528-4e90-8674-baa2e4a49f3f", "value": "T1F2142A45EA414B13C0D727B9FA9F424533239798D3EB73069928AFB43F8679E4E23506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692142699, "uuid": "2694e8cd-c8d8-4001-8bf4-6474ebb3cc76", "value": "6144:fwIsh5dMVoaKKxCBwPzYTvR7czUrZSeM/Rhf62:fwTFMVoaKKxCBw7MpBSX/7f62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692142699, "uuid": "74ac83a6-93f0-4440-ae43-a1b07b52cc1d", "value": 204186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692142699, "uuid": "ed86d50f-b652-4598-812d-16585a6cfb9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692142699, "uuid": "6d4aea54-3e06-47d7-a4b4-5c245d55d26e", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d0d7e72-3b66-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692102052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102052, "uuid": "181fa8e6-bdd4-43f0-930a-7c013f558944", "comment": "Malware payload (AgentTesla)", "value": "b9978336180c99d08ce3e6445d285cf8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102052, "uuid": "41b81815-864d-4eb3-8b3a-e54565f38484", "comment": "Malware payload (AgentTesla)", "value": "7ef57b4182fe29e7281171c8ac9c21a7f91c3251da992523ef6e69b11faa60a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102052, "uuid": "9a05126a-6390-4e76-8ba2-3859e97a6e7a", "comment": "Malware payload (AgentTesla)", "value": "514d1897f6e0bdfb5c0fe1bd9271a6c7074263d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102052, "uuid": "dbe1235a-77de-400c-866a-0ae0a009ecf8", "comment": "Malware payload (AgentTesla)", "value": "01de50c8d423236dd3830d2ee75bf5b4e6ca3fd02e207dc3b94b8fc276c46e4dabd53ba0b93c30284af4ccfb39de15c9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102052, "uuid": "b133fc8f-37b4-439b-b8b6-9ff5bb424c89", "value": "T14D55F103E900DBC3D41D83F87E530EE90F0A6F19E99569DB15663F9B3B70A72099A12D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102052, "uuid": "1a7362cf-cb40-4430-92b2-a14e96b5b072", "value": "24576:xaZy0w6VgjKaWlEzp7a2Zyaw6VOjKaWlEzp7a0zdf6cb7QApQp5E/kwPx:xE86VgjKjOz3y6VOjKjOzldh7/pX/kE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692102052, "uuid": "dde1eec1-0fc2-45ad-878d-99c86b6e84e3", "value": 1329664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692102052, "uuid": "6cfff6bd-6dff-455e-aa01-97eb5e19eeca", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102052, "uuid": "fb0e5926-4829-4d18-8956-8da506f052ff", "value": "Hertz New Order PI OS-01-230526-12315.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe423699-3b75-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692108845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692108845, "uuid": "2b18fd47-f668-4a6b-9807-a13db2fede9d", "comment": "Malware payload (AgentTesla)", "value": "dabfc4e4d8e074ab38a8626c2ba32967", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692108845, "uuid": "e0a9389f-94f3-41ea-861c-0fabd7354e80", "comment": "Malware payload (AgentTesla)", "value": "8001a7f9b4ee584c8266f1db111b1960444f5207fe227f12462c4bb542498410", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692108845, "uuid": "864f5848-1a45-4947-b66b-62c2175cc64e", "comment": "Malware payload (AgentTesla)", "value": "f363fc3d8f59305274ab4dc45c6721987a242570", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692108845, "uuid": "6d0d6a4a-ee65-4a68-8b1b-a741949d49d8", "comment": "Malware payload (AgentTesla)", "value": "a5e53ee2b46b266d5761debac86a5103fabc17cf1d59a506698dd08c3de089abb30dd7bd7e193b140b5b2143ff9bdba0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692108845, "uuid": "442396f8-74bc-474b-ad98-414e13c0dc12", "value": "T15BC423767921B881F9EAFDEAB270F68F8D3047DC170C5E56CE1D9E0A02924B18ED4749", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692108845, "uuid": "01e75b4c-b508-4430-a4df-c964c2a3f3ce", "value": "12288:JFHRJ/2DUlpqtwiYOgaBReI3kpKdU7eoUEzoR4jxWYdCmS1uaNELWvCTtqOOBtHi:J7mMpCw3Ogc8z58R4VTUh8cELWvCpJOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692108845, "uuid": "5091d8e8-34ae-4d14-98db-6c75d55b9bf4", "value": 556626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692108845, "uuid": "1d9ccadb-c9dd-44aa-804d-849cdd49fa08", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692108845, "uuid": "19731073-0a15-4811-a00f-79463daaedc1", "value": "STATEMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93cbeb7d-3b65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1692101795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101795, "uuid": "0eba43bf-df43-42b7-a49a-52064f54c286", "comment": "Malware payload (RemcosRAT)", "value": "c56567facccf39a8ecf48f58d99ee961", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101795, "uuid": "9aa4d5f3-178f-4049-bb4c-89e7bdc4eac6", "comment": "Malware payload (RemcosRAT)", "value": "8167261af1cde7e03bd2ddf43ebde21bda4af66216d2c4ee9ca1c967e580f7a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101795, "uuid": "267d76cd-9a13-4bc6-bc2a-61971dd2a683", "comment": "Malware payload (RemcosRAT)", "value": "f3be1a22d87dced78fe2e54e534784a5ef6843de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101795, "uuid": "1854cff1-0cf7-4a27-8daa-2a7337549ad3", "comment": "Malware payload (RemcosRAT)", "value": "b8d84aacaa1cd08c6f49d0f087a277265029f46e51aed55d30386956ff405047b37799b8f887f4e19073c06141252ddf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101795, "uuid": "f5a004f9-8ffa-4fad-9d35-2b6e39417817", "value": "T157A4233BA8F4C987ED724B319671DB352FA5A04B18B8436B07106B9C7E1E550DB0F2A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101795, "uuid": "b1047fdd-a842-48ff-808e-953db342aaf3", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101795, "uuid": "fad75848-4658-4fdb-bc15-f32a82eb2161", "value": "12288:PY789UN5s/W38XzJ7hCgW7nTgkX3R/gkKODJCqH:PY78Ke/W34YgenEkX3KNuDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692101795, "uuid": "dc98f230-9a91-45db-965e-3470860c9188", "value": 488575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692101795, "uuid": "3a268617-585d-4bd7-8a7a-cd1dd335c59c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101795, "uuid": "956051e7-e355-419e-a7a4-549c64f8cf57", "value": "SEPA 2023-08-07 PDF_033293211002839277.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a77ba1-3b79-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692110552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110552, "uuid": "497c0287-87a5-4066-ab86-1a42cbc36b2d", "comment": "Malware payload (Amadey)", "value": "f41fcca5c188503c2a1b0d49767779b9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110552, "uuid": "b24ae9d5-3233-482c-9656-5238dfad0c40", "comment": "Malware payload (Amadey)", "value": "81d76c398555e57f2fd240873ad5e4574be217c7a2ccc401062ae080fa2c4730", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110552, "uuid": "239c77e8-f0b0-44ec-b5f7-97480884ee59", "comment": "Malware payload (Amadey)", "value": "2c5dc3ad7318e747d8deb287e2c4d66a1daaf29c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110552, "uuid": "ecf48107-a8cf-4ad7-8800-c52368251f84", "comment": "Malware payload (Amadey)", "value": "d0eed87689f65504e37e68b9e2c0f12d524495ed8db1c5d61c97c74fab24a5b969df776816dbfc093e57a05151e56baf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110552, "uuid": "9ce92288-484d-4328-828f-39b16c0974b8", "value": "T1776439507956C032D960A5721BB5BFF2C19D6C15ABB04AEF6BC00E76DA212E37930F39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110552, "uuid": "2df89549-cc20-49e6-9ed9-cf345fba4dea", "value": "b5701a03716cd526591d6ce95c5326c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110552, "uuid": "66cf27ca-032d-42a8-aea4-668d55d38a8e", "value": "6144:e+m+D5aS7R0gl508zvYIto3j127BnCW8W/sobeKuubF7GFMThLAOoKsc:rmkr7YItoj12xeKuubFSFShL4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692110552, "uuid": "2e739f80-6c2e-41fd-867a-96a471d8c6e8", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692110552, "uuid": "e104f8da-fd5a-411e-b9c8-43e863fa80d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110552, "uuid": "14d90de1-517f-46d6-a506-53414dd5bc5c", "value": "1692110550902459b3d38a295dc636c21043b764a40002f1a0c9978e09dc8a11da0bf51876723.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1215d6bd-3b7b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692111026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111026, "uuid": "238e3018-6b93-438d-a858-82a11e9fb983", "comment": "Malware payload", "value": "47a8c1df196bca5ad9a0978fb1bc6190", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111026, "uuid": "1c51d3c9-f0d7-4987-989f-8f14b664cc20", "comment": "Malware payload", "value": "826715c8c8488c93223f5eea64fa5d00638cb8bf040671486fbc2770340850d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111026, "uuid": "e8dc15f1-3159-45c5-bc21-0f117cb3061c", "comment": "Malware payload", "value": "a7ab4e666c7eadd448895785caa54d7f430a98cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111026, "uuid": "f2b64e20-77c2-4865-98fb-8301dc32eb55", "comment": "Malware payload", "value": "deaee6eea54bd74b46317358c87ff30c7dbd5d417ddd15df4643c01e19aa49549e1a80742522464db41ec1de3175bae9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111026, "uuid": "fbd7c4fc-6c54-4e46-9e2b-21b50772d9bb", "value": "T1D704C5583647A9BEC96F487DAC700CD0767CAC631242A707988FF4E9793B7819B091F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111026, "uuid": "4f48b906-398b-44c2-bd39-e0bd85742ed2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111026, "uuid": "1dcee949-b069-4cfa-8928-fe095b094319", "value": "3072:MZm+U1wq2I0rI7DEOGloe8QsW3E0aGdevJE8e8hx:8m+w2I0rI7D2zsW3E00vy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692111026, "uuid": "8a6e4bf8-a500-456e-b4c9-0042e08b7089", "value": 178176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692111026, "uuid": "a7af6ea5-870b-4104-91bb-92578faca877", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111026, "uuid": "412cd267-ab19-4a25-a618-a1fb6db1a0f8", "value": "decode_e215c54e22b71b909c6b03505a03b872679edbbf2609342ec9402515fb15ef57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7826e04-3b57-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1692095922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095922, "uuid": "db06ac36-8f7d-4ac4-9616-ba50d339c944", "comment": "Malware payload (NetSupport)", "value": "3e1185302ee2384fc75ae263d796c45d", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095922, "uuid": "8b1b0d0e-61dd-4991-97fd-3c96504dec14", "comment": "Malware payload (NetSupport)", "value": "844ce136f12eab711719722c97a0c7b7612a8d72e72d67f7c2bb95b36f37ea9a", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095922, "uuid": "832c9f0d-9512-4c7f-bb0c-884d8e71aacc", "comment": "Malware payload (NetSupport)", "value": "c8b6727562dbd70300101b36ba4f368d65beed07", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095922, "uuid": "16180c6c-2f6e-43b2-aa41-a7662272b77e", "comment": "Malware payload (NetSupport)", "value": "decb84ff8a2c807c96c14ec43b0296214f9fc351c6892f6d631b766c5b227a21fe1f1f8c2231dba4d038b32fadde5dac", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095922, "uuid": "6513bbe5-2b11-4356-b313-dee93e796360", "value": "T10E52C0654123E07940F9B9CD4D75B38F2AB59F7218AC61ABBA8598F3B0406C126B4CD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095922, "uuid": "c37c8a0d-868f-4348-ac2c-9d20c29eba38", "value": "384:uJqMEQg2XkjeZu1GM/+ZuMTkb7HtKlXM1bXOV8c:uwzQ90j3GM2uMTkTtmM1bXFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692095922, "uuid": "c00523f9-bc8f-4914-8cad-ba7e42be34d7", "value": 14314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692095922, "uuid": "adb466ec-4372-4ac2-b89f-7f5e7afcc67b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095922, "uuid": "332afe98-c7c2-44a9-9bd6-609377c6f35c", "value": "nine-life3404.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b57887-3b69-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692103333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103333, "uuid": "439de700-c29e-41fe-9fbd-e55a0f50bc69", "comment": "Malware payload (AgentTesla)", "value": "14bd8b5985684a0950002735f935c0a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103333, "uuid": "6c536b5b-00ad-46d7-b046-ed2642e5ad18", "comment": "Malware payload (AgentTesla)", "value": "85080c93fed815e1de0896f7e79b99c9d6895572f9223f95ba6f52d132c52b26", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103333, "uuid": "972aa98a-becb-41b0-b5fc-d0563cb03e16", "comment": "Malware payload (AgentTesla)", "value": "b97edaa29c2171288a6525a1461d86dc0bc2b0b8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103333, "uuid": "8a59384a-ce85-438a-9a97-53ebd94cdf27", "comment": "Malware payload (AgentTesla)", "value": "90b30498c51d30a8aff13ad53ce398f79caf4582597d6e2d0d689a0dee3901e2481c689866755e0e1403426723a57bf5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103333, "uuid": "2aac6113-cfce-4a50-b6e0-d2c04e17f354", "value": "T158E34B0BB78A86B2C141CB3ACE9B52300F74DA92B37FD34B754D23151B027E9996536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103333, "uuid": "78e5a0ee-c72b-4081-8191-5be4669f6dfc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103333, "uuid": "903465a8-81b5-48af-9032-7fa60277a4aa", "value": "3072:LtveuyvFnfh9GVY+z5XKMikgbbfjqfhAP8tTk:5TyvFOVY+zOkgbbb2AEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103333, "uuid": "b7fb3e69-72f8-4ce0-84d3-f3a348ebb107", "value": 155136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103333, "uuid": "bf0fc5a9-f1ea-4036-9dfd-b7987fd7c839", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103333, "uuid": "1937ca96-1a02-4a6a-a476-9a3406408e04", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5401b5c7-3b6a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692103835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103835, "uuid": "69ca2637-8c51-44e5-b4da-e1e9de33c59d", "comment": "Malware payload", "value": "fa140e40a18b9550c3c3d1c5fb128ab0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103835, "uuid": "900eb50e-34e9-4217-aed2-1d7acc162a61", "comment": "Malware payload", "value": "850bb1ffd6270d2a1edd7371c4e858d6253db344e0c32450f060209adcc78091", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103835, "uuid": "174e496f-5867-4593-9ddc-6be7932734ee", "comment": "Malware payload", "value": "08a7b85c705d2f28afd7afd868d55a02cf78b75d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103835, "uuid": "ccee4f6a-b67d-4a81-aae1-f79dd89932a0", "comment": "Malware payload", "value": "4aebae819ae2cff011f3411300f1a0a1f5bb699a2a855111aef9f54f76b94c4a65f8eab9a467cbfc5f8f0f8301a9537f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103835, "uuid": "8fdae801-4ed1-4a42-9999-2b1f32aa117c", "value": "T1E3C412696F88BA2DC6BDDEF5D329E1AA0912AC8332A507D3915104C67FD13E6DD0324F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103835, "uuid": "e21b22cb-905d-4952-a15e-f6177f2abdb1", "value": "12288:OnIs602Wd0NYCisobPfquTbOIp+ggFOLfOX+cFnMuDNLs4dDOmqiNugKXRAVWOfB:OnJ6pNYCMjSNYWXfBM8NLsyUiugKXmMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103835, "uuid": "0f696931-af65-40d1-aec5-85fa4b1230dd", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103835, "uuid": "24bcb2b1-e88c-42bf-978a-e7bd57d838a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103835, "uuid": "44784db7-6e93-4e4e-9e33-a6b6d0b62ac0", "value": "fa140e40a18b9550c3c3d1c5fb128ab0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "019b3212-3b65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692101549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101549, "uuid": "8ba434e2-5acd-40a0-80c1-fe9db601fb91", "comment": "Malware payload (AgentTesla)", "value": "39be2b832ad508a27883a033a11535d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101549, "uuid": "613a9ed3-919d-4a22-8c45-079e7ed5140a", "comment": "Malware payload (AgentTesla)", "value": "865da6b7f453c9d7a5d9eef91b61eaec863a10fba0fe377541ac58bb42da6669", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101549, "uuid": "70d539f5-c2f9-4296-9a9f-16b9048243f4", "comment": "Malware payload (AgentTesla)", "value": "cde0526950e59b21157388468efb8c632df073d7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101549, "uuid": "03a0b8e1-eb94-497e-825f-f90731eb7a50", "comment": "Malware payload (AgentTesla)", "value": "f118f329c45e71cb3c38041a7de9e9964a8ada310a64a07b079cc20787321841354cb53fb44be2e818221885110432e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101549, "uuid": "83f22a07-4d63-4d23-a53b-1a013809b7a2", "value": "T1ADD42379498E78C08214C4A628F58F79E4B7FB8D93FC98DFD3EAB116425925BC1F4908", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101549, "uuid": "2e757dc2-fe10-42c4-85fb-37a2ca969794", "value": "12288:HWrMpTqVp+e0UVWWXK0D3TdJalIIBNN4ANMlgqnpT+XmM/ayTb/m9:FpTq2ajdJaJ39NQfnpSXmMTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692101549, "uuid": "2ba095d1-5152-4ae4-8c0b-6230632bc4f8", "value": 623015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692101549, "uuid": "4b3ee299-3a62-4968-b346-5edcc5cf4ce6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101549, "uuid": "b0b9b550-8fec-49fd-99b1-d604b51ecd99", "value": "Scanned #00461070823.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f98feb-3b46-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692088356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692088356, "uuid": "4e385fbd-98cb-44d1-a7f6-00cf3f0a8c09", "comment": "Malware payload (AgentTesla)", "value": "1d625b13bf703a89f766b8e121b7ae00", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692088356, "uuid": "cc511d1a-c4d3-4681-8087-cb72d0dd52ce", "comment": "Malware payload (AgentTesla)", "value": "86c5c51b047865c732ec34409ec07572ac0c06d26ee2133f89993c86cd3dfd8b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692088356, "uuid": "228b3090-fcfe-4d22-b420-01fae57f0a59", "comment": "Malware payload (AgentTesla)", "value": "d67af0eaea904f189a3e1cda6bb24953cb0d0bf3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692088356, "uuid": "fbb6df4f-5b13-404e-aa69-589eed4a28c7", "comment": "Malware payload (AgentTesla)", "value": "90954d4b23cfdb79dde0cf4ae434242e5fad480d489394ccece390f3d22c527309cd27c3580bce32ff1d9d9346d1a86d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692088356, "uuid": "a2d4acbf-01e1-43c7-a845-be244da9482e", "value": "T11EB4236F359613C80A83A72FCF6A4391C6A31F013E561807ACC63FD9B0225D57AE576B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692088356, "uuid": "4a4c3f9c-e67d-40c7-8413-c3d88b956e04", "value": "12288:8WbOqgaBBCy+EcceJZw7OGg2iaHHGmZPC2JmqlF2+N18Mb3LI9qEIFPV:5bOqg++DJCaGcmZaFCFNN18M3mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692088356, "uuid": "2443dc92-29b3-47bf-8641-f800538045df", "value": 512301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692088356, "uuid": "9c835e38-430d-4892-8fc2-c4ef12c4194d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692088356, "uuid": "ef7c8648-983f-48ce-a995-13d403651e7a", "value": "Payment Copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd031699-3b60-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692099716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692099716, "uuid": "5ef04410-da98-4755-89eb-fe94bcf19705", "comment": "Malware payload", "value": "1331d4add0524da8950ef97790fbfa95", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692099716, "uuid": "4b93c8c8-f5a8-4011-81bc-964c1639a9b0", "comment": "Malware payload", "value": "86daa9a71e5c7e856308da4031ade3d154831c5c90f561f4150780464e61f9a4", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692099716, "uuid": "8600e3d5-e931-44e4-8017-df95a7ad08e8", "comment": "Malware payload", "value": "a2b62de9dd41b062efdb3e2e49dba5dcc8b7e2d7", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692099716, "uuid": "99c73f17-e016-4fc8-8c52-e8e77cc8c7f5", "comment": "Malware payload", "value": "b19204815b392bb8546a4219b8b2860b8a605d158511bfca246cd67f5454f94a0cf0caf620b302225c2364349d4728b4", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692099716, "uuid": "f911c415-052f-415b-ba1e-0dff6395cd37", "value": "T1A5540215B8CA47A2F2E2F47ACC0AD75D6A6BDD1E010F906455A27B3FED3A92D0D80347", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692099716, "uuid": "06df62fb-ce7d-495b-a452-681566312ac3", "value": "6144:+vobDDV7ib8zt4N7YU8GBB3cni5+ihW6K0RLh:79ibi8d33BwihW6Kw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692099716, "uuid": "4bf7b49d-ef74-43d1-a6c3-49b658c973a2", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692099716, "uuid": "aad597d5-b7fd-4d11-95c1-d92ce12da184", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692099716, "uuid": "98b1b37a-c66e-43ee-a01e-f61f9cda2c6e", "value": "SecuriteInfo.com.Heur.2565.22393", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34bd216c-3b65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692101635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101635, "uuid": "9bfaec37-e00a-425f-b1c9-0726d67828e7", "comment": "Malware payload (Formbook)", "value": "745187a622580b5979668fabc06e0fe4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101635, "uuid": "a23a757c-1acc-49aa-b013-b5401e04c80f", "comment": "Malware payload (Formbook)", "value": "86fe793dd78fe5b8f80d271bad4f574577222d150fa1d21517f26ac8b77193be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101635, "uuid": "7609582c-ccc1-415b-8ae7-5ea8e7b9df20", "comment": "Malware payload (Formbook)", "value": "13e3682d381e8cb71f8058fd81aff5485323dfe6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101635, "uuid": "0a595cff-a376-47ca-85be-852f1e0c8a86", "comment": "Malware payload (Formbook)", "value": "f0482a68a37450009df46646fe79d8253ce44a2688e2df79f8b3ea976c4920147e2746dc120618060832307ba47ad7ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101635, "uuid": "f58405ce-6718-4006-ac33-8e34aaf70568", "value": "T1C854125643C5C07FF8636EF26C73668B2EF65B0601788A0F1B1073997672646FA2E312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101635, "uuid": "3ba584de-feb1-4aa7-9ba1-141cef223fcf", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101635, "uuid": "6a4c86b5-90b7-4d79-bda3-7c6d966de4fc", "value": "6144:PYa6odIYezviKrAKJMIVwPeWU9T5CTlFH/MdsiFR:PYedIY+jAyMKCeWUqTlFfM57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692101635, "uuid": "5afa9f7b-120e-46e7-b9b2-01d3f4093864", "value": 282687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692101635, "uuid": "b1589b2e-f9e1-4030-bc1f-74dcdf26fe8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101635, "uuid": "b2d0dee7-ee22-4107-b508-1622e9f13b44", "value": "SOA END OF JULY 2023_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a6c9a8-3b7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1692110982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110982, "uuid": "4e7171e3-f210-4744-851e-306af2f01ca7", "comment": "Malware payload (RemcosRAT)", "value": "c55d640aca24b85524e54653e47bb099", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110982, "uuid": "987cd9a3-bcd9-4653-b7eb-800a96008bf8", "comment": "Malware payload (RemcosRAT)", "value": "87494546833f3274a896371ba977e1d2f7980c0111a3ffd7daa94acbe8aa37bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110982, "uuid": "305c866e-87fb-4ea0-88fb-37e05e264cdf", "comment": "Malware payload (RemcosRAT)", "value": "1c08e479e2c8e5fb670783328fdf2222b5998ba9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110982, "uuid": "01bdbb0b-0976-43ec-99bd-05a3954a4b01", "comment": "Malware payload (RemcosRAT)", "value": "f80ddeb45cc5194f3f416d6ad814075b4f5f7a32363090d334c6e6ae409f5b4b9468288c53b40f4384e40c9e5ac56b46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110982, "uuid": "58ad196f-dea8-447d-b110-36fca2194007", "value": "T17AA4BF02BAC1C072D57651300D2AF775DAF9BD20183A457BB3DA1D9BFD70190B63AAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110982, "uuid": "e09d2636-f29a-4358-9737-3f09a1fdf096", "value": "04d77d421b8e5297898a3fce39d74267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110982, "uuid": "eb548062-0771-4f5f-8027-3c2f0df78a7e", "value": "12288:pRXxReZj3WZfj/2eSseWFaIe2+f8CL47bs/ZO2tDU:px7cyF2eSsewS8W47eZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692110982, "uuid": "90e0f6c2-6a8f-4132-a8f0-14f696d06ae5", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692110982, "uuid": "e5434c19-0cac-485e-b43f-aad5cfe8c2cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110982, "uuid": "5846c265-db90-49de-9884-0718d3d23a23", "value": "decode_4a0c2ca9779415dba27de8c17cf3fd6b11407196fdf9e00de6edffd9e244d135", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b56726e8-3b5a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692097127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097127, "uuid": "8dfc56ec-3b0f-4f83-bb16-4513a10507b0", "comment": "Malware payload (Mirai)", "value": "53412152f24c93894c7416a00cd21af9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097127, "uuid": "3683d2f2-24d2-413c-941d-08d6defdf951", "comment": "Malware payload (Mirai)", "value": "878988c32e48c8f9f3d150a295722043bd617390202870f110324d390c87154a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097127, "uuid": "b9fe8e68-02b1-43d3-ab0f-ef0a729cb311", "comment": "Malware payload (Mirai)", "value": "64d247dac7da352e454bd2990092993fc113fbb0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097127, "uuid": "02c42002-c2eb-427e-a6e0-c7d570df5c41", "comment": "Malware payload (Mirai)", "value": "bffa3aeb044a037fe43a37ae2acd04a8dca965944dc8c6f27f6cc5b1cbf10aa1fc30d39e198bd7cbf4bdc3e87103431d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692097127, "uuid": "30c94ae7-ffc6-40ab-8d15-b98f52e9d388", "value": "T141934C06F8419713C1C327B6B7CF47093B3667B957EB330266386FB02BC67991A25A60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692097127, "uuid": "fc7923da-be33-4db6-b1a3-778f4bf644b6", "value": "1536:ZvgGLI1gX3JGQxPuwjxtOZyh5hXNKV6T/Fo2kjvVqQEqn/lJXCPe:tIHQjj95hXNKV6T/cjvVqQEqn9JXCPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692097127, "uuid": "94542c03-ff21-460a-8b6d-4c195373b1dd", "value": 96620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692097127, "uuid": "7333ca1b-4dd1-4897-ada0-fb9c47fcf860", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692097127, "uuid": "e8b00df2-0b0b-43c0-91fb-5ad8fe6e9394", "value": "53412152f24c93894c7416a00cd21af9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98054606-3b41-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692086340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692086340, "uuid": "da72f700-00fc-4692-a2b2-67882c940b77", "comment": "Malware payload (AgentTesla)", "value": "98e2dc5aafc1ceb8f277a4d5814f2ff6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692086340, "uuid": "9ade808a-934e-4162-b075-28583b4d5f04", "comment": "Malware payload (AgentTesla)", "value": "8925e136b962aa01f4ce1bef45f8caaceecd1770601952f93f7f26a1c4d680a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692086340, "uuid": "dc3f4ba9-8663-4376-9c33-bb41e6445002", "comment": "Malware payload (AgentTesla)", "value": "0a97e5dfbab1bad99aebcb943b83113e3b0c3aed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692086340, "uuid": "9a122213-939d-426a-86c3-59edc6dd952a", "comment": "Malware payload (AgentTesla)", "value": "7db46b1d8263ac75986e9563ef61580919b8b233380362872a3ba319db377d153bc60416890dee52464a14b16fa59d0d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692086340, "uuid": "3a8927b4-8fc1-49e0-8fec-18cf29c23232", "value": "T18225F70058750096EF3E267D1A63573DB9BC1D5362F2C5E9A72726D38DC3012CEA8BE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692086340, "uuid": "bcfa54af-46db-426b-8578-520833200a97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692086340, "uuid": "8dea9a1a-b63f-4322-a85b-393ee5b0cdc9", "value": "24576:hJ0ayJPIDpppXpppppCOopppXpppppCOY3aeWDpyAxqv:kNIuO/OrXwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692086340, "uuid": "b48ef9f0-b6d8-4b20-9eeb-59266ef27482", "value": 976384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692086340, "uuid": "6711aa82-fbf9-4ca4-8e0e-50297a3671df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692086340, "uuid": "1117b63b-da60-4fd0-b07e-c14a573501c8", "value": "PO55223347.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1328a062-3b31-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692079245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692079245, "uuid": "14223857-3e48-4d9d-8dd5-6ef86c1aa658", "comment": "Malware payload", "value": "17ed5c6315c6cd6621060aad63b51544", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692079245, "uuid": "f59fa32d-a892-4715-a013-327ea5202340", "comment": "Malware payload", "value": "8970c45b6098e59c1fd5567f9f77c8c4ec5eaaae4de3e81df89a8a2eeeb88d2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692079245, "uuid": "d3bcef13-d65e-46ca-b3ff-a5083c9b9af6", "comment": "Malware payload", "value": "8cd7b953511dc8f1aa29d8a16ca80206b822adca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692079245, "uuid": "b4eb42ca-55aa-4570-9c68-d565c9d6f59c", "comment": "Malware payload", "value": "c56a79a471a027552362e996dc23231b2b0f50cf97f7be0cf22887a1510e30aff2ea272a563dac119f8718a60ab98bf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692079245, "uuid": "d231ebef-c873-42ca-b27e-52b611da6080", "value": "T1D065E0337804D431F9E211F99EACEFE4453CA930176A55C367C809A45A607E7BB31AFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692079245, "uuid": "9f9af883-46a2-496f-bc2a-36a6a486d564", "value": "7597640c29b0dad658948c09334fdbc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692079245, "uuid": "24051e6f-fe87-45e8-9faf-fcd84f291d40", "value": "24576:3oSjFj9IZOLS862Bg9PpFf/lJxjlycEg0q91Qt:3oQzvLBeDXxpjv0q91i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692079245, "uuid": "5db12d70-55af-4547-8736-8246711ebcf9", "value": 1513984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692079245, "uuid": "94521c70-dc95-41d0-a638-d4592092f9a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692079245, "uuid": "dc1b36cf-bed4-41ec-918f-f2e3776777c2", "value": "17ed5c6315c6cd6621060aad63b51544.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abeabd0f-3b78-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1692109996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692109996, "uuid": "1bfce97c-3733-4501-8016-46f849861a1f", "comment": "Malware payload (NetSupport)", "value": "a2b46c59f6e7e395d479b09464ecdba0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692109996, "uuid": "06b81624-68ab-47fd-b8ab-356356994d55", "comment": "Malware payload (NetSupport)", "value": "89f0c8f170fe9ea28b1056517160e92e2d7d4e8aa81f4ed696932230413a6ce1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692109996, "uuid": "5b918ec3-70bd-4778-9c2f-116b5dbe4af4", "comment": "Malware payload (NetSupport)", "value": "92c132307dd21189b6d7912ddd934b50e50d1ec1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692109996, "uuid": "3a97f2df-7a3b-4798-8646-d0394ded50dd", "comment": "Malware payload (NetSupport)", "value": "f01a5f0ededed60f1c81e7814a4bcfb6a4d8723d56c5eeff2c71e05ec716e86167846321be0b7c54afd608937c348cf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692109996, "uuid": "e6555643-f380-425a-b5e6-00a34beab052", "value": "T134C3B34F429DE173EA52E97DC4809B050C64BEC9A4F458FB105EF63E3E3178E2B6416A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692109996, "uuid": "cc1618ad-6c66-49b4-ac99-e86e0cbd4e0e", "value": "a9d50692e95b79723f3e76fcf70d023e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692109996, "uuid": "40b42ac5-0a38-4935-914c-e0dbfede3499", "value": "768:rNd8VZl6FhWr80/aVr2pe/1G42KFKcMkjWBr2pe/zcKFKcMkA:rfO0hGSBee/1GVIrveee/IIrU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692109996, "uuid": "f0ae91af-4663-4b3a-8c19-4288b0ea73a5", "value": 120744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692109996, "uuid": "914c4a7c-7b3a-4023-b931-0cea3631b160", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692109996, "uuid": "199cd265-3adc-46b0-8f25-eaf53d7d6d90", "value": "SecuriteInfo.com.Program.RemoteAdmin.931.6644.21990", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ce8946-3b6f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692106140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106140, "uuid": "cada016b-9766-4394-8bd2-2f4756e55039", "comment": "Malware payload (Loki)", "value": "7766410f41d8a2f7bce1f7fe8f054419", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106140, "uuid": "8ce23a0a-03ba-42d8-9a83-8e566d324da3", "comment": "Malware payload (Loki)", "value": "8a3f9afd3f759dd491957371e15ece7f13daf97d2813bdec16bb57f457d2448e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106140, "uuid": "a0ef9826-b41c-41ad-92ae-5e9d047e30af", "comment": "Malware payload (Loki)", "value": "4e80eceb1ad2874f94f7a37c977d9db843c0d87e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106140, "uuid": "a1a44607-44f8-4996-99e7-90a4aa14590a", "comment": "Malware payload (Loki)", "value": "01d4f428e090ebd5c8ea40ce30168da212e4510e47dea0960324264d71fa0dea9ef1ebc195e135c7b9371f44508b6ce5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106140, "uuid": "2b066574-a1e7-4ba0-a378-1b1a00afffd8", "value": "T101D47D7406A6C50BE41B1B34CCF2E2B57FAD9FA092E2C3474EE47DFBB44A09666910D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106140, "uuid": "ad2a6f19-5077-4d45-9e3b-f4164f55d049", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106140, "uuid": "25f4f047-9d3e-49db-a8ff-8dd272b66903", "value": "6144:ntT+iT+1yp1I2RgGQqcjri/VFFdMJ1Lq/HHwrySnaOwRCBCRr0d5md9BRT+:ntB1pNQ/j6bdM+fQrpQds5mjBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692106140, "uuid": "345d2336-2eff-401b-9664-436c90278b10", "value": 636416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692106140, "uuid": "bfb8fdc0-824b-4bc5-bf9d-82e655d458dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106140, "uuid": "82e1eee2-3cc7-43dd-b106-ec855915d534", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc3772b-3b76-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692109271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692109271, "uuid": "a5edb145-6a14-4e1f-8196-56ac2b547b3c", "comment": "Malware payload (AgentTesla)", "value": "a6bb9f230f2380fe061456d5c39dc499", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692109271, "uuid": "73bbdfa4-de3d-4624-84d3-1d4b1a15960a", "comment": "Malware payload (AgentTesla)", "value": "8b644fff888e4880ada45d337ac2e455ddab539464a2a1f97cfc72ad38822006", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692109271, "uuid": "411b6754-e984-4b83-b649-a98d70b6cddf", "comment": "Malware payload (AgentTesla)", "value": "c2f926c3cb7f40abfb7fac932920da3fbc3e2ce5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692109271, "uuid": "ec091eea-e005-4090-b70d-098ccf0afa7c", "comment": "Malware payload (AgentTesla)", "value": "06fa9c49053c8cd53e804dcbe69a7eb18301cb2d5de5e45859227e0caa8d34ffb17ec299ae2629c842751129ea06351b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692109271, "uuid": "f9979cf6-c3f4-4633-b066-145ebaaaadd2", "value": "T11A25F60059750096EF3E267E1A63573DB8BC195361F2C5E9A72726D38DC3012CEA8BF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692109271, "uuid": "78385b0f-789a-4d7c-b4e4-f20034316fd7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692109271, "uuid": "8d5df18f-920a-4b45-a2bb-901de5b07986", "value": "24576:pzw1lZPILsV5pppXpppppCOopppXpppppCOZxX5UnaFaUH7UAG60COYCH9xIxqv:KRILsqO/OZxX+napH7LGWbCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692109271, "uuid": "86e89b16-28df-42ba-acd4-d1ff96d25198", "value": 987648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692109271, "uuid": "7cd0537e-6ee7-47ee-96fe-3f78fe4107a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692109271, "uuid": "67661302-c034-45be-b96f-81f54614e63b", "value": "remittance slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b06bd74f-3b6a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692103990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103990, "uuid": "aedeeba9-329b-447e-a944-fa4d6ee4cabf", "comment": "Malware payload", "value": "d014ba5fd93ffc6d3411fade24d3e4ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103990, "uuid": "cef79b5e-3026-44ef-94f0-cc2b7448d37b", "comment": "Malware payload", "value": "8c019c365c10aaa95dbdffa05e1b12b893fe7acc44e9c096b8e0fff983339be6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103990, "uuid": "9374d344-7c28-4939-800b-9328bd70e08a", "comment": "Malware payload", "value": "f7b63d4d9df349df4ea6ace43fb36f609e54969c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103990, "uuid": "09c81d53-c840-4ad8-b452-aeda14e37d70", "comment": "Malware payload", "value": "740067b0222c05ba4a54a0827cebc321858807a04c49a482084f5af099496268e7a122977983e82c52640c37f2ba058e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103990, "uuid": "6795ce6b-9598-4575-bd9c-155d8b29ee4f", "value": "T11F6633EAA785C2D8CD1FBFB6DA70238F5688E43391905143C35935A4BF474A34629ACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103990, "uuid": "7f815cb5-f616-4445-be8a-299353184a9e", "value": "98304:YvYNeFwgNExmzKuCX6uSl2etBhnfSzkjgA14cY9SM4XlRPtcrnRvWte9LK/zQThm:kFwkDed6xN5fxgfJ4En0te9LK8fX28QB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103990, "uuid": "c4344bc9-4c4e-455a-94ae-be4bf5999537", "value": 6895033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103990, "uuid": "071eb0a1-f175-4cd6-85ab-db0a6a024426", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103990, "uuid": "0280ccea-df6d-4456-864e-f5c812f7b5bd", "value": "d014ba5fd93ffc6d3411fade24d3e4ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ffdbe95-3b6a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692103936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103936, "uuid": "e06998fd-2178-4321-a648-42fdc1a9ab23", "comment": "Malware payload (Formbook)", "value": "b3fc98596e410ebebb2c1f39007abaf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103936, "uuid": "0785be74-f7e7-4c26-a480-dfcdd826b5e4", "comment": "Malware payload (Formbook)", "value": "8c2f373ff5cc5a441bb057f2f168b5bf502b9c98d3ad1640be39dc617c6d7b03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103936, "uuid": "86d36275-034d-4b8a-bc87-3490705455e2", "comment": "Malware payload (Formbook)", "value": "fc27d37f8fd45b4dcabd79d05ba86b97e511e3c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103936, "uuid": "4756cbb2-5228-4ba5-a449-31740e0dde7b", "comment": "Malware payload (Formbook)", "value": "9ca291df4c00be2fb49772b83a708e5e7818a8e74a2e35090b3cb3f405d0825107e6bbbb06d3879bc92f1aea5916f0a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103936, "uuid": "d4825a96-e4ff-4686-9000-19005e2b9124", "value": "T11C74131272628853E273D6708EBF4D81FBF4E112286A731B673257E5BE13181990F76A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103936, "uuid": "b6e3544f-11e6-4431-bf3c-cdeec6706ba8", "value": "f10e4da994053bf80c20cee985b32e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103936, "uuid": "8c1397c5-1634-40c2-9547-5b152625c27a", "value": "6144:QM23fNkLCxC1X5G8/GjpDeZFYNIcQnT8E/f3gBaVjl9YBsxVj3Q:oPNlxAGPjpDebYpG3LVjYBsX3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103936, "uuid": "5d9707f4-8bed-40dc-999b-4971cc6946fb", "value": 348968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103936, "uuid": "48788e92-c1a7-45f4-93dc-9a61b53bd839", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103936, "uuid": "133b1c1c-0e35-483d-8e54-0aa120af383f", "value": "b3fc98596e410ebebb2c1f39007abaf5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea52730-3b6f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692106269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106269, "uuid": "4135d643-9797-445b-b446-6ddb67d50e88", "comment": "Malware payload (Formbook)", "value": "f51456d6ef5bc0e72c16b65dd5b4776b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106269, "uuid": "d745792a-b5e9-42d2-8d9f-2848d5a3801d", "comment": "Malware payload (Formbook)", "value": "8cfdf661efbae4657da9021a442cc1598eb969be3f6ef598041e496d293f75d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106269, "uuid": "cf5b2d42-473b-4dfc-a9ce-67103a921f2f", "comment": "Malware payload (Formbook)", "value": "6773d982b2daf7f2a253841e47fd65dfb4f4962d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106269, "uuid": "c95c1c34-82d6-403f-9709-f05c93841788", "comment": "Malware payload (Formbook)", "value": "51b6ce2d9db7fdf76b53044e28ba51ff47d09a91921a94d1406917d9420a8ca39c784ca5977e0708e9d8921078c9d042", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106269, "uuid": "a4ae0773-0035-4eda-b832-02891ab0095d", "value": "T1C234128C3356D0A7E4E6A7330B3A501ADFB9B475147A668B23948F4D3D20F41EA0F7A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106269, "uuid": "112448b6-b658-4c21-a889-b9f5000f188a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106269, "uuid": "73bee2fe-e001-43e5-a3ea-fb17b1668378", "value": "3072:3fY/TU9fE9PEtuabkIcXE//kcXYSZtE6+YIrH4ZVL8WdPl5XIlI9G9S41NJyWDbB:vYa6KpcXpofgiIrcBslI9G9S8JyW/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692106269, "uuid": "c788cf21-5e2c-499a-b1f0-8a15ea3eb264", "value": 248278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692106269, "uuid": "947f62c7-1822-462d-ad20-69c876a7f26e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106269, "uuid": "e3e1b38f-c2ca-40a1-bb39-b13d48515c8a", "value": "order #6122-001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff0b8c91-3b65-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692101975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101975, "uuid": "203b71d0-1b01-434e-ac7e-3d7b7dc29e00", "comment": "Malware payload", "value": "fdcab49010fcc5d49e3c0bac441425eb", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101975, "uuid": "99d83eeb-10e1-4608-929b-7c3071259666", "comment": "Malware payload", "value": "8d4f562faf53456df4b0ffeb121533af5c0e48f22e610ca9f10eeaf264d6035f", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101975, "uuid": "156056a2-bba0-4da3-b4f6-f93c5b34b2c2", "comment": "Malware payload", "value": "785b7624c9e5aa29dd01f625a95ca0e02195cf0e", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101975, "uuid": "38b9b0c0-564c-4f63-8f53-bd1c2453a1ba", "comment": "Malware payload", "value": "fcd9ee9a15ae58ea1ddb5d7733f36808e4e377de59c8e7798355b2626c37a0c0e96b1cd34e277a3e95954cc2be0bf2c5", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101975, "uuid": "da878a0a-dde1-4bd9-9e0e-051b8d7e531c", "value": "T18845F1039C548B83D02847F8BD474EAD1E093E1DE8827AEB54667FDB3E706624D8E16D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101975, "uuid": "374742b2-339a-4e56-8f28-db08fa55bf29", "value": "24576:CrY+6bvdXXXXXXXXXXXXUXXXXXXXXXXXXXXXXJMeixYrwPHjkCnJNLEfZL5V:Crt6krQkCJNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692101975, "uuid": "2dd1e845-cac1-4030-8ff5-92d651395a24", "value": 1244672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692101975, "uuid": "ad5afa60-1314-4e03-9e4f-3d339772d315", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101975, "uuid": "9443f2ed-337c-47e6-acd7-fe8cfd2fc902", "value": "New POrder No001220230815.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c335de62-3b71-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692107028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107028, "uuid": "9c0f9358-4405-484c-9459-43424dab5e17", "comment": "Malware payload (AgentTesla)", "value": "85df604f64fce0f839849029bcfe94ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107028, "uuid": "dffff7fb-ee40-40f2-8c74-1f0be603f8cc", "comment": "Malware payload (AgentTesla)", "value": "8d63c67a016c955e0bd5e865b0420a0040c768fd5331ce450a0b7fe38c3d7407", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107028, "uuid": "16877dce-7834-4bd9-a539-1c9d93ebbd46", "comment": "Malware payload (AgentTesla)", "value": "228daadec9665596c18c750ad7bb0526519131b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107028, "uuid": "7f176a80-1b81-48c2-8a3c-dd633a7f5830", "comment": "Malware payload (AgentTesla)", "value": "b17dee09b69a41eff637eced9ca9059a888d4e23babb43ab6f02874e4d915b56335a1509c61b29002f86be86313c0c4d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107028, "uuid": "033663b2-dce6-4801-aa0e-238583b3f362", "value": "T105C423767921B881F9EAFDEAB270F68F8D3047DC170C5E56CE1C9E0A02924B18ED4749", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107028, "uuid": "c6e51c8b-2432-4c99-ac26-d04c81e63362", "value": "12288:8FHRJ/2DUlpqtwiYOgaBReI3kpKdU7eoUEzoR4jxWYdCmS1uaNELWvCTtqOOBtHr:87mMpCw3Ogc8z58R4VTUh8cELWvCpJOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692107028, "uuid": "c9daeb29-71db-4b72-a844-d844c5666ca4", "value": 556626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692107028, "uuid": "796151c2-87b6-4303-830f-0c3fcf5d6d9a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107028, "uuid": "2324b427-5c67-45ed-9153-9ea983cec743", "value": "New order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c90b887-3b73-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692107822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107822, "uuid": "8afa0819-ec87-46e8-9c83-5923ea747b55", "comment": "Malware payload (AgentTesla)", "value": "1d97b57c66eb663673c44bfcc93491b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107822, "uuid": "93da8ee5-650e-46c7-b411-5b3821ce3b00", "comment": "Malware payload (AgentTesla)", "value": "8f04cf1d80b97228c6eed0e40b6bf722a501013ecda2e01a9c87a4a83e589dff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107822, "uuid": "a6d613ff-8f2a-44aa-82d4-b3fdf4d1ac8d", "comment": "Malware payload (AgentTesla)", "value": "12fcc510f62246cf86ef81b0f961216673b6f6b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107822, "uuid": "119dd67f-73b1-418c-a0d8-a796db357715", "comment": "Malware payload (AgentTesla)", "value": "a20daf82c0ac0863d7cb67549646666a29834a8bc603b63da7f0d79e957dcbaa21b53c1ed13d8d3da2699a17a93d36cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107822, "uuid": "13ce95ac-7c11-46d8-8a88-c29fb341278e", "value": "T13F759C21E77B655AEF29A6F89E1F843138D9DC80F1B1C888B7E7290385C23514D35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107822, "uuid": "ecb0085a-3910-4100-98de-3c48dfde86cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107822, "uuid": "f774e0b9-1523-483a-8b59-9b97b76c1d0d", "value": "49152:eGvGRRs6CE3jLbO9Rs6CE3jLbOVutmQk3HoQ2P71ExDx4uHVTEEhh7K:eGvGRRs6CE3jLbO9Rs6CE3jLbOkmfNik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692107822, "uuid": "d31a9c8c-b7f9-4c94-a6ae-99b3b948765e", "value": 1653760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692107822, "uuid": "6aac9d2e-18f6-48aa-a299-1a5cb4e9a73d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107822, "uuid": "ef8cda1c-6585-443b-ae22-03c5e143fa7b", "value": "Dunning letter for account no. USXCZGOLRE.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01512592-3b87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692116152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692116152, "uuid": "f9049d5b-ffd7-4421-8396-8ec52ad73369", "comment": "Malware payload (AgentTesla)", "value": "2fab437c660d95b3e7e7f4ae8e4d09f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692116152, "uuid": "b18cf738-6b23-4b00-95f4-a0e3bd1e923d", "comment": "Malware payload (AgentTesla)", "value": "90b9761dcd25c9d5b71632aceb036e4f7c66230a1e27fcb98d9a306d2caff7ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692116152, "uuid": "30c207bc-77ef-4018-81a8-e7bf316ed17e", "comment": "Malware payload (AgentTesla)", "value": "9d3926cb4cca802a3a46ce853470ab447c8187a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692116152, "uuid": "84a39055-6ae6-42e7-96e3-071e2e8e0e0d", "comment": "Malware payload (AgentTesla)", "value": "4acd156f92c905279555ca4bcf1f3c6000032712a2de2b2516b649ad64eb1d524d04654cef36b77e7f8cb6848c194375", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692116152, "uuid": "a83a5373-91dd-4347-aa66-b65e61e338dd", "value": "T11FE4BDF660A9C7A6C7B593FF546344740BA33C092671D28D7ABE31E52E95B831A10E33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692116152, "uuid": "d2f1ff5d-88ca-4cda-864e-ed230bb511df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692116152, "uuid": "ca9f8c5a-0ba8-4da9-90c0-e13a265b3738", "value": "12288:nFOstV/Oo26M/9Ar/UvBFadVqdiIxEaR9txNdYFT94fBReOAvTa:8s6xWrmBTEadCFx4fPjAve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692116152, "uuid": "930d217d-8745-40d8-8c00-40721b1ad45d", "value": 719872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692116152, "uuid": "44c2f7db-5164-402e-8250-b9d342fc4438", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692116152, "uuid": "8445d59e-dbdd-4b89-9ed0-e8405e4ce09e", "value": "Payment Advice - Advice Ref[A1T9IvYc5tfi].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb03bad0-3b7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1692110961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110961, "uuid": "10e86a69-f7c4-4666-a333-8f9b2a95b6ee", "comment": "Malware payload (RemcosRAT)", "value": "3847ea3588be7bf05288faa8a9d4c313", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110961, "uuid": "8b4a5338-1c65-47fa-9335-7b52b6363e48", "comment": "Malware payload (RemcosRAT)", "value": "91741818480b13eaac1d5547b488142fe2df86b8eb51b62b31acbfd5fef53f47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110961, "uuid": "16e81e44-eb3e-476d-a7fa-0dc183c04fc6", "comment": "Malware payload (RemcosRAT)", "value": "7bd8ac99ca69d25f5423cacfba19380243662d97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110961, "uuid": "2bce52fb-ff22-4df0-a367-f17ab395d80d", "comment": "Malware payload (RemcosRAT)", "value": "62f35c7d551bbcef732229f8018368bd02a4de41205407461873ef463d06b170e85ccd8f8cbc4f7a2dae42fe6f1ac53b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110961, "uuid": "e59a9f16-12af-4e3d-84bd-f8c39cb8fca1", "value": "T109A4AF02BAC1C072D57651300D2AF775DAF9BC20183A457BB3DA1D9BFD70190B63AAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110961, "uuid": "938568aa-7333-4392-a204-a48ae49f2b18", "value": "04d77d421b8e5297898a3fce39d74267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110961, "uuid": "86fde2be-068c-4431-a46a-27aec14409e8", "value": "12288:TRXxReZj3WZfj/2eSseWFaIe2+f8CL47bs/ZO2eDU:Tx7cyF2eSsewS8W47eZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692110961, "uuid": "5aa738b7-5460-4ffa-a6db-11097f00d6fc", "value": 492544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692110961, "uuid": "1fc48523-5d8a-4cbf-a84f-0e82b819d08c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110961, "uuid": "e5ee28d9-41fa-45de-b45e-0376fff30ff6", "value": "decode_1465fa2e2b90a0824ec63609fbf2c91541d8bf284fef51bcffb79bfc4cd18d81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3539843a-3b87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692116239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692116239, "uuid": "00b45b18-c503-49f4-8855-e62613146fa4", "comment": "Malware payload (AgentTesla)", "value": "0387ab4b6b5cc4cca1b4cf51d0356c4e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692116239, "uuid": "a7830d27-62cf-441b-9e27-c77025f1cb8e", "comment": "Malware payload (AgentTesla)", "value": "9298465571a4a3e1edd7c7cbe93b40b00325c6a0ad5c3bca897e78fc0da1c137", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692116239, "uuid": "5b7da8df-4d2b-4f69-9bad-7f0c9fc349f3", "comment": "Malware payload (AgentTesla)", "value": "f25f441bfc43fbf2b7199e3bfbd849ab7f07725c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692116239, "uuid": "bdf1408d-72c8-4424-889e-c85dab84939d", "comment": "Malware payload (AgentTesla)", "value": "0fbe4a923f2f238cc9f5661f8ce92ab1b27797cc953dcfb14c54c1f4952b747353dd138d053329e2b01ec972041d554c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692116239, "uuid": "4434fed4-6210-407a-b4f0-6cfd03211ecd", "value": "T1EA451206B73C6F22E13EC3F96811150587756A8B2A32D36DFD6E10C62B65F912B90F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692116239, "uuid": "a343e383-f670-4f86-8cde-ba91445bb3b0", "value": "12288:6yHaV/Oe9Dfw13SO7oMeK/6RSs3XFvKkA3BgfTQtGHDyKDcQR:6yFepYiOfsR3XFvqxUTQgHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692116239, "uuid": "7b26cff9-04a6-4f13-9eda-c4dc2cf59b87", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692116239, "uuid": "ee43516d-3522-49fb-a8f5-3d1dc89a2e89", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692116239, "uuid": "d187fa19-0395-4959-ba76-d7103ffb82e0", "value": "invoice copy.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b86824-3b66-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692102016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102016, "uuid": "ba32afef-03a3-49a5-9207-8450a1f24887", "comment": "Malware payload (Loki)", "value": "a60d30aea7ef54e9e0b3da2674bfbb99", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102016, "uuid": "0e3e29ae-3aca-4323-86b0-a700b1b8419a", "comment": "Malware payload (Loki)", "value": "931a165f078e6269fbdfb222ec7fa84e9102c7fe91781c355e61cd45bc58a7f5", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102016, "uuid": "0d142eea-27fb-4caf-854c-500c17de9757", "comment": "Malware payload (Loki)", "value": "97b320e4b0d24099d17a0a5a22af9b3a9b12397a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102016, "uuid": "d1aaf73e-6859-43dc-ba0f-44e74e4cd109", "comment": "Malware payload (Loki)", "value": "73afc4accc7f8d8c54b8e3c9165d7d0f98bc10a7d28afd170f64a11297c3370cb5dd65266eda7bab9698d199ccdb58e7", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102016, "uuid": "971bd45c-f18e-464e-ab87-ec25a1d41e14", "value": "T1BA55F103E900DBC3D41D83F87E530EE90F0A6F19E99569DB14663F9B3B70A72099A52D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102016, "uuid": "44c8c231-89c6-43e0-9bfa-325e5f698ece", "value": "24576:taZy0w6VgjKaWlEzp7aVZydw6VpjKaWlEzp7aQzd6f/b7QAUQp5E/zwwx:tE86VgjKjOzIJ6VpjKjOztdU7/UX/zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692102016, "uuid": "7f202ad6-6bd4-4d96-b366-65c4117080b6", "value": 1330176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692102016, "uuid": "a4090e9d-24dd-44a9-b121-f5272d845d5c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102016, "uuid": "b79f764c-fc56-482f-b13d-86cb26a1ff31", "value": "shipping docs.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6bd318e-3b57-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1692095921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095921, "uuid": "2ab44b70-5617-43b9-9095-a25b96948d18", "comment": "Malware payload (NetSupport)", "value": "c15beea0035b0ac586f27895a29a04f4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095921, "uuid": "0a63d4ba-ef48-468d-b96c-7c01c4538401", "comment": "Malware payload (NetSupport)", "value": "933861b75227a3f4727b5872fa9da1b049e420632f8a9198987e8bfbaf7da9e6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095921, "uuid": "2c7ccdd5-2e9c-4813-9417-3891493eac10", "comment": "Malware payload (NetSupport)", "value": "937d9d8eaac5a6ef16ce8bcae4b084a3603a49a3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095921, "uuid": "3f926097-440c-44c7-86cc-e79d346ced07", "comment": "Malware payload (NetSupport)", "value": "fd703ec4655b061dcc99467b8422c746015e0f04ae7efbbabc8f852947bd855cb93f9fd2803593af617ccd2dbe083961", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095921, "uuid": "28e7d9b1-2505-495b-a572-3a39c33cf86a", "value": "T1590360FA9AE761A42513B17B573F7444A4941A670C08FF29B84CE1105FCC12CBAB96F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095921, "uuid": "4134ac7e-e104-4b04-9eb2-5703a7adefe5", "value": "768:r4mmlLumMT+Sh5+nyZcUtu/tWnm8raemrwzyWM6j:0mmlLg7hdtwWnzraemrcMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692095921, "uuid": "e1c7366d-9768-4f53-85e6-20132c30d0d8", "value": 38501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692095921, "uuid": "e1518836-5818-4a76-b738-954a2e87e840", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095921, "uuid": "0ceb0fb2-91d4-4d55-ae0d-f186516d7c8f", "value": "nine-life3404.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aac8314-3b26-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692074614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692074614, "uuid": "d9b71d5e-5c7a-4e19-b7f3-d19b8a04cfd3", "comment": "Malware payload (Formbook)", "value": "a3c5ae2998ae46c0411ca8c40f16575a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692074614, "uuid": "95af5af6-d1ed-4cb3-adcf-14929d46db03", "comment": "Malware payload (Formbook)", "value": "93512f8df3b84088ddebeaa216201bfc2a2e9d68ded4133a9ef94fc5f154b229", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692074614, "uuid": "635e9fa7-5f54-43d6-b42c-ae5d3fb27fc9", "comment": "Malware payload (Formbook)", "value": "404424f2bcd17c86bfcf923d4f235b2a243ab5a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692074614, "uuid": "dca560d1-35e7-42dc-8f9c-63e68e83971a", "comment": "Malware payload (Formbook)", "value": "03ecfb3bacce7632cda94e40ac53c3b053e64a41340a7ae6f5820497339881699082f3cbecf9007998dc666d27d9b691", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692074614, "uuid": "b44e9062-916b-4edb-bc38-600d8b08d7cd", "value": "T18A641288B3B4CCA7C5410E32853B1A269BFBDD1648DCA78E57407B09BD763C3590EB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692074614, "uuid": "bd613fe3-e9d4-4507-b0c6-3fca6454580b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692074614, "uuid": "a2094ef7-1ef3-4d66-9788-45f20092c6fc", "value": "6144:jYa6gkZtygxqfk6Jjo3/+NiVOFM0pG+p08CtYYdjIu7N9msbTQ:jY2rhT1o3/+NiapN08CVCuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692074614, "uuid": "a5e02882-15a0-4c67-a1f8-da69af29c86d", "value": 327473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692074614, "uuid": "14aa9b89-f3ad-423c-b658-d10f7ac18917", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692074614, "uuid": "d97d0491-2fb5-4532-a136-67cb55fc5125", "value": "DOCNO09342177070.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143603b2-3b66-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692102010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102010, "uuid": "2e2d8f10-2e74-4f4f-9f8d-f679ec470ac9", "comment": "Malware payload", "value": "117d9138f0db7fa7373f336234472248", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102010, "uuid": "30e7ba95-0a30-4e74-95d8-7e236b7a01d8", "comment": "Malware payload", "value": "935a394128e7c42b915d94309d81b6c5111641651cfaa1b8c6db2e0095b7110f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102010, "uuid": "98049247-9e36-4f53-9a4a-245b1bb74839", "comment": "Malware payload", "value": "24bdaa4d25737a79190c8a36c5a22cb159c118fb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102010, "uuid": "94a7a5aa-1493-4699-b950-922976bd9c80", "comment": "Malware payload", "value": "e4741639689a83f6067f7a6b1a143ca93fddb85cec024b279193c9bc4e0e41f16eba35c1017c10c3be41b64f76da8de4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102010, "uuid": "0b3fa6b3-ece1-4e4b-8c8a-55c3982ffd23", "value": "T1D85474E8644F0576E205AC5D6A94B040AD7AFED730C188B033AFE135DF6AAF59EC054B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102010, "uuid": "72eb669f-e6ab-4cb1-935e-a8072374391d", "value": "1536:iSa0GUisxYtxiO8Lcs5Kpn0Ws/zkvOsC4FKjX+da7xiLM20TQVzFz76mAg5eeVh4:iStG1UY85x83VzFtr5RDAw5wf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692102010, "uuid": "accaaa81-5c53-49fe-92c8-a4a78fbf6739", "value": 287771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692102010, "uuid": "551add72-216e-485e-8815-c249c43fc58c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102010, "uuid": "34251f2f-294b-4569-9944-bea334ed8ece", "value": "Product Drawing.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c3734bf-3b8f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692119714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119714, "uuid": "a0cecc50-cf10-40ce-a5f1-85274bccf036", "comment": "Malware payload (Mirai)", "value": "a22d55b9d992ded875dbf8bede83e0bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119714, "uuid": "5907fede-2630-4e48-9ca2-db597700aea2", "comment": "Malware payload (Mirai)", "value": "959be8c6c804fe46276cf6bf1ebb20ad0946bf497bcce77bb7c216242918d64a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119714, "uuid": "168fd893-b5c5-492a-a897-457151a354f4", "comment": "Malware payload (Mirai)", "value": "21e41558890b43e69e9e79653d40e8c043a1c5ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119714, "uuid": "8fbc044f-a824-4d32-98f7-5e629ca43166", "comment": "Malware payload (Mirai)", "value": "da6fdd045864baa953ba9139c7cd746586ed33117a7d6c77e8efcc3bebbde5c7fed5bce56e1f569844a19f2244ff4431", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692119714, "uuid": "6a600b24-e085-49ab-9f79-914d095c48c9", "value": "T100835BC5E683D4F1FC5305B2A537AB364733E43A502AEA02C7699D36DC52A50E72B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692119714, "uuid": "6104a45b-26f3-4c50-b2f8-e6fca696a919", "value": "1536:lhYHjbkc9hQiEYeeqrbayCgW7yL1PfmuSSW1Z:lhYDJ9hQiJevnhCf+pW3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692119714, "uuid": "f0eee9dd-37c9-4d70-a1e5-6ea3d3e47036", "value": 84100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692119714, "uuid": "6b96f8e1-3f5b-4f1e-82a6-8e57b0ce2eda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692119714, "uuid": "e32b46ff-d62d-4308-b1df-1de445635764", "value": "a22d55b9d992ded875dbf8bede83e0bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "090feb87-3b69-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692103280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103280, "uuid": "d072db77-0ae7-4fa9-a81b-6f062b796e5b", "comment": "Malware payload (AgentTesla)", "value": "38c542d48707d4865e75ce6bf5caac05", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103280, "uuid": "81be22ad-ac3b-474c-a4d4-1d565fbcc8ca", "comment": "Malware payload (AgentTesla)", "value": "967bad97761462afa55ca360040d55cdbcfbf019c9c68672ad8a1cfa1d05de3a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103280, "uuid": "96bf8697-92d1-4d9b-ac76-329b00d14912", "comment": "Malware payload (AgentTesla)", "value": "152b07bf5a82e93c5ff89823318aa46c41e1846b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103280, "uuid": "5c25ada6-5b34-4cf6-9195-c30c3dc0e69f", "comment": "Malware payload (AgentTesla)", "value": "79324ecc1f0b643428d02ae0906342581a23f6ac33ac40f5e8960f322072dfcb80cd9da8e62aa218ac3868cc4b9e51af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103280, "uuid": "975454b2-580d-4bc5-a1cb-88f2a268c464", "value": "T18BF4234FAACE813E7F700CBB8E41B0EEC97DA2C045251EB8B759E3DC66678099449735", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103280, "uuid": "20a2c434-6cb3-4533-a137-f79202cd3ab0", "value": "12288:QsQFeQJJFlz+PrWPFjPFpjB3QlbOCq8kZ0zLovWU0kyjRewXkgq/:0forWPF7fjNQNOjxLDyAL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103280, "uuid": "e202ec54-bb0d-4225-bdba-419b63d4b364", "value": 735335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103280, "uuid": "3c2fc9e8-eb5a-46d8-9a41-29ed019055ac", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103280, "uuid": "03f8ef78-6390-402f-89e9-8cfb84a0e612", "value": "Order 21739282.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb425fe-3b5a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1692097110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097110, "uuid": "f2a28f4a-fd59-4973-90d9-edc1190053c0", "comment": "Malware payload (Gafgyt)", "value": "6fa4978a4d8e95d20a52031eee4ca133", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097110, "uuid": "6bc87fea-ba3b-451e-8104-add98909173a", "comment": "Malware payload (Gafgyt)", "value": "974c341b487be9b38ffe9dec6ee0d503ccf54a0eba42caae2035240819ed7198", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097110, "uuid": "b4c3d3e6-b8f6-433d-bd42-9c7913c2600e", "comment": "Malware payload (Gafgyt)", "value": "a8f108d090723e9433a8bc0b064e1d94816d0360", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097110, "uuid": "4c42ae08-f09e-41ab-a251-6ebab342e842", "comment": "Malware payload (Gafgyt)", "value": "972a94d6b3846148d1a42afb5061015b76a8f6a4a38c7c17f165a7a305575edc17f3a7ac92dac8a8bd101d3b6fade45f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692097110, "uuid": "58cdda2d-d07c-4530-a276-75e874cbc428", "value": "T103E34B09F6408B53C0D32776B68F534537239BA5A3DB33069928AFF43FC27A94E22955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692097110, "uuid": "4eceff5b-f9f6-423e-8a95-22ffe1164466", "value": "3072:tdntU2haO5H1XacBoGmh9H5F5hDiGRvEM/9f9T637m5wTsL/Qpyn:ntVhaO5H1qEc9HL5hDiGRcM/9l+7m5wS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692097110, "uuid": "f00180bb-20fb-4f20-87a4-7b32682ceeb8", "value": 156296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692097110, "uuid": "fcbbba63-d534-4dc3-a27c-a712314e551c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692097110, "uuid": "2a003710-3d91-428d-b7da-f35c8f936dbb", "value": "6fa4978a4d8e95d20a52031eee4ca133", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b80b41-3b65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1692101660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101660, "uuid": "2809aa47-ae54-4fa4-968f-7f989b419de2", "comment": "Malware payload (ModiLoader)", "value": "7fde0f4ee7a1c8b2e8a6460e92ebbd09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101660, "uuid": "2b24f5ba-788b-499b-901c-a5d2ac237224", "comment": "Malware payload (ModiLoader)", "value": "9aa4d0eb53b0456c4b9354ba96a05997e8d526473eaed3fd1f55d455cdec380c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101660, "uuid": "98db0161-5518-4d6f-86d8-0be8de4bc341", "comment": "Malware payload (ModiLoader)", "value": "3b41152464af5070d3bdbbdab747d77977bcc663", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101660, "uuid": "c226cd67-3ddf-4893-833b-7c1d0441c0eb", "comment": "Malware payload (ModiLoader)", "value": "2bad79c9fce800e02c4e727797d895e96dc9288c85798094fea4f6e0f8902f5152edfa27603b51fc7a033e180d6bcaad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101660, "uuid": "b29c4594-0434-4454-8b0d-38e77746a056", "value": "T1B865E153B19045BAE1132F3499D7976D46397F106A183E46AFF63EB81A342E1382F18F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101660, "uuid": "2f253fbd-98c2-4266-8ed9-6c36285f7c9a", "value": "7f620cc7b7af7eed4a635e4f9d9d9c79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101660, "uuid": "c86dfe8e-4e1d-4e21-81fd-579ffa493af8", "value": "24576:uwhXkaJaRlGSy4fu/W8P2y/RCkl3d9hQqDOn9:7hMdy/RCkl3d/QX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692101660, "uuid": "3173a1bb-d97f-44b9-96cb-ac5bc47bac6e", "value": 1538048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692101660, "uuid": "021b6e56-9340-46f4-8b46-8aad3c65c6f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101660, "uuid": "18eecb1f-4f5c-4cea-b304-d24e2e15face", "value": "Ymdtavpqygjrzq PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f17deb99-3b68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1692103240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103240, "uuid": "a26350fa-925a-44fc-a5df-5469cdcc4b87", "comment": "Malware payload (AveMariaRAT)", "value": "d53ad1ff0ceaf47f7e38a5f59c391014", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103240, "uuid": "ef2c17ea-9d0f-4343-b3c4-83ee1290733c", "comment": "Malware payload (AveMariaRAT)", "value": "9c67c0c1497538e6834027b2aa6e057d67888f240441a17192d149715f0e8dc9", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103240, "uuid": "3fdf4376-cb66-4ad0-9920-999dc5e36e87", "comment": "Malware payload (AveMariaRAT)", "value": "422b2d752501f38d3ea3669bc5c9e2e355b2c403", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103240, "uuid": "413b4129-4a91-45a6-8c6e-19eb2e8ad4b4", "comment": "Malware payload (AveMariaRAT)", "value": "084367e29e0b1ca5a4100bd7a67925ef13d009a7eb6fb362be163080e7c647c2f8a7291fd763b9903cb3010f12a1744c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103240, "uuid": "199f3741-fec8-4cc6-a97c-2344c4d33b82", "value": "T1AEC3A711638487E6E61A12B8DC6060FF0A6E2CFDD913EE3658B8F6C8D9777533241792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103240, "uuid": "3f974243-5537-4236-be12-f6f20058fb17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103240, "uuid": "fe085e6c-7c71-4459-a799-bd32fcf01ea6", "value": "1536:/m2dhjglfmlU/+a1T6uYR54XchGstFttDtt5U4d5scmb:/m2dh0ala1T6RRyXhstFttDtw4A9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103240, "uuid": "2709507a-b0c2-4941-bbb2-68035d25d6e3", "value": 125440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103240, "uuid": "752188ef-c558-43ba-bd8c-fc8e440f85d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103240, "uuid": "a3b482dd-3ba7-46d3-bd56-837564d675cf", "value": "DHLAWB08142311.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb4014f5-3b70-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692106612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106612, "uuid": "da7c7199-c0ee-461e-a149-cc3e37afd005", "comment": "Malware payload", "value": "d145f48fd8e6c6376503363a2a02924b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106612, "uuid": "afbfc2f1-8448-4c9a-9f3c-903a03f32438", "comment": "Malware payload", "value": "9ce295317b4ec0cf8d6f9b7cb6b422c64d641a587e941e0521fba5a51fd2aff1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106612, "uuid": "83cfdaea-e744-4f20-8c4e-bedfd2410dce", "comment": "Malware payload", "value": "3b2d417965faca7ebc1d223bdc49812b23f91903", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106612, "uuid": "8a1d0a0e-8402-49b0-a5e9-f92a7f80ef7c", "comment": "Malware payload", "value": "b977ed4f6a543439235306e33486ce59efcee1243e32523fe480c62775b853dc19754ff0c1f3239e485e53ee8c62c567", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106612, "uuid": "aaf7c74a-dbdc-4e4f-85a1-f8ac9cae4667", "value": "T132425B33964708ABDF155EBB4DA7084D06E88003531924ABE759858E6F79383FD875B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106612, "uuid": "62afa329-6319-49a3-981e-11cb7b94cb7d", "value": "f010843a52db470e0d3050e7610f589f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106612, "uuid": "4bf30962-1d36-4b1a-832a-6979939c17db", "value": "192:ebrJY1Vp1VlAcUJb47plPvvFRAfFrqHxFODAlEUVLp:ebsZrvnFoFrqHuDAiUVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692106612, "uuid": "d730e3b0-3290-4c8e-acd1-c49c6fe03a64", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692106612, "uuid": "9bfd1fac-a350-4428-84fd-baf40f4713ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106612, "uuid": "e35b2862-01be-4377-b718-fa6419e5fa06", "value": "SecuriteInfo.com.Win32.MalwareX-gen.18563.27182", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc8153ee-3b7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692110990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110990, "uuid": "8186a43b-1423-4dc4-a8dc-ecc079329c9a", "comment": "Malware payload", "value": "2f014f314b111025e36ce217075c2942", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110990, "uuid": "730c7f5d-39a4-4fbb-9b9d-28cec2e180a1", "comment": "Malware payload", "value": "9d6049ead951b9e02b064d43c8faacc2b8b5bd279ab538786a0af418722b8332", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110990, "uuid": "e585a77a-b034-414c-9987-bd297f79da7d", "comment": "Malware payload", "value": "3ba55e13568c02a858071087e9ebc55cb44567c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110990, "uuid": "87f82bca-c445-4c52-80f1-ae49f8ecfb19", "comment": "Malware payload", "value": "ae274c6e36298134138c220c411b4872211fbe8bb118df210ac4ecaeb88ede278a499a20550bda73a9285c8688f90609", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110990, "uuid": "ae0154fb-fca1-415d-9173-719c5562c793", "value": "T166236D403BA8C136E2FD8BB5A9F3A2418679D2672D03C6596CC414EA1B13BC597136FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110990, "uuid": "da34e751-cfbd-4f29-9b61-d71ee63e3147", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110990, "uuid": "7c0efbcb-9d7f-44ae-baa4-4639a4d21940", "value": "768:k96mxUTILWCaS+DiRFBRkiY98Yb2geeOjlUkBcdnYvEgK/JvZVc6KN:k96AKWRKzbpt5AnkJvZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692110990, "uuid": "df527e0d-d74c-47f6-bcf8-8f97e7813d59", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692110990, "uuid": "8e5771a2-870e-4489-ad06-61742b128abe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110990, "uuid": "3c3bc068-fada-44f5-a590-617d75a94dc6", "value": "decode_6fda918c8a7ba6982a7080a5eff5f97ec6ec50bea55936e98179f3683aa2c6e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f43706-3b69-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692103347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103347, "uuid": "d9ef1a6e-18e7-4450-a09b-c788b6d03c12", "comment": "Malware payload (Loki)", "value": "255f19c4ccdc14e35b44074ffc8e5607", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103347, "uuid": "dea07227-69a7-46a3-a51d-6244dea71c2c", "comment": "Malware payload (Loki)", "value": "9ee5d34b5de79e79f492e962d73fb45d7eb63d6b5f146e29a1a27a7bcb6c9a14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103347, "uuid": "20f58d17-5986-4704-8ba0-96976adb6b5b", "comment": "Malware payload (Loki)", "value": "2a694b6ca0e8c00a09eab590a45964cc301a4b75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103347, "uuid": "0c4e32b3-9923-406f-9bc5-b4956f40ac50", "comment": "Malware payload (Loki)", "value": "e3cbe1add1ebc0196d3c29283a2d351be4c0334121a60d9ef4c838f2af548d2551b3122b34088e4e7d92acd6ce05edb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103347, "uuid": "e459f79c-7f00-4f61-a58a-bbd4ea3ceed3", "value": "T104A41253BBF95992E8BBD6FD25010829037814477A33E79C8488316E9FF5B490A60F6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103347, "uuid": "48f458aa-ef29-45c9-9c14-12d4f8e7f748", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103347, "uuid": "7f15573e-3959-40a9-a259-45c6f98b99be", "value": "12288:KPV/OR9skrZfEgQq02Bs8RgIrQrDT1l+B/JMdWf8QT:/3vr2202+82I8rtaBM4f8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103347, "uuid": "ce1a9231-753c-47f4-a1c0-a73e259c14b3", "value": 456704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103347, "uuid": "8bbf8e6a-810a-4fcb-a5eb-1163c12409a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103347, "uuid": "7979f584-a110-44e9-9a46-19bbb022137a", "value": "FedEx_AWB#725323201643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97ab6a5-3b65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692101938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101938, "uuid": "9396c37b-f069-4d37-9b0d-a6bb51dc8d52", "comment": "Malware payload (Formbook)", "value": "98b7b8a94153f878a19cb1fac819f1e2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101938, "uuid": "8bd35928-7b14-4601-adc8-143ddf525473", "comment": "Malware payload (Formbook)", "value": "9fd10c4a58254ab2ff5a283544cbfb066d824a1f661e303ee52d14650927d3b5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101938, "uuid": "af19a72f-9335-4ffc-9aac-0b373071b81e", "comment": "Malware payload (Formbook)", "value": "b78062f1000a59b89ba789aa702dd52809b2c7b2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101938, "uuid": "fc52d691-7ab3-4684-8e61-7edc53139264", "comment": "Malware payload (Formbook)", "value": "025523bcf71afae85f4af84bd09b6e25517d7b67e6c8c74638fa56f093bd7ea2c56a990b560dc58daba78e5316081a81", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101938, "uuid": "730f08b3-defd-4b1f-ab7d-528ffbe437cb", "value": "T1ED2423B78A1226C9FA70734B1497E5D809F2C073E1A0656B76D20F7E57C6A438DBF902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101938, "uuid": "2b090363-5c00-4a8c-a6b3-2439b44198f9", "value": "3072:eZsI2xBfAO4zAWYe2GhnsZQMhA1kUSRBLhCBIYhM8f0VlpuM2Jh9joTpoR:eBmJ48WYahsxPWRhbfI/i3oCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692101938, "uuid": "3122459a-7ea8-416c-a25b-0c5eda8261a6", "value": 227060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692101938, "uuid": "0a74c73e-6a70-4c9a-aaa5-18e486e85418", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101938, "uuid": "457a69c7-e3f3-443f-a43a-999dd9ffee99", "value": "Mt103_005308723.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d819ad4a-3b81-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692113935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692113935, "uuid": "e78694aa-1532-4120-93e3-0c114eee8d59", "comment": "Malware payload", "value": "64870ba5b0e92b05dc383959e02782ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692113935, "uuid": "c2662d06-b518-4082-a05b-161a97078d31", "comment": "Malware payload", "value": "a0c810baccbd3943748568d16e5b9cdf6b829364c8e4b21cda09c4f865b228f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692113935, "uuid": "6dd8798c-8763-4b13-b7b2-56c21338671f", "comment": "Malware payload", "value": "167e866c71e4cbcc12c2d24d49c7b89e8cfb1b99", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692113935, "uuid": "fa71c9e3-aa19-420c-9f9f-22e2079b84ac", "comment": "Malware payload", "value": "7c32afee964617d8db812d81c3f4d6bf034937b6f94754e14fb29d336ec422decf563df61e1c129fc30099f628d9d050", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692113935, "uuid": "dcc12430-82a9-4141-8fc7-777332af6130", "value": "T1D115EC2839AA5109F2729E755FFC75B1905EF6F226724C2F19F7030A22529F0CB9C53A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692113935, "uuid": "bf276281-275f-40a5-b9e4-bfd119eca888", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692113935, "uuid": "775dc0ce-7b46-465e-9be6-364b925b0521", "value": "12288:QwNK+LSjMM6I7EjObh43pwlPdO/6jd923a79GNBkrRL74K73c5VDwM:CRjB7a/s23CkAgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692113935, "uuid": "38ba75b8-d7d8-45c7-badc-a436792d10c1", "value": 940544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692113935, "uuid": "56ef0cbb-901c-4e84-8f5e-76166f1723a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692113935, "uuid": "548f1205-3e97-4e55-84ac-77e97cc059a9", "value": "64870ba5b0e92b05dc383959e02782ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed5f419-3b34-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692080607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692080607, "uuid": "03ab3b89-10d5-4236-b0a5-520d3b8df945", "comment": "Malware payload (AgentTesla)", "value": "05f4fe6d881402ac43a3f83687ab9275", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692080607, "uuid": "673c452e-5692-48ba-b0b6-a08b3b8a96fa", "comment": "Malware payload (AgentTesla)", "value": "a1b22bb99dfebf6b3fc3fa288b770d64120cb17e0c9d904aac2f8a813b47e579", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692080607, "uuid": "46fe3aba-b239-403f-9342-b364d9b1b9b3", "comment": "Malware payload (AgentTesla)", "value": "134d35ff519c13a010ebfe59e71de4feea467849", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692080607, "uuid": "a44bffae-7bb1-4dcb-9bbf-9d5d30791d47", "comment": "Malware payload (AgentTesla)", "value": "f49c53a7f41701104744f3a361a82855b171c5c4aebc2957dbfaa795be5d33e32f503c2962e56a59810956300666cd43", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692080607, "uuid": "c611eafb-a159-4b2b-b67f-4ea3633cb3e1", "value": "T1CFD423B5B0E44F22C8B9A6F324615DA6033C3A7F2852F7EC0F8D148D5BC63496559E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692080607, "uuid": "0db801bd-2a39-4783-9c64-12a60d771fb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692080607, "uuid": "8538dc39-7398-4a24-ad48-a42a37d7cee3", "value": "12288:kPV/OY2hlWdRNpcExYX9TFddfxUchGi7vCUOS4JtU+lV:dplaPc/9FGMvCUO9td", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692080607, "uuid": "be22f830-4272-4075-8fca-29ce1a05f145", "value": 613376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692080607, "uuid": "19f244e8-60a4-4450-801b-2a0aa8224dec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692080607, "uuid": "8319895a-9f33-4945-8554-d1516598f857", "value": "FedEx_AWB#502573274643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "588709b2-3bc4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692142497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142497, "uuid": "8bd4b7c7-57c5-48ea-9729-f8c0528823d9", "comment": "Malware payload (Mirai)", "value": "40b376c3bc280468cfc074385ea6e4e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142497, "uuid": "9b1f012d-999a-4a96-ad2d-63a0901d806b", "comment": "Malware payload (Mirai)", "value": "a24093cc963c0b331147f13181d12083341b1ff74fc8608199367714c12284fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142497, "uuid": "e6493652-73cf-453f-997e-421b62a45b1c", "comment": "Malware payload (Mirai)", "value": "82ebe98d9517c40402e155a81fec8bf6dc07a3db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142497, "uuid": "da4542ed-e3e2-4e29-a2fd-139540cf3f82", "comment": "Malware payload (Mirai)", "value": "dbe49f04302a6f1e6cf48687d84872e323e4e65f2404a6fff70bfe20e437facb2d4ae122c7dae3545fdf0101d0a86e26", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692142497, "uuid": "38869150-6d14-4ee7-bc94-0335e21fe75e", "value": "T1F1C32A06B31C0A47D2632EF03A3F6BD193EF9AC121E4F640356FAA8A91B1D325545DDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692142497, "uuid": "c6e54ebc-7636-4d44-8412-f708561307a0", "value": "1536:a+cInXFmmDXsiQiixp5vTZN0E+bfpgpLbMX0xvALI9eR2WpnfqNH8pkIf3k2rr:AInXRwiixn7ZtwgVbMPLnuIf3kcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692142497, "uuid": "3a19005e-4d0c-48c9-8138-1a4a5f63b454", "value": 129912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692142497, "uuid": "cd073782-f3df-40ac-b11d-6828fc854b76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692142497, "uuid": "ff532819-838c-42d9-96fb-83822b9f9518", "value": "40b376c3bc280468cfc074385ea6e4e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec15ee76-3b33-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692080468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692080468, "uuid": "0167894a-d97d-4be9-b44d-1e0dfe04bb2e", "comment": "Malware payload (AgentTesla)", "value": "73bfcb84e1d3dfe1e5e2b5f95707b8ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692080468, "uuid": "387bda8f-a1a7-45ee-a3cd-478f5fdd7ce6", "comment": "Malware payload (AgentTesla)", "value": "a262d4da37d4c081ad7be55b568f89de0dedff46ed1aeaf6f1e44dcae305c24a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692080468, "uuid": "d9c80e05-da4b-4733-9eae-6f1d9cf22e61", "comment": "Malware payload (AgentTesla)", "value": "32c64bd270fb95b95ce3cea400cfdd1a13383de0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692080468, "uuid": "7eb18341-2603-41c0-8ecf-29c7732f2d64", "comment": "Malware payload (AgentTesla)", "value": "ca12a9c75c8b0ac3fbf6739f3a597d755906cbfb7da54de657bfca6b335755df3a5f71eafb87f7db3dadcfa3de57a961", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692080468, "uuid": "a328ddf8-d274-4ab0-9176-47a69a21b639", "value": "T1DD15E60059750092EF3E267D1A63573DB8BC1D53A1F2C5E96B2726D38DD3012CEA8BE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692080468, "uuid": "a5deb4ff-ae56-4e11-b4e4-6beaf17eb810", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692080468, "uuid": "a3eb2781-48a3-4007-b288-b4dac6cc93e7", "value": "24576:fJ0ayrPIrpppXpppppCOopppXpppppCOtwmdjnyZ0AIyZWIblxqv:GfI2O/OndDyZpI0by", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692080468, "uuid": "1fd60ee6-5a38-48e5-b8d9-30b07fa372fc", "value": 909824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692080468, "uuid": "bb2a4b6d-35c5-4db4-9a8a-62f50e87b08d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692080468, "uuid": "b5eb6c09-575b-49dc-8482-bd455bffde2d", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32269546-3b4b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1692090464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692090464, "uuid": "7fedc2c7-0b06-4492-ae6a-76979eafc83e", "comment": "Malware payload (IRATA)", "value": "56dac53199a24ad9de59ae15f3180dc4", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692090464, "uuid": "cfa91499-267a-41e7-af6a-f0d51fe74d7b", "comment": "Malware payload (IRATA)", "value": "a3094acaadd484c6bf7d3117879dd832a6c9008cda4f6bf5c23b81a296c83532", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692090464, "uuid": "85826288-6af1-4dc3-9b1d-6cdb102475d8", "comment": "Malware payload (IRATA)", "value": "9ffa2515569da49df67fe8fd8f1dd4604d35ea43", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692090464, "uuid": "55ba4619-194b-4473-b15c-b737abc73486", "comment": "Malware payload (IRATA)", "value": "c5421ca5f829ce7d541bdea8cbc5819f0498d160bdc23506c906c1ae45172c9b11776cd81f0aa85a73673c2b158be814", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692090464, "uuid": "332086af-06b1-431a-9359-459f602dfa41", "value": "T108852392FB84C887DBFBAE735866428444371D22C9C346573952F33DB4B37CA974A688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692090464, "uuid": "f6c1ece2-a258-4897-a2da-ac02a0d86ef0", "value": "24576:9NfgQSDkuW1YfxrHqn0PfGS9ilZ2rCJHjnJLZ9unnmJT1vtLUm5LFYdUOLOsC:9ZKPd+0JibzjJtUnnmJ5vtQm5mUwLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692090464, "uuid": "2697287d-ae5f-4978-b463-6909b6866d73", "value": 1839239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692090464, "uuid": "dccafd14-6350-42ae-a470-76b0c3423b59", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692090464, "uuid": "41c62f8c-a8af-4f1b-85e4-6531bbaf80e5", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed140b52-3b65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692101945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101945, "uuid": "d3885d2e-620d-4955-a9d1-6714bc9d972d", "comment": "Malware payload (Formbook)", "value": "feb7bea27622adb8cc4940f73b66720c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101945, "uuid": "9356823b-e6a6-4764-81ca-c9f081902140", "comment": "Malware payload (Formbook)", "value": "a318197c6b7d13969ec28187327e1005ac7d39f969ef27b81f7967870e896378", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101945, "uuid": "dba05bfa-74d4-48fe-9b56-bc622a454fb9", "comment": "Malware payload (Formbook)", "value": "b3417938466e3e08f5e2a3a09ce18060fee71d77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101945, "uuid": "4a658ccc-2a80-4b70-9964-b3a6ef5b2a6f", "comment": "Malware payload (Formbook)", "value": "b80e4f27e37af5044e3b338e190fee3713469f03231f564e24976b7908dceed9cb1b49304d825b967a57a9428ded0988", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101945, "uuid": "bc6064ea-e7d6-4271-84c1-1a21adb169e3", "value": "T17C3412507AE4C4B7E8F307B21B7A579F5EFBE425A430172B27409B1A78B2593C90BB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101945, "uuid": "63e952e9-dd5a-4d85-9970-f6661218808c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101945, "uuid": "6acbc59d-7afd-4d73-a3ee-c7bf446d1e0a", "value": "3072:HfY/TU9fE9PEtuObqkhMgKTVbIvinptPSuXlVopVhk4VvFmfUo7hz7d2QjQt6PBI:/Ya62qCMQYptxGVhkkmfJ578YQt6tcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692101945, "uuid": "80177ffb-dd76-4488-99b5-51407e394b4a", "value": 242983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692101945, "uuid": "38cc4466-3a27-4bd3-9577-0cecaab6e14c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101945, "uuid": "ea4bd6bf-6916-4ccc-b5ca-32edd23df5e1", "value": "Mt103_005308723.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f319b02-3b6a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1692103908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103908, "uuid": "3f3f82a2-e467-4ef4-a2bd-e0a9287e4044", "comment": "Malware payload (ArkeiStealer)", "value": "6076ec9fc98856b3b627751f92843a35", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103908, "uuid": "4e3ade46-03ee-408d-b6f4-713baa091099", "comment": "Malware payload (ArkeiStealer)", "value": "a3ec2956fea5d99ce309b2b2209dc4dbcbf5330482ebbe46a754eb8c0885a209", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103908, "uuid": "353e679d-a105-4973-ae21-d2bbe714ceea", "comment": "Malware payload (ArkeiStealer)", "value": "5520b12ee2f8d39d6c8def16c7d472d08d43ec65", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103908, "uuid": "22541241-c6d6-4776-a6b5-6cabef3ad1d6", "comment": "Malware payload (ArkeiStealer)", "value": "d722eaf94ce51139411ebca0b0e970d53c1d7681af603fa4fbd530d79249fd874a1c9ff508d6cdc0287906b41c979eec", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103908, "uuid": "7a050a7d-b4cb-44c1-8ce1-02bd996f1a50", "value": "T15584BF13B3E07C23E5228A729E2EC2F4671DF9254E6D675A522B9F2F0BB01E1C163751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103908, "uuid": "2a847295-7bf7-4446-8548-c3ac4fcd891f", "value": "e22d1ddd8438f247ac07b74fc5ce87b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103908, "uuid": "d44f5659-fb1e-4001-88ab-f939ad858d9c", "value": "6144:P2D2TuXOIXT2/1WWoO0wWqi+/yHAnZlYuYBdAcDTXaAKOj+3z:i2aeIXS/1dVrdyHyYDBfDTXiBj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103908, "uuid": "e7dd64d0-81d6-480c-8ba1-5e5977e87094", "value": 384000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103908, "uuid": "8a9e91c6-8967-4dfd-87da-a5e4997669bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103908, "uuid": "fd93f324-0c93-4b7a-9469-bb8e01e090fd", "value": "6076ec9fc98856b3b627751f92843a35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d934a81c-3b33-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692080436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692080436, "uuid": "89cf98ca-9bf5-44d4-82d4-5c7ef82d250c", "comment": "Malware payload (AgentTesla)", "value": "d66a5d0513fe5493199620ca07c310b7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692080436, "uuid": "f5a1b1c6-386c-4841-affb-795310f5de77", "comment": "Malware payload (AgentTesla)", "value": "a424dfa7f8731a0a35e55a2686449c25e7924b52a8aba562009458545195c7bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692080436, "uuid": "a1169a35-591b-41a4-9881-24a19157ffa5", "comment": "Malware payload (AgentTesla)", "value": "429b9aca4a2a18770a5c43963ba473756a344294", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692080436, "uuid": "25a0fb39-a34e-40f1-97dd-87212543f6de", "comment": "Malware payload (AgentTesla)", "value": "e115da127dd06de7ae7da31d0fae710041cf8852e1186cab5bc4a356d3a1036fdc9b4f4932550cf2f49425fde8fc07fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692080436, "uuid": "d0f38da4-d800-46d8-80e7-5262b460026c", "value": "T1F415E60059750092EF3E227D1A63573DB9BC1D53A1F2C5E96B2726D38DD3012CEA8BE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692080436, "uuid": "94aa0eda-ba79-4a25-9588-b5063533a07b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692080436, "uuid": "233cc858-f43f-43a1-824f-3a1b00b73b1a", "value": "24576:0vr4hmPI35pppXpppppCOopppXpppppCOgU2yAgM0XnDcGkdzxqv:GrI8O/OgU2Hr0T48", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692080436, "uuid": "2e0e8642-30ae-44b8-a175-cd76abf60ed4", "value": 935936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692080436, "uuid": "59f93826-bf60-4683-907a-ba1a5b18daa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692080436, "uuid": "a2d9edc8-2f90-4c49-96b8-2d3c158a45ad", "value": "scanned image.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a0a628-3b5a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692097159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097159, "uuid": "3e5b1328-5f1b-4b80-a7e5-f0655488a602", "comment": "Malware payload (Mirai)", "value": "769160ba39c89a4b323ae27e5e5244e6", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097159, "uuid": "549c2840-7576-4843-b696-59ad266635bb", "comment": "Malware payload (Mirai)", "value": "a44ccb36656c34f353ceed0bba4fabe49e163f894fc67eab702ddb23c2022be5", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097159, "uuid": "39675cca-7f11-4c88-b858-2254a78a6083", "comment": "Malware payload (Mirai)", "value": "02c750b6598a76d99a3cada6d6ad6c4fc5c06741", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097159, "uuid": "d731f6b8-0f7c-4a46-acae-bac5285c1584", "comment": "Malware payload (Mirai)", "value": "5db3a0963d10c9e0ec1eef44ea90177b7def62600c47888e95a9570af95ab62dfbacb223b9d1bea4737f953849344ecb", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692097159, "uuid": "18d1deb1-cf63-4ba7-9ddc-c482f4045b63", "value": "T1B2934A17B653C6BAC0874BF41BDB9A314923B8BD0B227206B3D4BCE67F165A61D19F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692097159, "uuid": "25ba0a10-3db0-4daa-b648-26b91e971ae3", "value": "1536:p7rHXokXsWFVSzkfLEkZAT5ipG5v3dphauH/SPNlDDUg6I9um2Xj5YZb0e:pcCPOkfQfNipGddphaE/AVog99um2XFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692097159, "uuid": "c869a16d-1366-4bba-b07c-63e4b13b4afc", "value": 94012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692097159, "uuid": "d374c354-3fd6-453a-89f5-4022ee383b42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692097159, "uuid": "07feed38-6701-4b71-9145-d3f3f374f845", "value": "769160ba39c89a4b323ae27e5e5244e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c47fda04-3b6d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1692105312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692105312, "uuid": "cc2e79a0-a51f-4a48-af1b-37d47be67423", "comment": "Malware payload (SnakeKeylogger)", "value": "f53abff112e4815172a625412373766e", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692105312, "uuid": "9720cdec-dd8c-471d-ac73-65b0ef46a1d7", "comment": "Malware payload (SnakeKeylogger)", "value": "a4fcdd5549a817c092ad654eaecc56aef805d35211a3fb9307711ad05ed9ab83", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692105312, "uuid": "5a36b4fe-d9a6-4237-aa4a-cf3ac8419ee1", "comment": "Malware payload (SnakeKeylogger)", "value": "8ba76b3cd3b686619cf07c6ccbd87c31e2e8f938", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692105312, "uuid": "588e5881-94a2-4145-93cf-7f8c0130958d", "comment": "Malware payload (SnakeKeylogger)", "value": "52429f15c451f3cb62ceb56c2e2e934e4e4588478559cf238b240fda1ef2debf2d22509359c1fcaaacd120e18a6a812a", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692105312, "uuid": "8eb39464-9104-42d8-a36c-007f4c55d02f", "value": "T1F405330920285DE8BB2FB5CE59A8EB0D4CA6BE475782160F455D9049360EB32FBFC43D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692105312, "uuid": "2069df27-82b9-41a8-9fec-0a86bf6fd155", "value": "24576:zuY8cJUO5f29UP/D4idauUpyRoAyoJACVo5LIkkmS7:a7O5f29UPb4iguUpuHyeADxYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692105312, "uuid": "e6b8ded1-804e-409b-a708-8cd27334c8a9", "value": 855828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692105312, "uuid": "c0cc687e-f260-4824-acb7-d8e2cf6d875c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692105312, "uuid": "e82fe5e3-8eab-4fbb-8036-7a82b37041bc", "value": "NEW ORDER_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a05c56-3b7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1692110977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110977, "uuid": "dae14a2f-668f-4306-9c47-b9d5d941aa44", "comment": "Malware payload (RemcosRAT)", "value": "3ea3807fdf3c3efd6c51bc387c8f0939", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110977, "uuid": "d174998b-0a70-4f13-87aa-330fd453f665", "comment": "Malware payload (RemcosRAT)", "value": "a5b799a913cf8d77a3486c6e6a2bdc1ee89a512102ed7eecfde842e7648ba93f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110977, "uuid": "ae28f64b-76fa-496e-83e1-942327231bef", "comment": "Malware payload (RemcosRAT)", "value": "4daafce94292b16a89239eea39d49c12b99494a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110977, "uuid": "80674768-d929-4c65-b0ff-5ca067740e7c", "comment": "Malware payload (RemcosRAT)", "value": "a182596bbfa03b8ece2683c7697d33c1dbe9a22e59b1f837736e8544df63e18feff1c9c5cd2eb95d758173cff032804b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110977, "uuid": "0a4162ac-159c-4a41-9d49-ef3b183947df", "value": "T1E0A4BF02BAC1C072D57651300D2AF775DAF9BC20193A457BB3DA1D9BFD70190B63AAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110977, "uuid": "0197afe5-72ac-4306-a25c-dc6366653309", "value": "04d77d421b8e5297898a3fce39d74267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110977, "uuid": "f7f63308-afeb-472e-88c0-8ca29d1e2a11", "value": "12288:hRXxReZj3WZfj/2eSseWFaIe2+f8CL47bs/ZO2gDU:hx7cyF2eSsewS8W47eZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692110977, "uuid": "e5aa3cbd-8cf8-40c4-b413-339d2b08e754", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692110977, "uuid": "40fd4f35-20aa-4287-91bb-a76056792741", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110977, "uuid": "577cf9c6-8d20-48d6-adce-6896b58f8c18", "value": "decode_3d96c9d849d93585c464cce3f9f6b70cfff658687999d667eb8822db87b79b3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84338c79-3b17-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692068268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692068268, "uuid": "6ae11b34-3821-4702-89dc-b63903387341", "comment": "Malware payload (RedLineStealer)", "value": "5fb59ec46fd6a15ac0856e37fe226573", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692068268, "uuid": "5e9816a1-0be7-41cb-9beb-44756254e4e5", "comment": "Malware payload (RedLineStealer)", "value": "a77aeb964d6d999e14963b578325f37c7b951da9d67af592ae833a42858649df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692068268, "uuid": "588a4267-8f6c-4324-b5d9-ea3435116164", "comment": "Malware payload (RedLineStealer)", "value": "eee55c1d7f2108fff02d44b33343cd2aad989847", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692068268, "uuid": "f6430228-0f40-4838-8a57-eb61406443f3", "comment": "Malware payload (RedLineStealer)", "value": "0fa1c59313a1f32562baf99b7a66e0bdf77d47c804feeb67c0959f42599883d630250e070fb4c3a28f2692677c7a2ed2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692068268, "uuid": "847901a0-0204-47c4-b32c-c81941ea558a", "value": "T17804C558364BA97EC86F487E9C600CD4777CAC631246A707998EF0E83A3B7819F151F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692068268, "uuid": "d18fa54b-190a-4b27-9505-27e09a7190aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692068268, "uuid": "1a903112-514a-42fd-8d29-d4c832e692fc", "value": "3072:gfvQpQcTI0OAbvyO70RJy7oAE0CA9JlOJd8e8hy:gfvqTI0OAbvWAE0flOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692068268, "uuid": "9e6bde9f-297d-4910-a5d1-f2fed6be05e4", "value": 178176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692068268, "uuid": "73c74059-5363-4e52-a4a1-f16873a273f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692068268, "uuid": "77800eb3-dce1-431b-8a03-8ffa3e604665", "value": "5fb59ec46fd6a15ac0856e37fe226573", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b8f1502-3bc2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1692141617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692141617, "uuid": "43cf1d71-04cb-4e7c-af9d-a87cef623d16", "comment": "Malware payload (njrat)", "value": "11d49dd9407654efd37f016694461dfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692141617, "uuid": "115c59d6-7977-47e7-a927-3fff9b76b0e6", "comment": "Malware payload (njrat)", "value": "a77d89af9f2b35acf31f220c08293373fb7670ae463d114dd9aa0ba76d040d96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692141617, "uuid": "918e7cc1-98ca-44a6-82de-8f86e2bbc356", "comment": "Malware payload (njrat)", "value": "55f385dde7de9eb303a6ad158a6150d1322da736", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692141617, "uuid": "e4fb1f71-91d1-4449-8dd7-551075bb0c83", "comment": "Malware payload (njrat)", "value": "f2fca3ee60baac883fe5ec32e6cb184af26139d38811e5fa2ffebe75a8d42f58aff6b2b4042ac00ca520318883fe8c25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692141617, "uuid": "300c9171-8741-4823-961e-74c1a6570ef9", "value": "T18B93D74977E92524E1BF56F75471F2004F38B58B1602E39D48F259AA0A33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692141617, "uuid": "8690b179-4c5a-47dc-a3ad-91e5723c813f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692141617, "uuid": "9918403a-ca08-44d2-ab87-5955304b654f", "value": "768:PY3IcRhpC0EoQspgnOmWNW6tsX2JADll2gSXxrjEtCdnl2pi1Rz4Rk3wsGdp/gS7:9cHpVEoKOmWM6sdl4jEwzGi1dDID/gS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692141617, "uuid": "9f5def92-00bc-4a97-a93a-e23433bd7a59", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692141617, "uuid": "d8c2484c-357a-4e24-a9ed-ebb091b4e905", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692141617, "uuid": "9edc895d-41bf-4607-bf21-e4fac4947931", "value": "11d49dd9407654efd37f016694461dfc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d9b0df-3b9d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692125749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692125749, "uuid": "85ee46fd-cd82-48a6-8602-a229aa67190e", "comment": "Malware payload", "value": "d27b11d2a13cc266b07d150ebfce01a9", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692125749, "uuid": "4b49f729-5025-432e-a99d-a2376849006f", "comment": "Malware payload", "value": "a8a4bf8d047a131a24c1c9e5c78dab5fe2f56dce030c68aa2b31e3252109c90b", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692125749, "uuid": "b9cfa4f3-a41a-4ea2-a78a-abeaa58cb00e", "comment": "Malware payload", "value": "9648f9572f89528b030d138d2f5226d58983a852", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692125749, "uuid": "29b7a0bc-e725-4346-8656-b05000f191c8", "comment": "Malware payload", "value": "ccebcd7610f2c4dd541e27cbac6133c68e43360b580972c4fce463daa733a12a3a2be98f80c2b704024c2f5c5dad4fbd", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692125749, "uuid": "4ce24cb6-0c4d-4aab-aa9a-8e49afff1ec6", "value": "T18632030129EB10D8B2B35B446FFCB8BB4A67F861693DB6BD1140494D0BF1E84D862F76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692125749, "uuid": "e8dbd30a-0eba-49f8-9660-f35088e5ee8c", "value": "192:QWYF1FLtIA5RdsFTPFiyTgTcONVbgslMAMVZSqcJc9JXX4wDJXkcN946DSgwkexY:rYFfL/5qFiTcMJgk50YqcJcbnF10cNMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692125749, "uuid": "305c793a-06dc-45bf-979a-006982b2923a", "value": 11002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692125749, "uuid": "81b5fdda-4cc4-48f3-9baa-dc2ab0841d82", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692125749, "uuid": "278e28cc-5ddd-432b-b35b-2994bb99cb59", "value": "scrFE4.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a5ea574-3b0e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692064252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692064252, "uuid": "cb6f6204-4539-4814-9b17-4abd69f88d4a", "comment": "Malware payload", "value": "0fa6f038f3ce8323e1a44afb42268b5c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692064252, "uuid": "04d953b1-d8e5-4e76-a942-e1ab12624bbd", "comment": "Malware payload", "value": "a9147f641d3a8799e51f2b5164e2a481b2c2b0ef4baae28edbbcc7f7b7536d13", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692064252, "uuid": "a09c76a4-61a1-46b5-929f-2dc1b4841ff5", "comment": "Malware payload", "value": "ba4026109b7e4007de3445af4a72361be8585874", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692064252, "uuid": "6c4eef79-ab8e-458c-9757-64b8910d50d9", "comment": "Malware payload", "value": "6d3101067daf3a31e7e23b1aa1dec96267250fb9f70d1d50c7f260f3fe774b8f1756c56a6a2aefff9ddca5173cca3931", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692064252, "uuid": "14fc3ea2-89d2-47f3-a91d-5b702fc2134d", "value": "T10286029BF718A82FC87B14F2196E523122574D168E93DB436D48331C297B6D82F9DBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692064252, "uuid": "74b27e95-dff9-4143-94aa-62e902c404e5", "value": "196608:tJj7cln/1tYoym9N8wOAOlhw6FiAy2m0oQg7Yv9/:tK9tYoH9N1QbMAhBE7Yv9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692064252, "uuid": "eaac9a9e-c5cc-4b40-8f5a-2a35c1a71586", "value": 8445398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692064252, "uuid": "eb4250a0-e121-4d19-ac4b-143452c35bc9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692064252, "uuid": "33b8e3be-10db-4c6d-a476-2ede8a532182", "value": "aplicativo.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f088ce2-3b99-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692124067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692124067, "uuid": "b23f7b45-9789-4396-bbaa-a559a69718f9", "comment": "Malware payload", "value": "95487c9ce8e5adecc11910ed661995d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692124067, "uuid": "07afa888-6130-4946-bd1a-3207907b37c5", "comment": "Malware payload", "value": "a92fe96c9cd0b0f376503785e0de8b9bfab1a9b911bccc5e27d0bdd540b68c69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692124067, "uuid": "bcc99d16-eb52-43a4-9768-666c660d5f18", "comment": "Malware payload", "value": "9afa9c8c84c650a7286124aa4a6dc8cedccfe9ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692124067, "uuid": "e72be5f7-4821-4441-8ced-55f7676b229a", "comment": "Malware payload", "value": "ef96a39f8754c1a928ee0d06976e15712e006633df1c0dc0153f881c229e5cb577f40401468f5aec4f705b76b92a1630", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692124067, "uuid": "a1b67598-00e8-4e25-8904-3cd344c4ebe6", "value": "T1BC556C48A2E9BF4AF79D3971C83B49108EB6DB261563F30F127F2655FC622A00B5B5C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692124067, "uuid": "96195715-4ef7-441c-bb05-e60d163455cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692124067, "uuid": "3093bee8-099b-4725-9fb5-f0421fd1d8b1", "value": "24576:yEAAo9/oKl+aZVcxtD7EifR7K8VUYJKVQN:9c1Zce8hEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692124067, "uuid": "802f1942-5672-4dd1-a903-6aa56244459d", "value": 1393664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692124067, "uuid": "8a2703bb-5edf-4718-a1b7-9a10f9bfd360", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692124067, "uuid": "852599fc-09a7-488c-a132-1c33b4f567f2", "value": "Exerciser.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eadcc01-3b69-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692103316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103316, "uuid": "756d7818-e4cf-403f-a04e-64739252d9ac", "comment": "Malware payload (AgentTesla)", "value": "ce464debf432c86d20143d0ac6a39810", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103316, "uuid": "6ef56aca-6244-4b80-852d-4d8906a23f00", "comment": "Malware payload (AgentTesla)", "value": "a99d3367f576374f2ecd4cb7d3c237442cf9b774b11435fb9af1642a74f738cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103316, "uuid": "e65daa7b-8634-4bd9-91ee-c5e695872d0d", "comment": "Malware payload (AgentTesla)", "value": "dcb158525d6f5898dd411a6162f91dac3f85a1f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103316, "uuid": "50ecca1d-836e-4028-9862-a7b690197393", "comment": "Malware payload (AgentTesla)", "value": "19863c94be374e52c1812e8105ef4aa7fff9dc6c7a2962d2dac671ce73c4b6b886baf68631e11c9a9569d63428772b8f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103316, "uuid": "1b3b6099-1dab-4082-b89f-23a102419ae8", "value": "T1ABD42354D0DAFBBDC6D4BC52845A1EBB2E647F02C551BD79F317A00903B8B8B4206A7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103316, "uuid": "4c992207-3fdc-4176-b4d9-5c9d66b90749", "value": "12288:yKnWj8TRVR2I19C5b13nscc7TuBbYbdBq1Bs5uEUy+JsbWb0KZ6yBK:nd3RpMblnHc7TuBEbdQyeIW7Z6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103316, "uuid": "348074ff-7edb-45fb-a098-86c737483374", "value": 623596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103316, "uuid": "79acc580-c10f-41e2-bb6c-5624f2fe75ea", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103316, "uuid": "3aa61c0e-1bfa-4a42-9e7a-376897ea4343", "value": "AP-07461_AP_0-7694.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ed33fc-3b71-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692107013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107013, "uuid": "70f65ca8-ebbc-4907-9c87-4ed3cf132a6d", "comment": "Malware payload (AgentTesla)", "value": "3ddf63698ae956fae31dc76788fa3692", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107013, "uuid": "2aa274bf-9533-4927-ae04-4c348dbca3ea", "comment": "Malware payload (AgentTesla)", "value": "a9f366a21a8cceb0582048e0e63c9888b7556a4358d6fe9552271eb12fca41c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107013, "uuid": "bd7c63cc-11ad-450d-9b5c-f0376a7070a2", "comment": "Malware payload (AgentTesla)", "value": "9df887ef475fb6ba20e4fd8f810185ef1cc25317", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107013, "uuid": "df037506-f425-4b28-856a-cb244b18fd43", "comment": "Malware payload (AgentTesla)", "value": "bc0ec9f56e067f9a6aef6922f8a8b3ba14213885a963f5f037164490d8235883bbb2824d386f9c086ae75b7829bbb643", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107013, "uuid": "fab85b2a-590c-46c0-b2c0-dbbcf47efdc9", "value": "T11D252925E77B6546EF29A6E85E2F847238D5DCC0F1B1C488ABE72C0385C23514E35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107013, "uuid": "c0cb34ac-632a-49a3-98ed-c82815b3c163", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107013, "uuid": "ac3cdf31-91b0-444f-810f-e62716c7c00e", "value": "24576:G1I1R1I1nRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUO1OguU7ZMR43Tw8:GGvGRRs6CE3jLbO9Rs6CE3jLbOrugZcS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692107013, "uuid": "cdaa423e-bcd3-455e-acae-e75760963de2", "value": 976384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692107013, "uuid": "22cf6c6b-0586-43b9-acb9-3dc14a7444d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107013, "uuid": "6dd3113b-b9e7-4859-a594-b73a347170e5", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "168e8348-3b7b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1692111034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111034, "uuid": "daf137f9-d61b-4993-89d9-99efcb6e60ff", "comment": "Malware payload (RemcosRAT)", "value": "576b4d3d9aad213f9e89c7354194bf78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111034, "uuid": "d5294a1b-8581-43b3-9650-d0b51284eccd", "comment": "Malware payload (RemcosRAT)", "value": "ac3a6ad13ede048573f561b04558c5b3e0e84a2a4af280b559794087018e369d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111034, "uuid": "f2be32bd-a9da-490c-8dc1-bea236e5272e", "comment": "Malware payload (RemcosRAT)", "value": "b4483a96a83eaaff671e35c8ad9494541b1f1819", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111034, "uuid": "21f94850-93c8-426e-94aa-ddcc460370e9", "comment": "Malware payload (RemcosRAT)", "value": "02daf75dafd7e06996c8fb54398d847d05c3334ddbf2aa5e3c4cddb38651ccf93adb5c270bb3059cfd0d49e57859405f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111034, "uuid": "d1576fc2-954e-4b99-a55e-dda6dda3df56", "value": "T1CFA4AF02BAC1C072D57651300D2AF775DAF9BD20183A457BB3DA1D9BFD70190B63AAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111034, "uuid": "fe168463-1ad2-432c-ab1c-21f2dc6ffc24", "value": "04d77d421b8e5297898a3fce39d74267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111034, "uuid": "f47d170d-fae1-4639-acbb-62fed2d551ae", "value": "12288:tRXxReZj3WZfj/2eSseWFaIe2+f8CL47bs/ZO2LDU:tx7cyF2eSsewS8W47eZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692111034, "uuid": "3f487069-bba8-449f-9e5d-9d19e3a572a3", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692111034, "uuid": "68b9933e-dda6-4334-8032-f8ec5216303f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111034, "uuid": "54adcbff-0555-495d-a278-fe114c3e515e", "value": "decode_f3932b52d30026ca8f7c14f62f77f596f809ac671466373b397038aa528e4d77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d08140-3b31-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkTortilla)", "timestamp": 1692079276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692079276, "uuid": "a8d4b00f-4df1-43e0-acdc-7ec7d214676a", "comment": "Malware payload (DarkTortilla)", "value": "e0de873cfd224e563201bb1f7c310b96", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692079276, "uuid": "f07bba17-a272-4976-9987-c8b9d2eb39f6", "comment": "Malware payload (DarkTortilla)", "value": "acba581f0c34cd415335c86268ed38a453df315f8cf878992f846c20bc8a1877", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692079276, "uuid": "b2b9b9a1-bf11-4682-822e-4f710fa6517c", "comment": "Malware payload (DarkTortilla)", "value": "d11e0bff97e66731d3a80855a1e33e42e65774ed", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692079276, "uuid": "a3a06d88-41fe-4cc7-bba4-579125d1c2c5", "comment": "Malware payload (DarkTortilla)", "value": "9dcefe26ed265006b305bc9cef3e45d79c490eff3dc077968367c29c5218fb1b7a340f211313ec170062d75f3cb395d2", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692079276, "uuid": "512f474d-7aab-4a68-878c-5646de422ec0", "value": "T1BA4623A1D38895E4D47A13BC18B36D3317B6BE6899A5D20E2CDE7D697E7334100A3D0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692079276, "uuid": "5eeb8494-c2dd-465c-9cf0-c1e7739ae05e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692079276, "uuid": "fd9e421a-0065-4b87-b251-ee31fef817bd", "value": "98304:W/q67ZtheZyrWIkgzsjGi5d0tXi5Fesr37+R:Gd75e0SIbzcGq+i54sDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692079276, "uuid": "614fb765-ef8d-454a-8dbd-2cf1ab2eff9b", "value": 5504512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692079276, "uuid": "f6667e68-35cf-43fe-966b-e4baefb0a7f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692079276, "uuid": "a50984bc-83c7-4f04-8a3a-33e25a3a9747", "value": "e0de873cfd224e563201bb1f7c310b96.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95b965f6-3b67-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692102657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102657, "uuid": "f1e871e7-9663-4cb6-bdc2-e5fd733c63ec", "comment": "Malware payload (Formbook)", "value": "013a719564fee962f64473767b1e8cd8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102657, "uuid": "ec87a5c6-31f5-4554-a703-5fbcadb1f1a5", "comment": "Malware payload (Formbook)", "value": "acdf8d88a30518cf72ff6b37e7610fa5774d657da25ff500e8a76390e56fe103", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102657, "uuid": "aaf9f7a2-69d5-4be2-90c7-062d822a69ca", "comment": "Malware payload (Formbook)", "value": "f6dbd86c580815a5546894a93e18853a23969b55", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102657, "uuid": "8ac7477b-e092-46ae-a7e8-3522a7a74a1c", "comment": "Malware payload (Formbook)", "value": "53f2f047df912fa1936c2701cf9947c57f69224974f0bb6547b69036dac5708deb0e69579a6598d459fbbc54bb5f108b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102657, "uuid": "fe329a45-c212-4793-a1fe-78dd5481e352", "value": "T1BEC41249F3FD3F16D5BBC3FA613085A803B5A8A726A1DB5D9CD160C61A34B211781F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102657, "uuid": "75ff49bb-26d4-4a03-92a7-ece4b7977211", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102657, "uuid": "13aadd4f-6365-42f4-a741-8173b9dcc38a", "value": "12288:9yxdV/OAf4UGK3Fh46Sv/HjrbxLH7gGfOYyRp0XIE:9y4c974DfhHCO4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692102657, "uuid": "e43a9499-4f03-4d8b-85d5-012454ad15f9", "value": 555520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692102657, "uuid": "8df1bb07-f74f-4a69-a23b-0815180219da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102657, "uuid": "49b56eba-ecfb-4fac-9a84-eee40fd930f2", "value": "013a719564fee962f64473767b1e8cd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb0fc73-3b3f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692085299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692085299, "uuid": "a01eb48e-cdf7-421b-9aae-0c0e23f5733f", "comment": "Malware payload (Formbook)", "value": "edd9db937caa5a68661dc1796968bdc3", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692085299, "uuid": "abff648b-1148-40d8-ad99-c35a968ba9fc", "comment": "Malware payload (Formbook)", "value": "aec0a12e22dc8e6a2ee6eb88f8ce7d17897a44c7c3f9b122e741dcaf2da3c73d", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692085299, "uuid": "1bbb9d4c-6b7f-4c7a-9cf1-6742acef7a8e", "comment": "Malware payload (Formbook)", "value": "3699d1e8d42e18cd40c81daf683fe9feb32e7331", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692085299, "uuid": "63725289-f011-40c2-a41c-3b2ffb0fbd80", "comment": "Malware payload (Formbook)", "value": "834a7d2948eeaeea302412cf9dead9a109f73b3fb407628c97af66962b714d3520bdd2006cdd0f70cb71a6a0933855d4", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692085299, "uuid": "0d761e12-a819-46bd-b92c-63efc85417d9", "value": "T182C423EBE54C1296E77C3A759434026EFEBDB91E3CC936291CBCA127DC94B3801E9841", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692085299, "uuid": "c2a87198-7d0c-455f-80b7-a4c43b91728e", "value": "12288:wxh1/mXtYy+Jwaliew4tnxxnRg+t+Qjbd+g:QwYy+5rHFbwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692085299, "uuid": "435242ef-c5d2-4e02-a447-870e574a311d", "value": 547202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692085299, "uuid": "cec78148-ba3e-491d-b532-8e529349bc1a", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692085299, "uuid": "3a49d2e0-dc22-4c4a-866f-6615210c4dba", "value": "DEVIS 23-1-1269 FANGET.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9062aa5b-3b65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1692101789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101789, "uuid": "3a16ca7b-345e-493c-95a7-9fca7e37cbc1", "comment": "Malware payload (RemcosRAT)", "value": "db11d7c5b08a08730892d9a8ea567147", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101789, "uuid": "7b97a25b-0bf2-4274-8747-c43584dca62b", "comment": "Malware payload (RemcosRAT)", "value": "af551138bc3952708e41adf9d4ec58556eb243e02730d720b893246bdb857234", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101789, "uuid": "4ca7dd22-7626-4e9d-b3a3-f586fc5d0c15", "comment": "Malware payload (RemcosRAT)", "value": "0bec4a323cdd70f9c3d7e3fba52b33698fd66409", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101789, "uuid": "f6512849-4a69-4c71-a22b-89963f2c7c79", "comment": "Malware payload (RemcosRAT)", "value": "0e8e7a2c926ab18f94d56e8be4a140ae7d7cdd837c6dfd5a30f6bbcf8b605847491c2a14fa513ad9bb8c7773099853f5", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101789, "uuid": "dbb16077-782b-420a-966e-ff37440ea15f", "value": "T1E6A423BBACEC09865D358F95D1E1FB34254470CF2DB847B649187698BF4C8709B4E0EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101789, "uuid": "6e052909-3bab-4133-8a13-f6bf5c1056e1", "value": "12288:R3ul9WNfs/+3mXzJ7VCQW7nrgaX3xXgkKqDJCvm:4lQE/+3K8QenMaX3mNyYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692101789, "uuid": "77cc627f-d5af-48b4-819e-73d201fea79b", "value": 474613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692101789, "uuid": "431f117a-a994-49cc-b6ce-15de26fab1f6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101789, "uuid": "a5ef9660-479d-4741-974c-f75962de9ce6", "value": "SEPA 2023-08-07 PDF_033293211002839277.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e470bd4c-3b57-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692095917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095917, "uuid": "bba2b6f6-1e9d-488c-bf78-2f9273641c2b", "comment": "Malware payload (Formbook)", "value": "d5c875d48395594a5f4a25ff59ccde28", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095917, "uuid": "31704a58-a653-4513-b321-c9622694a48b", "comment": "Malware payload (Formbook)", "value": "afa0e5ddccbe8110c99d9e4095c76f05ea618c26d5760d13aad456da2a2ebbaa", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095917, "uuid": "a91dd3f4-53f1-4b43-be0c-72b0d73b9142", "comment": "Malware payload (Formbook)", "value": "e0750716e3b086d692fb3075ea50bf958bbc0ccf", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095917, "uuid": "b891fc9d-4c34-4255-8d87-5bb619e3b5ff", "comment": "Malware payload (Formbook)", "value": "d64824d1c7532b22f57cf1c8ef99475f1845b7b4ea5e7f5d0e82ab210987559e624ffbd8d0c71cc4eaf785a790566268", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095917, "uuid": "72477c90-be28-40d7-a2f9-446ba5468815", "value": "T1A6327F2A9DD055AFC30B61B569A5331BFFA476A7D234020E7D70AB5884B368F8301399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095917, "uuid": "f51dc66f-4d13-48f3-9f12-6a1eaef0dc6d", "value": "192:6ya0N5H4fWA4N5eNA2A+EnVs+mg1SoBmJY+O36PvJKzkXY9PcWexm+S:6yX5H4fWAu5+A2bkBdBmJY+OqPOkI9PD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692095917, "uuid": "2d142d20-32aa-4942-8a93-5b123033988c", "value": 11493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692095917, "uuid": "3ac84cfa-cae3-417f-92a7-ab24ca71e77a", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095917, "uuid": "ba1fb067-899a-47c7-9dfb-c10e805a60bf", "value": "MT103-BIBBC2164179.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f85016-3b63-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692100783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692100783, "uuid": "eb01e221-968e-479a-985f-95ca81f9f1d1", "comment": "Malware payload (Formbook)", "value": "473a541ab9cb2a507ad69e117d4a7931", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692100783, "uuid": "cb83f42d-9be7-4495-b12e-00e645c2854e", "comment": "Malware payload (Formbook)", "value": "b02a5fcdaa1a1544084750565c8e6dddf30d0e6974cc39588e066c5ceee651fd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692100783, "uuid": "23304977-5a05-4105-a966-7d67da2e23a8", "comment": "Malware payload (Formbook)", "value": "07784851e3b31c1a9db81e64fcd13d41cd45a024", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692100783, "uuid": "a6540b15-90ce-494c-bd96-b39a9e158d6c", "comment": "Malware payload (Formbook)", "value": "9865dfd490817f646d39c67e6286839d50a236d20680395d012dc3edf9e457305d5355eb77d0e3014ad9bc6849047bbe", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692100783, "uuid": "8547bfed-c2cb-4a7a-9fe0-cd10b55f3c26", "value": "T11E2412FEE6510CC575EDB4B6B27902D85BB409AEB5FC9E07F610960C230B167900BBE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692100783, "uuid": "f7c710eb-4bc4-4eb9-a6ac-70bf9267ab63", "value": "6144:BcGMQi+8uQp7QDmw5zuZ/N/K7X83DHCsR:Hi+8jpymwNu/K7X87jR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692100783, "uuid": "3d81a706-3335-4f94-b400-7d4c3491d194", "value": 227075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692100783, "uuid": "83a16ae0-6105-4e93-a906-6e3b8577fcfc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692100783, "uuid": "02a022da-76a0-4735-82b6-598300026282", "value": "Kaas Order 2023 pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7feee105-3b3f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692085441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692085441, "uuid": "e925d321-5ac0-4dd0-86cf-8064a5737fb8", "comment": "Malware payload (AgentTesla)", "value": "f9d62892778e865a7a152b47d0ee25a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692085441, "uuid": "8f184d1d-6ed5-4b47-9081-215eff07b874", "comment": "Malware payload (AgentTesla)", "value": "b45c0da68ff2d7aa8399e31e7d4b65593e930cbb09927f66f55cbc4c82602837", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692085441, "uuid": "3dc90720-76e8-41a8-8f8c-06e6d962ebfc", "comment": "Malware payload (AgentTesla)", "value": "9594db0db6dc781c298f0f8f42d290d8017d398e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692085441, "uuid": "366b5cc4-0eab-4ee8-9218-293aaddb560d", "comment": "Malware payload (AgentTesla)", "value": "11919873c9437e7b3a290efbc3251807470a3aadeb8cb9d8952502287b252d9010993f8d63ff112d3e9bf023e2c90ead", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692085441, "uuid": "67b363bb-889b-415d-bcc2-493fbf773450", "value": "T1B8C423370CB9558212511722745B4214BE8E362FFC7B078BA9EC2B9B1F7D28D439861F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692085441, "uuid": "21ea0889-1f3b-4ec5-ba38-5bd96617e696", "value": "12288:ZgCNnAoybXQ00yAxMUrcTANJguOjitJeLDwdwdAQ2E5fE4P/HP2:tNnV00yA2UrcTANJgubtoWOE4PvP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692085441, "uuid": "ec637c9a-c592-4caa-83ba-e343574b61aa", "value": 570135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692085441, "uuid": "a43bdd8d-a236-49f6-b775-ff1c8876b9cb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692085441, "uuid": "3098cbd5-7759-4b2d-ad81-314e1ec9edd7", "value": "JUNE-JULY SOA 2023.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "332e9659-3b09-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1692062119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692062119, "uuid": "dd01b09a-0d1e-414f-8995-869bbf789e7b", "comment": "Malware payload (njrat)", "value": "3520c9f0c8169bf49125281e56b32902", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692062119, "uuid": "5552245c-dffc-4e3f-8f77-86d99771dd0b", "comment": "Malware payload (njrat)", "value": "b5858487a2ee0d680409be3ac9bfb0afc35a947fd0dd47dc148905ea34e99307", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692062119, "uuid": "9a9ea92c-9090-4747-84ce-140bbbd32ea7", "comment": "Malware payload (njrat)", "value": "42ac25b22b53cc0cc79c03d6b126c860800c417f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692062119, "uuid": "dc0ccef1-104e-48c5-886a-cae9894c99a7", "comment": "Malware payload (njrat)", "value": "60f1846d7ddbd2ef197afd5aca93ed0d0f23f5473214690f8ef38dbae9c665c3c2797fc900e7e58953ffeb1fe0a7cde3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692062119, "uuid": "963d8b5f-2e1e-44f3-a4a4-d3e94b26c7a9", "value": "T18A93E84977E52524E1BF5AF39471F2004E38B4871602E79D48F259AA1B33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692062119, "uuid": "c7a6bb5e-791d-4570-bc8f-8140baf1e6fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692062119, "uuid": "b373b715-4c85-40a1-8e06-e1a2726b1d6b", "value": "768:SY33UgSgmnldjcRoMwrx7Y+DIkIITJbXX0pOt8ux82WXxrjEtCdnl2pi1Rz4Rk3A:NUumlbrq+1NTZ0OojEwzGi1dDYDBgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692062119, "uuid": "a54efcd9-0715-43a3-8609-2f79a4836492", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692062119, "uuid": "83b57df2-5023-4dc7-8613-56c22993e3d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692062119, "uuid": "69a44581-fb90-4c1b-8422-2defabc94eb1", "value": "3520c9f0c8169bf49125281e56b32902.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "259f0e37-3b69-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692103328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103328, "uuid": "c9b489aa-755b-4171-a6e5-87b4b134d9ad", "comment": "Malware payload (Formbook)", "value": "54f2668a5f658c323aad9c9f27b23dba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103328, "uuid": "0c49e111-412f-400d-b94e-42093ff10701", "comment": "Malware payload (Formbook)", "value": "b663d64967ea2c767419bb45189b60b0ff088b8060598a7b914bd284a91c4c92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103328, "uuid": "bbbd4901-149b-4fb6-98fc-8802e4a730d6", "comment": "Malware payload (Formbook)", "value": "0db321f2a1f18d53b8166834b633c491a0395385", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103328, "uuid": "3c579e13-ccb2-43e2-bd58-bbac96e1e32c", "comment": "Malware payload (Formbook)", "value": "893957e52a061dafca8b759330787ac99cd2adef42df65fdded4b7b44323bda64a123fc6316290bafccb507f733b81b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103328, "uuid": "eae29256-4ab5-47a9-bc07-a154e3b33df9", "value": "T15C34128877B0C17FC0F386B09E7CA6263F6DFA5520F4934B13141F79B82265A910CB9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103328, "uuid": "78b60434-c0df-428d-9b11-4d2140a00cad", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103328, "uuid": "ae5cec6c-94f2-4b32-aa55-0476c95363d0", "value": "6144:/Ya6dc7gBpA0ku219nhQMv4KVkZna0qddB:/Y/CcO0r2n+MvD4na02D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103328, "uuid": "7b6771bc-6ac3-4ed6-bec3-65a428d9a8ea", "value": 243751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103328, "uuid": "7cca003f-63e0-44e3-a7d6-9b87fb1dcab3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103328, "uuid": "49a323e0-15fb-47f4-a655-3455eb759dfc", "value": "E-dekont.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01727f24-3b69-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692103267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103267, "uuid": "51e0b16e-166f-463e-a48c-40c966b1b38c", "comment": "Malware payload", "value": "848062ceceb21f27903c951e60067941", "object_relation": "md5", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103267, "uuid": "e353cb9a-4128-4408-84b6-07b77f16c1e5", "comment": "Malware payload", "value": "b73d1ef3c646bc8f5a0fcb7f091fe08b3492b8194194f225d43cc5ad33053f03", "object_relation": "sha256", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103267, "uuid": "966396d9-6c30-4072-b041-45c1c3d25663", "comment": "Malware payload", "value": "468ecc4f301e83ae156133e425f4d260bb799abb", "object_relation": "sha1", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103267, "uuid": "06ab48b2-ad61-4948-b15f-96ae8099256b", "comment": "Malware payload", "value": "416d4239193c48158713f641283d5e0e2a2f2d5c6823ad5d2ed56bd1ac869edd3f2c48dd7b9f67fe9252cbf3df7a17a8", "object_relation": "sha3-384", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103267, "uuid": "d4413728-0e3c-4e51-abdf-c9ed9a42efc1", "value": "T120E13B5DD0E64429C31B643BC1C0E60A6728B726034F66637270F7AC69FE2FA1B9D758", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103267, "uuid": "7338eaa3-1ede-4508-a47c-85afbf9907cc", "value": "192:EBbD+2LCLEOV8vdQjm+Njz2vYuUc5i7hG:wZLod8qmgjz3uUc5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103267, "uuid": "2c6f4d10-6f6a-4f7c-a768-dc148068d940", "value": 7169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103267, "uuid": "38496967-fd1a-4231-a7ab-641aec505473", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103267, "uuid": "ded4126d-952a-4fe6-82fa-12c6e8fd2457", "value": "ORDER INQUIRY.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f52033a7-3b68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692103247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103247, "uuid": "ca251ac6-8be9-42a7-a4eb-0fde72186c00", "comment": "Malware payload (AgentTesla)", "value": "6f2c7145046af933b893c2ab398cb407", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103247, "uuid": "40786ef8-c47b-49c1-aad9-b17960e99b96", "comment": "Malware payload (AgentTesla)", "value": "b768daa3ba6b39b302f9d4cf34dcb7f8d6a452c70c6bdcf1a96b11b32f05c818", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103247, "uuid": "752dd49c-f1f1-4e9c-8bca-17c207f522ba", "comment": "Malware payload (AgentTesla)", "value": "02aba40a51320228b8952dec6ad963089505f6ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103247, "uuid": "1ad20239-5214-4028-93b1-d93280d6587d", "comment": "Malware payload (AgentTesla)", "value": "43ef747f44962a059c962c28453ca04ef43af306d22b869ade26352880ee1a6ca562997593c5c05d24daa56b1580cbfb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103247, "uuid": "d53e2baf-dbb0-43ed-a88d-c86f79cebf51", "value": "T16145D071D3C96DE2D82A137C54736C3223B39DA95472CA1E28CD3CA57FBB3920196A47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103247, "uuid": "3005e84d-e296-4729-85d7-57a330815563", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103247, "uuid": "cbcb36ad-9b32-4fa6-871c-a6ef5d09ad3a", "value": "12288:PMiQ7cdrCXcBvfa+krODKRDEeCnplB4QGZ1Zb+PxtY3v2z1f07rV2W:wrOEDYpA8JtY3v2z1f07x2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103247, "uuid": "37f02d8c-232c-4525-801e-c588046c8a60", "value": 1256960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103247, "uuid": "0a643238-db88-4072-8536-8aca062e3ab4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103247, "uuid": "1db71620-43ef-4b6a-9f57-d11f6f11a572", "value": "ORDER9547408.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98226828-3b81-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692113828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692113828, "uuid": "ac22d008-d757-4e16-b623-351d555dd65a", "comment": "Malware payload", "value": "4e0ad8330fae2292f2279988994563bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692113828, "uuid": "8340be6a-6eff-4c4e-aafb-49ce46effaad", "comment": "Malware payload", "value": "b92eda8f7dcdc8dcd1a8243deb0a582575204806ec2bc55e00ababc5abd2a4f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692113828, "uuid": "6248fd38-0527-4f82-955e-df84b0ddb207", "comment": "Malware payload", "value": "fc3da931bef0c927610d3a35ef67e37425e95fc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692113828, "uuid": "d18290a7-1546-48e4-b20e-788a7bbc9b12", "comment": "Malware payload", "value": "30f7f17c4b8e76b928c3b1632c21cd2dcbf0ff372ccf09bf96f4cb3352606108f0eabe214dfdf4953bd37911f1d958ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692113828, "uuid": "3954d7a2-a05d-4360-821f-56c0cd351cb4", "value": "T1D946D060374E5C44C2BA50737DDE22E6D956B908F8DF880475866C54E2AA07CFF2B8F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692113828, "uuid": "5235656b-6d9c-4f47-96a7-7a1685b04438", "value": "d3be2dc19ba54f7225d7679c3f791cf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692113828, "uuid": "35813020-3b2b-442c-bf44-a1788843e46f", "value": "98304:XPOM/aWvOCgOlredytoCaD2TQTk9zCoqUCrlxbni7NJ9cPFKsviT9sGD+xzvHp:XLOCgOlredytonYqUCpxbniZCKsvEyvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692113828, "uuid": "f1ff1c38-fc84-47a5-96d1-fd230951e132", "value": 5874456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692113828, "uuid": "395fab4b-0658-457a-abec-334fb667849e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692113828, "uuid": "a625db3d-88b6-44bc-a643-535efcc92bd3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df56a9f8-3b7b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692111370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111370, "uuid": "4a0bafce-1a5c-463e-81aa-8bf0a9fe47e4", "comment": "Malware payload", "value": "6efdc56bd6eb27eafdc1bf14fe4e757a", "object_relation": "md5", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111370, "uuid": "1020ae78-d065-446b-8cae-ed904baf436d", "comment": "Malware payload", "value": "bb57bca4633baab664188026d0a1a057750acc80b13a7cdc56f89b7b564d8c24", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111370, "uuid": "b720c963-c401-4c51-aab3-ac922946bb13", "comment": "Malware payload", "value": "e73205c12fd612bfac863a128ba3d33355622619", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111370, "uuid": "4e74b5d4-ff64-4533-89fa-6ff62f392c71", "comment": "Malware payload", "value": "ef19923bf3bd9cdd01ff59eecf8d01b5c5a8dba7b5a2a729d53f148be68bdff0979b26a29afde8be88edc2c333ffe946", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111370, "uuid": "d8756999-75ea-4198-a2cd-a74962330a9e", "value": "T15A4176F2F323C0D44476A6279CA7D0C5BE78806E0021150A7ADDC89AABB19605276F47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111370, "uuid": "32611b98-7791-43bf-b447-2a08222bece2", "value": "48:8ct2eOGJ83vr1Vje11Z9IYb19Z/cPFFpgfqpg4:81eOjvrLGZB191C5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692111370, "uuid": "cd734fa8-efbc-4152-b953-6eb91d5019af", "value": 1952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692111370, "uuid": "c48bf257-4351-47b6-b49c-de556d7f7dbb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111370, "uuid": "b3e25401-e49a-48d0-9cc5-d7b4c7945d75", "value": "Xftz2dcQ.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6249409-3b68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692103248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103248, "uuid": "0837f917-61fe-425e-a62e-be0c2499a0d0", "comment": "Malware payload (AgentTesla)", "value": "f0d27f985a9dd0d2afc3695b4df86b4b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103248, "uuid": "d44b3f33-5240-4243-bad6-cff663d2d573", "comment": "Malware payload (AgentTesla)", "value": "bc6ac708586d3cd72851c365708a555068339aa2d10b4d031c5ed15bc4269d2b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103248, "uuid": "d0d1f313-3ace-4b40-82df-e859952eebe4", "comment": "Malware payload (AgentTesla)", "value": "74a330344a4bd616ff4403d194d8797436906a3f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103248, "uuid": "139cbfb6-fba9-4c2c-b55f-e6cf9541d1ed", "comment": "Malware payload (AgentTesla)", "value": "0212c9f84f0ec5506a2a20c359868da19ddc51b1267e01adfabb78ab0bd16022dcfbb8e9d1a4f3605d58bfc70dc8ef74", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103248, "uuid": "30d1af7b-9152-4626-8795-f994ed3909e6", "value": "T13FD37C0BFB598532D6830B39D69B53249B74E683A363C38F704D53559F027E8BA7128B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103248, "uuid": "fc54005d-9a76-43bf-9f3d-a2ff28e00053", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103248, "uuid": "d8557b7a-cc7d-454f-af11-04c21787ea0c", "value": "3072:04qaHCU1Idrw9MtrnfhAP8tXclNd1Uifxv/dXk:04qaiU1Im9eJAEK/nZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103248, "uuid": "7715ec43-39c3-4f2a-bc8a-989821a4d46e", "value": 140872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103248, "uuid": "858de46d-0880-4222-8a1d-a094f66bce36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103248, "uuid": "a1436e9e-0e14-450d-83e4-c4b2be4b43cf", "value": "DOC8998454.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a38e805-3b51-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1692093162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692093162, "uuid": "1dfe180f-b2dd-4998-895c-041665197dda", "comment": "Malware payload (NetSupport)", "value": "c811ea55631165505507c918dca24f47", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692093162, "uuid": "8e53a178-b6f5-4604-9584-ea87c3901bce", "comment": "Malware payload (NetSupport)", "value": "bca99fde58005345c1f3b7f630b76d17a340a7bff426011a237eb975ddbb6874", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692093162, "uuid": "073ae021-8426-4226-9324-c628505bf4a6", "comment": "Malware payload (NetSupport)", "value": "1964a21c3283189c0506b199df4a3d2272ab8eeb", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692093162, "uuid": "e1c1e8e9-f850-4517-bc34-d1283010b921", "comment": "Malware payload (NetSupport)", "value": "fd542b476bf26da5ecdbc7597fd0043cb94c3bf731305c5be1477b139c0dfdbefa5361490eda728dd4823a05c7ebba6f", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692093162, "uuid": "34e406fb-69e7-4611-9ef8-6676db39cfd5", "value": "T15352DF8C01A991CC8BF185BF98DA3250253CDEED22CE1BEBC9259671605C9E4C15BFE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692093162, "uuid": "012916c9-fc74-4085-8ac8-3e3f6a0d5be7", "value": "384:MyJ+ng8xtiQG6yyI5QtwG2AoGjiirnB9xzueIa+UA:toiQ0yIytwTAocvuwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692093162, "uuid": "6386ebcb-b7de-47c9-9794-08423082893b", "value": 14231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692093162, "uuid": "3a67d330-de4f-4c53-8122-ae293aece06d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692093162, "uuid": "3c9db216-5afe-4b4b-9ccf-ac6716e36e48", "value": "nine-life2730.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb8d45cd-3b38-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1692082534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692082534, "uuid": "4ba19454-dd1b-4752-941c-49f39afe1436", "comment": "Malware payload (RemcosRAT)", "value": "750f2cff77e731de35fd0894d5ef0e91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692082534, "uuid": "616b995e-d308-46ca-be9a-d230d6eb8e14", "comment": "Malware payload (RemcosRAT)", "value": "bd9df3adf1e6c84fcab2206d63d2f02e3f1ce1b715c09459d21ff47c09cac2f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692082534, "uuid": "baff4026-6291-486e-bdcf-8b8f5f7cd66b", "comment": "Malware payload (RemcosRAT)", "value": "8f5760e3d3f44e1b90d793de3666a24f66bdb6da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692082534, "uuid": "a8862013-90c1-471c-84bd-b8ce3bdaf104", "comment": "Malware payload (RemcosRAT)", "value": "15229bd24f980fb93956a61e34641b9f64bbeb9556403ce36a629b149656c871aedf29082101bfdd72813321354f938e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692082534, "uuid": "00d84e92-ed46-46b9-a1d3-873e38408f9e", "value": "T1B3152364BAF95F35D8BFCBFA8042A94F03BAA5675266D21BEDE130D10A143040F91F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692082534, "uuid": "ad1d325a-c9c2-4d1f-806f-8a176fc1ffe4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692082534, "uuid": "a3418da1-3862-498c-bcd6-3d78294f5f11", "value": "12288:hyOV/OSNlLvtCEfdSM1RHBWa71fXMaZT0IOeMO5ws3kf/v55BE0uDvZiJbyUdmOh:hypilLvtC/MwO1ffZTJXesg3TytDmA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692082534, "uuid": "7c26d579-3456-4600-bd3d-01ff6ca8c44c", "value": 880640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692082534, "uuid": "6de4230d-d31b-4e6e-a9b4-bc0db8f98691", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692082534, "uuid": "8029842f-8e24-46a7-b872-038cb38d9c75", "value": "TNT Original Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52aca22d-3b8f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692119724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119724, "uuid": "3b843eac-9f1b-44c1-8315-f182f5d1d18c", "comment": "Malware payload (Mirai)", "value": "0149d48f392d71a1c89359294d256e25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119724, "uuid": "4c6c3bca-91ba-4e81-bcf2-e2baafa4901e", "comment": "Malware payload (Mirai)", "value": "bdd3af4f2849e78ba494f1d33138174d096fb8f1bf66712dcb595b4d54af473e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119724, "uuid": "a26923eb-d377-46ae-a009-398bdb699c7b", "comment": "Malware payload (Mirai)", "value": "ce701a05ad562fade86e56da4b26ceee000f22f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119724, "uuid": "95d63b81-cddf-4dc9-9e53-13bb694a61a6", "comment": "Malware payload (Mirai)", "value": "e8d3597b65847ccc8de4d8fb13e4fedb2f07dc0aadfd384c05e35763535cfe6263178a260c04b30d38d22de3eca58290", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692119724, "uuid": "a086aaa2-d478-4b34-ab2a-19c2fd3d1ec4", "value": "T186D319C7F800DEFAF80AE73748530805B130BBA645925B37625B797BED3A1D90467E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692119724, "uuid": "64f7f8e5-a29f-46cb-ac9e-9fbcf2576b49", "value": "3072:vohRXbsVduZ+7Xfx/CsGpB/ASVPjbinL9V6MElysD8If:Cl+vxasS/AxL9V61yslf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692119724, "uuid": "4b93edd4-66ea-4bf4-91eb-80e03acec115", "value": 142732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692119724, "uuid": "36af98e7-8cbf-4b5e-ad8f-f8e9eb934ee7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692119724, "uuid": "906865e4-2458-4161-b39e-1e3c9c0edee2", "value": "0149d48f392d71a1c89359294d256e25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f881d272-3b65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1692101964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101964, "uuid": "63445069-112b-425b-8732-2e6b867b1909", "comment": "Malware payload (SnakeKeylogger)", "value": "2dbdc96135002d650ff6ec39bce979d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101964, "uuid": "20f82557-b47b-4d7e-83fb-cb7e3b3d5f3d", "comment": "Malware payload (SnakeKeylogger)", "value": "bdefd80ebc99c33bb0bfa9db249680c258ba3e55fd704c22fda1f015ca7aed32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101964, "uuid": "20150ebf-b5ef-4c86-974c-20769b60f2d2", "comment": "Malware payload (SnakeKeylogger)", "value": "d8d6352a8d9362600db113467a5abeb654ddc0cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101964, "uuid": "1d156604-b70f-4c6b-ae8b-805f487930f6", "comment": "Malware payload (SnakeKeylogger)", "value": "1167db62ae608e7f1aed03b22307dfbaec895ccfdb9873b1f3f439c30cd5f42b1ab6547bc825d2795a3c259ff3cd8fdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101964, "uuid": "13d461cc-da83-4c8f-ba34-ca941400ef13", "value": "T117D423567DE82DA1ED6DDAB811310C5713396E266C13E2FCCCC622C01A9BB89964DF73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101964, "uuid": "b3e1ca99-9f19-42c9-8db4-591add8b754d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101964, "uuid": "d5cd6841-c026-4fb7-bd87-dc7940d2fa08", "value": "12288:GPV/OvRm6fQv9/DkdVl4cq8UTxW1U/4uUPE2lETspFhdmQZD:LvRAFbO4cq8UTxWntqWr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692101964, "uuid": "9632bea5-271f-47bd-8535-f915776ffa7b", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692101964, "uuid": "80d5a28e-b5a1-4906-8d2c-69976b03b21b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101964, "uuid": "50c4af27-89d0-4ada-a4d1-b67b08ac4b6b", "value": "RQ038023.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01bca23b-3b7b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1692110999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110999, "uuid": "6d63eb23-ddf9-447f-b733-5a0f936bc22c", "comment": "Malware payload (RemcosRAT)", "value": "afd5059634526a62419420ec64bd3d73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110999, "uuid": "8eeef017-7354-4f48-86c8-67996e4fc637", "comment": "Malware payload (RemcosRAT)", "value": "bf82f37c4f8fdd3b7572bd60a0f86e7d89356921728708434d07d6a2b0cbf7d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110999, "uuid": "22121e6c-9c42-4b28-b0d9-44e7b0037ecb", "comment": "Malware payload (RemcosRAT)", "value": "45fba7c55c1a7f3631f063a3db09902be00e58eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110999, "uuid": "51d41c56-81b6-4f6c-9d5a-5c67a7178cb9", "comment": "Malware payload (RemcosRAT)", "value": "ab4c7d456bd374e14dfa7516242cfdf58cfa656808ad5a0073459678441b6d5713e0b70622bc10235154241f66c9a5b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110999, "uuid": "f3fb7a94-07bc-4e93-bf1a-a66ec4d790a5", "value": "T194A4AF02BAC1C072D57651300D2AF775DAF9BD20183A457BB3DA1D9BFD70190B63AAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110999, "uuid": "8ca8e944-3130-4b74-b593-3fc74dc1be88", "value": "04d77d421b8e5297898a3fce39d74267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110999, "uuid": "e6d4f02c-360e-4cb4-a6c7-ca298cf79fbc", "value": "12288:JRXxReZj3WZfj/2eSseWFaIe2+f8CL47bs/ZO2ZDU:Jx7cyF2eSsewS8W47eZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692110999, "uuid": "bc2ed9fd-4c3b-4afd-84c1-af0e4190dc09", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692110999, "uuid": "84352fbf-669b-4126-ac57-2241d31ab3a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110999, "uuid": "f0e8f313-e37b-486b-b0fe-6f2b5b246bf5", "value": "decode_9e049ef05fa664f1cb2e1d251000e814529cfb1cb2668854c7a7f0e1d599145b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de552ee4-3b68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692103208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103208, "uuid": "849df4cb-f436-4d93-a017-e46ede23e534", "comment": "Malware payload (AgentTesla)", "value": "adfe7c8a0fcfb3c8faf867b933e21da0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103208, "uuid": "e09c8314-387b-47e8-9c88-b3bf26330f8c", "comment": "Malware payload (AgentTesla)", "value": "c0801437c4ec816b60489746c49a33b7268126eda8d69af47585d46175cbf078", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103208, "uuid": "4af7f2d2-aa46-4b6d-9454-73b17de6a563", "comment": "Malware payload (AgentTesla)", "value": "71445d437619e12c18eb7295603d8f65a7b9269c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103208, "uuid": "1aeb753e-7350-4978-ad7c-4ecc2671086b", "comment": "Malware payload (AgentTesla)", "value": "91d490591a755f84a26b10a85f03387e167e4f15eb8a432cef9eb7c882ddf1424c05f0f718b61c63cab562dda671e599", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103208, "uuid": "bc0e258a-1f2a-4197-96dd-12a3ef62e79e", "value": "T10E05E41419345186EF3E25BE1A63573E75F80D43A2B2D4E8BF2766C38DD20120F69BE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103208, "uuid": "9907803b-f35b-4cc7-bf25-c18359e00240", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103208, "uuid": "0f6d0f92-71cd-4289-8c62-4a383c1ce5a5", "value": "24576:u8GZcpppXpppppCOopppXpppppCOixqvjCauIxFXWt3EPJ4be9:QVO/OBjCauIxFGtUSa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103208, "uuid": "835fcb47-5b23-4e21-9a1f-f1de2f04412a", "value": 854528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103208, "uuid": "df6f51a9-61e9-4fbc-9682-d5c066903cd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103208, "uuid": "a1c08cfe-9636-4c4c-b319-0d6b8b6dbd23", "value": "DHL Shipment Notification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c0b94d4-3b34-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692080710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692080710, "uuid": "44f2e1c4-a005-434e-9620-f32d01c62e1d", "comment": "Malware payload (Formbook)", "value": "35d4ccea11ed9d1e96ef88328ff609ed", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692080710, "uuid": "4cb6f0ac-4674-4f58-8132-d957a830d1dd", "comment": "Malware payload (Formbook)", "value": "c0a4c73ac3739d0be9f611a8227800b9b9f19a9bd06b5a82d9007cc5e54a430c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692080710, "uuid": "a85ca353-1347-4476-91d9-68643a039643", "comment": "Malware payload (Formbook)", "value": "8580de4fc69b1e89c2b2fdde2ecc8ee688d33aa0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692080710, "uuid": "be90aeed-5f49-49f9-acb9-0a99fd6e0b8e", "comment": "Malware payload (Formbook)", "value": "4329dcb722fbbcf9eae048ac6d835849656794d14b19ac4b1d83893c6203125d940b294655ebbf27e771ea6d2af1ca8a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692080710, "uuid": "db9865a0-8107-420a-8615-783b586589d0", "value": "T11755F103E900DBC3D41D83F87E530EE90F0A6F19E99569DB14667F9B3B70A72099A12D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692080710, "uuid": "add4d464-ff57-40da-96b1-23624eeda213", "value": "24576:3aZy0w6VgjKaWlEzp7aoZydw6VjjKaWlEzp7aczd6f/b7QAUQp5E/zwkx:3E86VgjKjOzdJ6VjjKjOzJdU7/UX/z7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692080710, "uuid": "a4ef9ecc-67e4-42d6-970a-5b6d020d7e0b", "value": 1330176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692080710, "uuid": "052e3fec-f2b3-44b6-afc7-751ac1cade5a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692080710, "uuid": "823425d9-e0cf-4980-b1b7-eb2fb59e6684", "value": "PO 0049 & 0050.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b50a61-3b85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (BlackNET)", "timestamp": 1692115518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692115518, "uuid": "122bb6a4-0a96-40ec-816f-54c1a800188b", "comment": "Malware payload (BlackNET)", "value": "122fadb5b266bfe5525a7b450e4c778f", "object_relation": "md5", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692115518, "uuid": "7e9c1782-85b8-4273-b519-fb23edcd3bd6", "comment": "Malware payload (BlackNET)", "value": "c105e8c3286a2589c4bbdaefbd266cd45be414d08854e48b4aa43104cc48c510", "object_relation": "sha256", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692115518, "uuid": "1f763606-1140-4eb7-b5de-5bc8ce88149b", "comment": "Malware payload (BlackNET)", "value": "6141866987d31e85a522ea3881110789e4d38893", "object_relation": "sha1", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692115518, "uuid": "b790911c-2e07-4d8f-a5bb-bcffff6018d1", "comment": "Malware payload (BlackNET)", "value": "2300e4e00cd3479f301119dda4ddc0e6554a31490af13979b255b1c3cd25c1952832c95086d9cdd0716c5f48e605c28a", "object_relation": "sha3-384", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692115518, "uuid": "3e020daa-566e-4407-83db-1670bdb0ebd9", "value": "T10783C3423BED2851E0BD9EB4BBB363C1CBB9FD1A0912D65D08C4105D4A7AB47B941BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692115518, "uuid": "3a7d603d-fc2c-419b-a804-b4cd2a2ed2b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692115518, "uuid": "e1835093-53fa-40db-b35f-4c4390e26271", "value": "1536:AZuhD5z28TC2CYl9706u/GiPL1TgbSUPH4LgjCtYn:51306u/G0tgbSKHagj+Yn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692115518, "uuid": "c9e88ffd-c0c8-4f8c-b25c-a9809251fcd8", "value": 80896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692115518, "uuid": "48320ad1-7b58-422a-b7b4-dc49cc56cb62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692115518, "uuid": "3d1c4958-4d4c-492f-870f-2d077abeead7", "value": "122fadb5b266bfe5525a7b450e4c778f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e011d4-3b6d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692105179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692105179, "uuid": "b3016124-d86e-451d-90d2-6ad11270ee54", "comment": "Malware payload (Formbook)", "value": "a30e397e4ee8fb4091c896fd2d52fb36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692105179, "uuid": "544c73e7-2dad-4a21-91c1-dd67ccd71b34", "comment": "Malware payload (Formbook)", "value": "c1a46fa04740b97fb8ffd1a24b00a770dd5ccb929a66583ed48a4ce75da7c175", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692105179, "uuid": "c993713a-fe85-45ec-b317-d07eb61399ec", "comment": "Malware payload (Formbook)", "value": "e326629b6cdc17a1bc02dc36f92ccbb144df95c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692105179, "uuid": "925ac52b-8512-4c54-ad85-74eb0600c130", "comment": "Malware payload (Formbook)", "value": "c6a5a13b405f40b722409f7434157d165e9a9bd1055299eec5cd80cd8d5cab84cc3adab3b3b292c3a16e424b17f74b8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692105179, "uuid": "55ce04d6-e6b3-4294-a135-033934fb5d98", "value": "T15DF49E74069AC50BE41B1B34D8F3E2B53FA98FA4A2D6C7474FE47CFBB84A05666910C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692105179, "uuid": "b1a16117-becd-44b4-bc4b-5e248f494f8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692105179, "uuid": "ccd56fa7-6617-4f1f-8c74-28cbef51ebc0", "value": "12288:YtBqxM8a1WBZdtimfYgdAMxgbdWieNScr0Sc7OpN05:sBqmYz3EIbScr0SQAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692105179, "uuid": "37a08ab9-bd7a-4f63-af9f-643e1b062afd", "value": 760320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692105179, "uuid": "eeef7855-7138-4599-9d56-6ec965901472", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692105179, "uuid": "42f916d2-df7e-48ba-aab1-5fd124a7ddc3", "value": "ORD- EPC-170-2023L dt 15.08.2023 - AIL - PLANT# VA03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "facab2b2-3b7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1692110987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110987, "uuid": "4b40a75f-d36c-4462-bf90-a59619d337d1", "comment": "Malware payload (RemcosRAT)", "value": "747676826b32e06f3e0265e4e080ee17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110987, "uuid": "71f39be7-fe33-4bed-8ec3-a6ce4c435759", "comment": "Malware payload (RemcosRAT)", "value": "c25831d9db394113c32cbfc414dbf40230074381c893794fe94eebe29d798021", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110987, "uuid": "a26d5fc5-180e-4813-ae34-40e3197b5a4e", "comment": "Malware payload (RemcosRAT)", "value": "4203baa78dcc23bab7e70f4b7c53d3effdf58430", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110987, "uuid": "1a77c384-0927-40e2-b1dc-48c283588eca", "comment": "Malware payload (RemcosRAT)", "value": "d43b84fb510e123f29f895f96be5bf1b78db17c354c16f525af2212fa7ea2e857c9dd90acb1cb16c36c108594fbabb6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110987, "uuid": "93d74718-7258-4110-a7c1-25a1b7125e3c", "value": "T125A4AF02BAC1C072D57651300D2AE775DAF9BD20183A457BB3DA1D9BFD70190B63AAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110987, "uuid": "d226b8de-0515-46ff-81c9-8e26351a43e6", "value": "04d77d421b8e5297898a3fce39d74267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110987, "uuid": "749c9ac3-9a34-4e30-90dd-eecd0bf8d101", "value": "12288:pRXxReZj3WZfj/2eSseWFaIe2+f8CL47bs/ZO29DU:px7cyF2eSsewS8W47eZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692110987, "uuid": "67435597-22f5-4c8c-8405-0f977b80e56e", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692110987, "uuid": "d9f6d900-a8b0-4aa9-b5b8-a61b0aa20c47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110987, "uuid": "e8826a77-4518-4fc9-970f-39bd72fe9b7f", "value": "decode_5d55ed830760c7be337d3e6803f93c9437b4338e99732c6be04c54a1116baca0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05680ad0-3b66-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692101985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101985, "uuid": "cc91c3bf-0098-4eee-a6a5-96d57b132895", "comment": "Malware payload (Formbook)", "value": "93c87c90a78d6e943b0739712d2fee8c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101985, "uuid": "a6261335-2b5a-4ec4-8e8f-39d47541d425", "comment": "Malware payload (Formbook)", "value": "c2630b4b9196adceb90011cd1c34e47a09e1f25a98e1bc0e46b249472ddb3e0d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101985, "uuid": "be0396c4-8289-4ea9-8e9e-8a3f70ab2fb5", "comment": "Malware payload (Formbook)", "value": "dfaba4760c5ff938b0c9baf75e62d30bd0831a69", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101985, "uuid": "67c9577a-d90d-4b32-80b3-51e9f4873259", "comment": "Malware payload (Formbook)", "value": "41d4c0b7b2ab01df8a932d41ac2d44cde2a4a02ebeeecccc4e44c1fc5dfffc8e99074d3e1056dd1f75068b6e684e9f1d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101985, "uuid": "10c1c830-b4d4-40b9-a6b1-7624cca3473c", "value": "T17135230878C4C817E8B2A23559C2DDDB548CBC1367E4C59BA29DB36D1676B1242FE3CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101985, "uuid": "28d9475f-7e0f-45f9-83f3-a5855eba87d1", "value": "24576:0u5/bJ8+6bvdXXXXXXXXXXXXUXXXXXXXXXXXXXXXXudn/Cr6twWjW+TKn0CI3h/I:f5/b/6tCr6twp+K0CIxMdK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692101985, "uuid": "25a4bf42-4d47-4e02-bb15-c3694adc93fa", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692101985, "uuid": "84dafc3c-a8a4-41e9-82b3-b53354acf579", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101985, "uuid": "a8a4ef37-6cfb-43d8-941f-94ad45acfab5", "value": "Quotation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7c3e1f-3bae-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Arechclient2)", "timestamp": 1692132921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692132921, "uuid": "951643ac-c635-4eaf-9a5e-e852f1eb148c", "comment": "Malware payload (Arechclient2)", "value": "2799f95e13eda805a9ddd97278a9f8b5", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692132921, "uuid": "19608f39-3566-4754-aa42-036271e0f20d", "comment": "Malware payload (Arechclient2)", "value": "c479a0439f849bb2b093fc02b3beb42e7bc407aeca3828344b591ecc8045b684", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692132921, "uuid": "3aeaf896-a4e4-4ae7-baa3-1ba6edaf210a", "comment": "Malware payload (Arechclient2)", "value": "151943a4682a7ccbb0a7914ded3c3c32c602fb46", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692132921, "uuid": "c3d0946b-7ad4-4922-b2e8-acd7c65f5f5e", "comment": "Malware payload (Arechclient2)", "value": "2cb5b6610460b4c40e913c6f825472bcef13854de03c3fa12e82a9b5494f0dfdb1ce8d4474fe077cb66b9f79b222f2b9", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692132921, "uuid": "9df986b1-be2f-4661-9067-3e8b9f9adfa8", "value": "T127A4282D33179536DAD9BF7880FF0F2C95A7425286996A4F0B8CC8C07F8539E9709A85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692132921, "uuid": "b354ff8e-507a-4a2f-8717-3aaecb6966fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692132921, "uuid": "c71b85fc-718b-46c2-bd2c-47b410c8f6e0", "value": "6144:olBYO4yjEb17TcMz5/hQluj0oGWA9HowGD9kh0vIOnPxEXlz3432eA6ltZTOaoWU:GaO4Xb1740ZDw+vIc5EXlzBEltF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692132921, "uuid": "1ada6d17-79ef-4814-a6d9-fa043c6b6dfc", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692132921, "uuid": "72606d63-986f-42aa-89fd-51dff7d83ea8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692132921, "uuid": "54e713c9-f464-42a6-91cc-c1dd01311105", "value": "2799f95e13eda805a9ddd97278a9f8b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "129b3ca1-3b72-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692107161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107161, "uuid": "957a208d-578b-43c7-a59d-3de823c2e8c7", "comment": "Malware payload (Formbook)", "value": "7839c9d8c615fed9d0c94ad49412b684", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107161, "uuid": "ec9a4401-dfe7-4d11-bd25-ef88a0829696", "comment": "Malware payload (Formbook)", "value": "c7a97adeda6255f93fc115edfd254b5224deedb177a6100354ac6226ad42b9f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107161, "uuid": "0cd572de-639f-4289-981d-0b99237be8b4", "comment": "Malware payload (Formbook)", "value": "ae4eb463d856711a18065d6a44b7a8eb8f1a0132", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107161, "uuid": "eaf54e92-da01-4378-9dc4-c6ddf67e67c7", "comment": "Malware payload (Formbook)", "value": "91afa56943f089aa44ab9b6b4860d23df01b7a7353921bea95200a7cefd62c1a04e37b6da1c990bd0edbf418e57bc245", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107161, "uuid": "d6e513a4-6830-4b8c-bc0f-c3189ada1c82", "value": "T196341264AA64D87FD95257321E7F8E133F9A9C524ABD964713802B09BE7334ACD0EB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107161, "uuid": "d197b241-3139-432c-b26b-7ad8c4bc1b4d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107161, "uuid": "b31040ab-6a2c-48a4-a6b2-3e6affe27097", "value": "6144:/Ya6HcIbHBu8wA9lQVnM8q/8kVlzoU5I0li7eUezHCcJE9Sn:/YtDr48wAbQVnQL7JSkAeUeLC50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692107161, "uuid": "4188df6a-069d-4873-9b62-d73a00157ab5", "value": 248166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692107161, "uuid": "7f32d1fe-1ede-4ee4-812a-928e754e3740", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107161, "uuid": "7a09d728-55f6-46c2-9b2f-b12fdc501dbe", "value": "TRF_USD 23,480.25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90266785-3b81-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692113815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692113815, "uuid": "020d8959-13aa-4fed-ae75-963faac0e9b8", "comment": "Malware payload", "value": "0a04df8434f185fd12122014c7cdca07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692113815, "uuid": "3eb503f5-ee1c-459f-9321-cc50e474f6f2", "comment": "Malware payload", "value": "c8fadf09d5b23c2338703fa5f6d2c637c5c0b1ee062284cd0fc0de803025056b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692113815, "uuid": "5807cc40-bdd6-4b5e-8073-0f4d3ed4ffdd", "comment": "Malware payload", "value": "5103bb52ea1cc8d863be460a3d7a1ffcec7fde4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692113815, "uuid": "6cdb57bb-b3a9-4a73-af99-7bcb9cd80996", "comment": "Malware payload", "value": "7664051373c8b5492b5c8b78e355ba38e2cbf8072f4bf8d32628b3a8cc912d460eb1a631e9a4ecccc7d148f5ab91e829", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692113815, "uuid": "58d1887b-92ce-4e38-a0e2-d69b8922f4a7", "value": "T151C41202BAED8073DDA12BB05AF703D30B36BC909978872B3345595E49B3295B57273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692113815, "uuid": "315cecb4-1177-46c0-ab4f-000632607b92", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692113815, "uuid": "1b46cfbf-1326-4b40-8eeb-6ac09b2c9159", "value": "12288:0MrAy90s6u76yy3rhfBRb3Hon8V0GBbT7faSoFLN:EyHV763rhD+8V0GJT7jqR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692113815, "uuid": "16c349c3-831e-44b3-84a4-6a16d61cda9b", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692113815, "uuid": "64a17725-aec4-41ef-a3dd-533a921f5277", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692113815, "uuid": "a989bd79-4b58-4882-8a36-faaec889da33", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b65bad-3b6a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692103910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103910, "uuid": "a9f1396f-6e97-4ae1-acd3-a866482c658c", "comment": "Malware payload (AgentTesla)", "value": "84a3ea6308a3da1b8bc8ad21bd031b49", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103910, "uuid": "cc400392-b04c-4ece-bfdb-94738febfe3d", "comment": "Malware payload (AgentTesla)", "value": "c939e913342c14722c46909cd0432823bf0dc2fe1f663dba7a812ef61e16dc92", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103910, "uuid": "85f05cda-d38d-499a-abe7-aef37321e0d6", "comment": "Malware payload (AgentTesla)", "value": "1a47a00b849e0cc01292cae8e1ac7f9235be91b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103910, "uuid": "72c818ce-78c7-4a27-bbbc-b2cb40ebbfb7", "comment": "Malware payload (AgentTesla)", "value": "bd8879b66ec26436d8445aebdde91f5012eb548fef56b6b5ceca16d66f76885b7002f1bff4a03324c34aed235c586c5b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103910, "uuid": "6f8c861e-82e8-4246-bd2f-f4f35ba42a7d", "value": "T1A7D479C6E976E6E3C46587F9605220084F397FDA3469D1A41CA231DA3AF1B043793A7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103910, "uuid": "8c3ddc97-c8c0-4639-951c-57ea0baebb45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103910, "uuid": "086f757e-b7b2-4f9b-bb63-e39b0cc78929", "value": "12288:cTgaa4lrrW8Sm4IfVykzmvReIwj9zovhbwWWbrUSVRz:ggz4lXWdqIrYhSbMDz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103910, "uuid": "c53126c8-33b3-41e2-9389-7dd125953d74", "value": 631808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103910, "uuid": "26621ded-a8c5-4fdd-be28-a6213d20e841", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103910, "uuid": "b1cb22dc-5984-4754-b19b-5b0e303b4cfc", "value": "84a3ea6308a3da1b8bc8ad21bd031b49.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcdfc05a-3b5a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692097139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097139, "uuid": "29586ed1-bd27-40da-8d9a-5fbff469a815", "comment": "Malware payload (Mirai)", "value": "10a49b8861e01015b057c267ba65df18", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097139, "uuid": "1ddb92f1-91e6-4f75-af0a-37273660ac0b", "comment": "Malware payload (Mirai)", "value": "c98c4059a5c747b115b1213e9781f61067d453081bb9d043251299815033b05c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097139, "uuid": "d5c6cae0-f96e-4e37-9fe7-6496f2eab74d", "comment": "Malware payload (Mirai)", "value": "5842de7d29eadccab44b627ec7f399f3bb4dea68", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097139, "uuid": "3c87aed3-c120-4cd8-83b9-4b0fbf2e09cb", "comment": "Malware payload (Mirai)", "value": "9019ba583acaa5931e569a683c1afd8f3b5189b2b2ab1ad625b5b1a6fbdc29f4118a1f1d24e00a24e39c0059acef646c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692097139, "uuid": "03cb2ca1-99ad-4c60-aa1f-e8cb2dcd26b4", "value": "T1A2A32A05F9118757C1C327B6F78F47493B3167B997DB33026A34BEB02BC27991A2AA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692097139, "uuid": "8618ab46-6cfd-42df-be51-a22cf2c6cfaf", "value": "3072:7e9h9oZv5hvFfKufS2faYj0+rQ0Knm4XATe:y9wZv5hNfKfpYj0+rQ0Knm4XATe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692097139, "uuid": "5aa99ad9-3c3d-4f78-aeff-c9a1af29c8ad", "value": 103862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692097139, "uuid": "f6d82bd3-2f7c-4092-99db-624564a3938d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692097139, "uuid": "3e9aadaf-541c-4b63-b4e8-ea0ddc7e0b1b", "value": "10a49b8861e01015b057c267ba65df18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea293e51-3b57-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692095927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095927, "uuid": "9192bd4f-a5df-416e-92a3-1afafb30273f", "comment": "Malware payload (AgentTesla)", "value": "6fcf9e4478bbe84764d4c57ed4fe4304", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095927, "uuid": "a8d85823-d4ca-4d74-b6b7-31947ca2d351", "comment": "Malware payload (AgentTesla)", "value": "c9fa6667ce5b3f8bc302baad8e71fe656c71b84adee6ec9b36301e4b670dffec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095927, "uuid": "87e99453-80a4-446d-801f-f1d5238e5165", "comment": "Malware payload (AgentTesla)", "value": "654cef098617b2932294d0f19bfc8909bcb02e1e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095927, "uuid": "ef45167f-e757-4bda-b2f3-642ec9237295", "comment": "Malware payload (AgentTesla)", "value": "db9ae90a61b0bef5ee97a5baf4ca7bdeed5bfe2c3a3d3e1811d1f18738af5736df50604469b235c53b137329e7c1200c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095927, "uuid": "f2bf5fb6-b129-4a81-9c31-e2b64f622329", "value": "T191D43381039423972702B59C5D878290EEFDC8A589D63297CFA2FBF742E24F5576632C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095927, "uuid": "43d51565-eecf-45ed-8829-dcf35a7b3caa", "value": "12288:W3OcEOWi1WQgxlTrDDaCHewIf2CxxpQ+N2IQvB51fQAgWU/W:vjXYWPrXaLpfjxxp9bGBLfjgp/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692095927, "uuid": "1ae45da6-0b7e-498b-947e-44ae580526d3", "value": 606651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692095927, "uuid": "9f576103-35b6-48f0-a6eb-906dc1c7c3ec", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095927, "uuid": "014aa446-5654-4748-8b22-abace04d83d1", "value": "Transaction for USD137.000.jpg (2).r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da2ae2ea-3b71-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692107067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107067, "uuid": "b77177ed-2bda-40af-8abd-fae9cf0e36e1", "comment": "Malware payload", "value": "9409ab5e9f43aaab9df8e760c70dc3f5", "object_relation": "md5", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107067, "uuid": "4db3c170-5064-43ed-8ed4-efc93c3f8c97", "comment": "Malware payload", "value": "cc5118e5a20a10879d7a317a88230bb79d6e875e1059a4e7932a9d9146725b12", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107067, "uuid": "2eecb4c5-c4e9-4c74-82f5-c52b11367800", "comment": "Malware payload", "value": "d754fc2c4d8ed68295794c8093325af2dad13d4c", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107067, "uuid": "ee043881-752f-42fb-8ea8-fd4380cfe401", "comment": "Malware payload", "value": "663f689c4b217cede5f0c82d1c682e2a71d3c99b4c05a602f3fe578756ff82abd91bc3fba56ebb5c8febbb6005f23a8a", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107067, "uuid": "591d9c51-f8a2-4be5-9357-f96d8c782e3b", "value": "T10C4186AF6243346661F321D0CB82AA4AEE6540CF88182704BACCA14BDFD152947B7FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107067, "uuid": "954354f8-49e7-42dc-b8a9-bf595f83fd7a", "value": "48:hhC5C6oYabY2RfpXY2CQpScoX+pQikSEDAKUIPOP:DC5/0YMXfScA+pQhLDA9IPOP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692107067, "uuid": "fbdc5205-162c-430a-ad5c-a22c1b82c947", "value": 2330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692107067, "uuid": "7084f531-0bbc-4468-b25d-052fdd16d5cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107067, "uuid": "dba6c315-db91-4ccc-8bd6-b3a84598ecfa", "value": "h76JaizF.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c94a6b-3b73-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692107816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107816, "uuid": "6e696677-f28d-4155-a761-5ae2fb9a592b", "comment": "Malware payload (AgentTesla)", "value": "eed9aa9ebfe1fc9cf1d2ab73600189cf", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107816, "uuid": "bfc354dd-1ef5-4be1-9e7a-0777cf24ca6c", "comment": "Malware payload (AgentTesla)", "value": "cd5316f92ff101fef71381990a5103107250dfb25fdeb436a4539cb28be2cabd", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107816, "uuid": "ef848395-5fb4-41fe-9c48-227d8f1f85d9", "comment": "Malware payload (AgentTesla)", "value": "2cd18798de76561f4df12084d6ca015c5b7d9e74", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692107816, "uuid": "b78fa18c-4682-4c25-b6ca-173b79e50230", "comment": "Malware payload (AgentTesla)", "value": "368b48da72a66dd177b0a257b171dfbfbbc5d3069deda9f2621ccfd655df9d38d4219eba780d87ff5ce43c38d1e934e5", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107816, "uuid": "96aae77a-c6e2-4491-b80a-c192e915f1e0", "value": "T158353390B1048EF4813C6E7AB2D8A5489014176FAE79ADC1B3ABEDC3294D6D4AD31FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107816, "uuid": "426af22c-e61b-4824-a8ad-72ba5be4844e", "value": "24576:P2p+KbuOgsYmQTB7Ka1HC5/bUmDAuBLisf5azxDhBmaK+vVCLdLkszSxt:PbTsYmQb1HC5hNRfUxDhBjV4keS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692107816, "uuid": "e86fd7aa-4a79-4d30-b743-b8f05595c82c", "value": 1081536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692107816, "uuid": "94d4f665-6321-4b0e-b8f5-70db98a74e1c", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692107816, "uuid": "5f3a7795-7ca3-4616-848c-97037e5d945b", "value": "Dunning letter for account no. USXCZGOLRE.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ddb1fd3-3b63-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692100792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692100792, "uuid": "b7d6f5f6-2d3e-4d1b-83d7-1c3feb7a6a3f", "comment": "Malware payload (Formbook)", "value": "5caade9e8a1281ee68581e53631ec3ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692100792, "uuid": "c61e02e6-1313-4b86-a8f4-42d36b0a7c1d", "comment": "Malware payload (Formbook)", "value": "ce4adf5f77ad3bf554ee6727abfe3c82e49ac5097e4e8d50ba2faba0d05b9c1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692100792, "uuid": "9fcbc8ae-2651-40aa-9643-c2c4de069214", "comment": "Malware payload (Formbook)", "value": "77b9a0f424eed669f235accc64e22519148cd608", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692100792, "uuid": "387bed4f-b514-4097-b078-6fd0e7aef78a", "comment": "Malware payload (Formbook)", "value": "c42d80e89039b4e1b2b0c0eb74f35f7fabf90d4f498f864897df4b42351e3b9a8e0cda11d5dd6cf2566e209ee750ed6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692100792, "uuid": "009f715d-1482-4d30-9580-3edced169a52", "value": "T13634120827A9D843DDB31B320F7E0A679FB269561959221BB754BE087D633C2D60F323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692100792, "uuid": "9b4cada7-963e-43d7-a8c0-7f66b6e10718", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692100792, "uuid": "c37c4c68-5616-4adf-b17d-51bf6b69e4d9", "value": "3072:HfY/TU9fE9PEtu+bkUV+m5g1dBNvUEc4NprW779OXLMJIg6mZKIx6e7Mk1WVsb:/Ya62k1m5g1pUcc776xmgpk1esb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692100792, "uuid": "9a104518-88e8-4afb-957e-53af14168b8e", "value": 242973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692100792, "uuid": "b44ff33f-cd38-4773-893c-284550e6f3da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692100792, "uuid": "4ebfcb0c-de26-43f2-9cd2-50e176c753d1", "value": "Kaas Order 2023 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e184dd97-3bbc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692139291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692139291, "uuid": "ca134159-591d-42df-9c2f-56763fd341e2", "comment": "Malware payload (Mirai)", "value": "9fcc50f03e35f99b524b401815e044a9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692139291, "uuid": "8143fd4e-158d-4fe9-9e86-62f237c81a8c", "comment": "Malware payload (Mirai)", "value": "cf82ef147dc6b1c8900114ee61cb4efcec270eeaafeaf29feb3786a7a07bc760", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692139291, "uuid": "92375963-40bd-4802-9a4e-d030a7253633", "comment": "Malware payload (Mirai)", "value": "86142aea44a48fd53d960003c1c7fa895cb537a9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692139291, "uuid": "2f63e076-161c-45b3-aff2-1105907387d9", "comment": "Malware payload (Mirai)", "value": "792bbb179b82b71e7978690f534d17ef0d13f87b55c6387184a3c1f5b88aa76e1b39ee824483fe7951f2108e77dea54f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692139291, "uuid": "d8ac7704-3341-4764-8301-026a8bbd8ec9", "value": "T17EF3C81AAF510FBBDCAFDD3706E90B0239CC954722A43B763674D528F54A50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692139291, "uuid": "cdafb086-bdff-4d65-a6ea-fd0fce5283dd", "value": "1536:V/3/TXzzhbCMg8nDOepfgaULH5XcF/9An2kk1IZtAU4Fk4AR39W2kD8zhVtFZ3q+:V/3/TDi8DBdgasfkIppR39pk2Z3qs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692139291, "uuid": "0a94cf3e-1cf4-456b-a379-adcb306c2055", "value": 169640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692139291, "uuid": "ddf67358-c8cd-4a84-850b-8913f6e0595b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692139291, "uuid": "3181b52f-5e13-4490-9192-f8f748fa98c3", "value": "cundi.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2be12a54-3b65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692101620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101620, "uuid": "dc3fcc1d-540f-454c-8f98-d3528cc09206", "comment": "Malware payload (AgentTesla)", "value": "01789699273f4aea7727a2418c35e950", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101620, "uuid": "67e32f8f-c8ac-4cb6-9698-9cb50c0aac72", "comment": "Malware payload (AgentTesla)", "value": "cfb335616aa41e22de5585d65550e306e2eca30e177cc612c4d2fbded3c37b58", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101620, "uuid": "0c853454-35f4-4484-af13-68e60ae2091d", "comment": "Malware payload (AgentTesla)", "value": "f5ddbb7be57663f948cd477aaaeb185f5170bc2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101620, "uuid": "a0762781-9b92-406e-91db-b6e975769226", "comment": "Malware payload (AgentTesla)", "value": "4db00f303af46596f080b4ef7c1fcaaca668c42eb1645b52b4ae8198f31b965db1fb4f1d71d5d384f49cea910f7c85ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101620, "uuid": "87ef381b-909e-4b3c-b01c-03f664aa71aa", "value": "T1F8C4236425F17DDA3243AE4328D42601C5DA30EE1741D2A4FC64A66D2BDFC593FFA3A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101620, "uuid": "9c42fa57-bc01-4477-a021-e4e541030316", "value": "12288:yv/fhme3RaJfMmOgaFBektBmgmakdKIe49e5uZU7Uq53ixu4Hb7rf6ZW:yv/Jm1DOgkjkfc1Me5yk+7rfMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692101620, "uuid": "e9e06527-ce0b-4ba5-9a43-28e192a15e66", "value": 558364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692101620, "uuid": "ed17c6b8-2c92-4f92-a0a5-0cea412b9427", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101620, "uuid": "7311ff56-ed9e-4322-9957-09ffb7f2ac9b", "value": "CONTAINER LOADING PLAN ETD 08 AUG.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f96096a-3b65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1692101627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101627, "uuid": "0573d24b-9ce8-42a6-9943-3f0bbb8576b9", "comment": "Malware payload (AsyncRAT)", "value": "21015e2201b040273b57cace6491274a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101627, "uuid": "606a14f2-ca25-4f59-809d-a1673c64d69d", "comment": "Malware payload (AsyncRAT)", "value": "d04ef814be9cdabc8c537610e476a2d3174c54c4a38f0e960e291a9bc424a36f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101627, "uuid": "a4d989ac-cca5-430f-b574-cc3e338d336e", "comment": "Malware payload (AsyncRAT)", "value": "2fbef0384f5d58df05bf5b321b1c2f2638c099b5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101627, "uuid": "9931d56d-e71e-40ec-a5fa-e47b123f4213", "comment": "Malware payload (AsyncRAT)", "value": "7ac270c65f0c4f0a44d4946e12731f69b19bb273ceba87f794ae2963c392a21e3b71def70d805efef403cfa5e01c54d1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101627, "uuid": "c635a3ca-539e-403d-a1c5-e93a6f87d9d7", "value": "T174563306CF812B4AC86D1D34C05614DC83F1C7B3B6A2E6EE4EC461DE97A5AB7DD620C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101627, "uuid": "780fb83f-5ff0-441f-82d0-9710bd43d633", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101627, "uuid": "6e67d716-0b9a-49d1-8f97-903400e1bd7c", "value": "98304:RLPxcgj3GBceyDOfBmkvigwf6Dg8KoEE+VoWqoP6oBTpSb6oMQK:pPtGGe9JEyE2AfospKMQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692101627, "uuid": "fc1d7e94-333c-48d1-9f6f-07b63d29d6b4", "value": 6250496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692101627, "uuid": "73052494-e0c9-410a-bc2a-14e9e9fc9843", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101627, "uuid": "84003a64-5cd5-4509-b8c9-fc524b089b43", "value": "21015e2201b040273b57cace6491274a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add0af3d-3b3e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692085088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692085088, "uuid": "f6711060-8c1b-45d5-9c1f-30a64c860482", "comment": "Malware payload (AgentTesla)", "value": "02e6889cff15151b982839a59cbb5684", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692085088, "uuid": "56910fb3-3138-4286-aaab-21555c0ff84f", "comment": "Malware payload (AgentTesla)", "value": "d085da1dfe9326930a8b1c857430313536ce3983058083689d5c5dbf8aae7394", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692085088, "uuid": "51f5dcae-2ff6-4d2d-8558-06cee6d5f004", "comment": "Malware payload (AgentTesla)", "value": "2bb331301b34c264f989e61d84bdbb7a0e3f7385", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692085088, "uuid": "c34c4c33-b368-4ee0-abd1-6f41ec3d40f3", "comment": "Malware payload (AgentTesla)", "value": "b14592af8c8fc36dc272d4db5b10241afab1bc4e3c1abace3b4491cf937ea043335900989ad73c9b73bfedb807c5d061", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692085088, "uuid": "c4520550-9474-4739-a40f-dc2f0acc1218", "value": "T1E7C423370CB9558212511722745B5224BE8E362FFC6B078BA9EC2B9A1F7928D439861F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692085088, "uuid": "9d2c05bd-6483-4917-91be-be3ca079b749", "value": "12288:2gCNnAoybXQ00yAxMUrcTANJguOjitJeLDwdwdAQ2E5fE4P/HPB:GNnV00yA2UrcTANJgubtoWOE4PvPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692085088, "uuid": "0805dac0-af73-4dd9-86b2-0405bf28e68f", "value": 570115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692085088, "uuid": "eb66acb8-a522-4396-8d0b-fad6b889d019", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692085088, "uuid": "28311ce0-f90b-486f-908e-b33f0f793da5", "value": "PO H0001.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50c2f294-3b3d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692084502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692084502, "uuid": "e111a9c8-7ccd-4c15-90c0-573dfbce5d4e", "comment": "Malware payload (AgentTesla)", "value": "98bb403612f7b703221cf8ff8024a2f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692084502, "uuid": "c752eb47-90bc-47b3-9d48-ea2047ac4adf", "comment": "Malware payload (AgentTesla)", "value": "d1fcb7d17c9a3b228c9ae974d5ec478212c77eb17f4abff26c400f92dc42a6d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692084502, "uuid": "9222f9f5-dcef-4679-98f9-d9bbcd8fbfb1", "comment": "Malware payload (AgentTesla)", "value": "d5ae4208fe0f8de0def874148de4bd6c6b3b0ac0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692084502, "uuid": "58e6be8f-8fdf-4227-a08b-cd2fa5154114", "comment": "Malware payload (AgentTesla)", "value": "dc8e6e2d26187a7ef6307221cbfd02e468122859d10f22801047e78f2fadbb31b3d0f1534f1661d3c6081ec4c36f6ea7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692084502, "uuid": "f04496eb-5818-46ac-9308-67591236f777", "value": "T186F423B134BDF734CE9B1A77185261445370DF53AADDFB6BACE4304298D3309A4A292E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692084502, "uuid": "be6986a8-f919-42ce-88f8-81f564162e5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692084502, "uuid": "861367d3-c69c-4d2e-85b7-0af40002c457", "value": "12288:4qq8jW8aZZQ4UZ+9DHIowluNPuQtCBipQLpvmUMykv0V56/qUVQ0p+1j2lj5:1qCW874C+9Doowludhty5CykvA56/qK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692084502, "uuid": "fb5a5384-a8a9-40b3-9cb2-2049324aebdd", "value": 777216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692084502, "uuid": "47e5bbf7-052a-483e-9c17-cc001569db61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692084502, "uuid": "cf034219-ff1b-4761-8ba4-1002cb7efccb", "value": "Overdue OA payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea5ad04-3b7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692110993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110993, "uuid": "ccb874a3-70fe-4843-878f-aa6bf4ff2bc3", "comment": "Malware payload", "value": "ccf16ec83b2e2d77d5d0e3c59a047b87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110993, "uuid": "1c013ef1-91da-4b34-8817-d7c4f12e2f3f", "comment": "Malware payload", "value": "d45f14f2b2ac33d6f763d35f8ec0aa8bc531fb5a683aff22d70fa263dbcbf3bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110993, "uuid": "972b574a-3b89-4859-892a-f37b20321d73", "comment": "Malware payload", "value": "39090c8d6c19daf586017f31e620820e29594e3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110993, "uuid": "69331cfd-fe18-4550-888a-dd25b4090199", "comment": "Malware payload", "value": "b746f6d98f838f50458ee2149088098385f5297f59a3abcccd9ce098587d900c2d311cc868cc7a0cd2a6939ebf63883f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110993, "uuid": "75a0588b-cab8-4670-996d-50c61739db3f", "value": "T156237D403798C136E2FD4BB5ADF3E2458675D66B5903CA492CC814AA2F13FC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110993, "uuid": "ee027560-e8fe-4da6-a32a-1a44898a27ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110993, "uuid": "b75f6bf1-c855-4b0d-97ff-eebac47b36e6", "value": "768:59umxLiIL1CaS+DivPg3ZEiq78YbkgeG6TsHb4KnvEgK/JXZVc6KN:59uAPWv8OzbryQHb4KnnkJXZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692110993, "uuid": "b300f29d-7c13-4b3d-a920-2b55efbeabf8", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692110993, "uuid": "997ea7ff-94b4-4296-9378-dbefd743366f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110993, "uuid": "f4371319-1b72-4482-81db-0509349d92f4", "value": "decode_7b868e06ec063bd21697f2add18e6a340f8217c8092f1671c36189c2cea7c334", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2631f67-3b7b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692111402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111402, "uuid": "e4304c40-3a34-4a73-a216-db30fd8ed01a", "comment": "Malware payload", "value": "19886119e58f4ca36a4a5e0bc24dee90", "object_relation": "md5", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111402, "uuid": "44b0c6ea-7f02-4fed-bb3e-9434154eb840", "comment": "Malware payload", "value": "d4616bce65406b3eeb3eb7d5a918db92dbb9abdc2b26c7fdfbf387609fe46fe9", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111402, "uuid": "5987e19b-80b9-4b5f-af73-d44cc375ed05", "comment": "Malware payload", "value": "f97b608748b5949e96749f7cd9587b249d1485b1", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111402, "uuid": "7b00ecbd-168d-4223-90e1-be799df74cd6", "comment": "Malware payload", "value": "8806d0a6976be07bb1c40e9bf9833125aef7415e249d59e66c44d3cb9118069b19fa1e1ffe3259617003c4be8ad4fffb", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111402, "uuid": "44cca5c0-9f71-4f82-87f7-08dad82c014d", "value": "T1D84178F3F723C0D44576A67BACA79089AF78806D0011190A76DDC89AE7B19705271F87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111402, "uuid": "e48199b0-a24e-44ef-b571-98c3fdbe6f35", "value": "48:8cBI8Xr1Vje11Z9IYb19Z/cPFFpgfqpg4:8ajXrLGZB191C5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692111402, "uuid": "54dfbc68-0561-4302-bb3e-4d66cd625f46", "value": 1930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692111402, "uuid": "a6aa3319-feb3-4d4d-935c-eb4cc1179ab8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111402, "uuid": "4eee5551-0f46-4b06-958e-d221e7e412e5", "value": "zimhCRWa.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17dc4d05-3b7c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692111465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111465, "uuid": "6e203160-c88b-4512-9235-f8832e5786e1", "comment": "Malware payload", "value": "212e0266dc50a2adc152c986574cd647", "object_relation": "md5", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111465, "uuid": "536d4b5f-9557-4906-bed5-680385a037f9", "comment": "Malware payload", "value": "d508d9120671f7119d955a7fd1ea5463fb4545ef5ba327002422c68df9eaced1", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111465, "uuid": "5109c5bf-e8c0-42c4-9e4e-cd140e990946", "comment": "Malware payload", "value": "f3efb06494171932cfcab331e4d7b34b00168b8d", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111465, "uuid": "ed4675b4-960c-49bf-93d1-14488d9222b6", "comment": "Malware payload", "value": "5a35f08d64257678fd6102e2e4ab86773c8c04a7deb1b0089ec4cf14c251a0f18051e07494947f76227fccd435660522", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111465, "uuid": "741860cb-aef6-4187-a582-c4ee42280295", "value": "T15A11DDF66B1E5012C9F1CB521D47925ECF6480A254C40A01B4FD4E70EF39127A39FAC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111465, "uuid": "5e14e855-0112-4976-b486-088e7074af7e", "value": "24:KOVtyCiUomIEESsFTxnswvpdPNuR71q2z8JAh/:KOVtyCiU80sFXFMqcr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692111465, "uuid": "0206c218-83dd-404e-9c32-c80cb578570f", "value": 1066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692111465, "uuid": "53ba0bb0-6958-420a-bd57-b415c346d50d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111465, "uuid": "d921dd8d-98a3-4908-9821-f3510e56f04c", "value": "TLjdEuW3.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1850603e-3b87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LockBit)", "timestamp": 1692116190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692116190, "uuid": "8310fb65-aeeb-4dc3-a873-d55e7e6f4fe3", "comment": "Malware payload (LockBit)", "value": "fc5b359d88f007f1e44c16a03b5d5809", "object_relation": "md5", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692116190, "uuid": "7502bd57-df79-4ae1-8c6b-006925f4963c", "comment": "Malware payload (LockBit)", "value": "d61fa625288f6f8786399c821fb51ec220a1de1877115521f206306b89461d83", "object_relation": "sha256", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692116190, "uuid": "8e270219-6a30-49b7-bba4-c59bf966223b", "comment": "Malware payload (LockBit)", "value": "2c590ee4f3e50b0451bc83b2f203f6d22c395354", "object_relation": "sha1", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692116190, "uuid": "bab69ba1-52dc-4495-9b5c-03cfdb8d8eee", "comment": "Malware payload (LockBit)", "value": "c6a1a153a7af393c31cf06ba64bc1cd3e3adb81b7cee67788285db175ef4ea06499077091c58fc820d5b571956aa86fb", "object_relation": "sha3-384", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692116190, "uuid": "55950ad1-74c3-4e91-979a-f332ed70f850", "value": "T1AC94234371028E058802FA5FA14F2E6A1432561E61DCC5F25E39F42F587AD8AD972BFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692116190, "uuid": "9007d8a4-e3d2-42a8-9122-ff3bdacf5a3a", "value": "6144:dtWM/4a/5vpMPS05rAh76668AkkNzEjHaA45XqJv44pu5oRqSBUT1ahSun7y45/1:3D/5vRhTAxlA+6JQJAUBSln7yg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692116190, "uuid": "30e1a899-1904-41e4-b371-bf5265a7919a", "value": 432528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692116190, "uuid": "c3cc6219-07b8-4815-b3be-503d30a3338f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692116190, "uuid": "3810a911-f854-4e9f-917f-e4f3088d7324", "value": "LBG_test.com_C3F7B91F25992E56_15.08.23_test.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad3c51a3-3b2c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692077356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692077356, "uuid": "5ef4be7d-8e0b-4916-97db-3cd3f8af1ac1", "comment": "Malware payload (AgentTesla)", "value": "466e70506baa400950508bc146f99777", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692077356, "uuid": "8cebde0b-a681-4c6b-8087-ec1979aad66b", "comment": "Malware payload (AgentTesla)", "value": "d673da702f9563319695b289a4d89e7a7fe7930ec385d6e64b906a8cd56d090d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692077356, "uuid": "9092252b-95f7-4225-a91e-b44052087ff2", "comment": "Malware payload (AgentTesla)", "value": "25bc943dbfca37b5c99715903a0aa1625beb560a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692077356, "uuid": "2ded42e5-6666-4158-8965-884208552c10", "comment": "Malware payload (AgentTesla)", "value": "bfccc95bac238005336649436eac064d9fc7558e6b08fff53a721ed2f77f0f0442f841de40ea6366089e169e22daa7cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692077356, "uuid": "952f4d54-d4b6-4208-aa8e-9171a78ddc93", "value": "T12625F60059760096EF3D267D1A63573DB8BC1D5361F2C5E8AB2726D38DC3012CEA9BE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692077356, "uuid": "529dd3b5-55af-422f-bd15-684ca447c886", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692077356, "uuid": "d322faba-16d3-4649-915a-5f12438e7138", "value": "24576:0vr4hNPIWDpppXpppppCOopppXpppppCOUBk33yjH+MEwVZxR6xqv:G4IxO/OUBUyj7E4Zx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692077356, "uuid": "510d974c-79d3-4516-a6a4-73b0e83f5912", "value": 973824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692077356, "uuid": "88a6d93e-490e-4fbd-a870-2b2e6bb66190", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692077356, "uuid": "aaa3758a-d85c-460d-b931-85cb7fed61b9", "value": "SecuriteInfo.com.Win32.PWSX-gen.8795.29053", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "388c64b4-3b87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692116245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692116245, "uuid": "1119b597-a171-45cc-b453-46a1ec42fbe6", "comment": "Malware payload (AgentTesla)", "value": "505bfbffcb637df3a1f6fda75a35d488", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692116245, "uuid": "f1a6edbd-554c-4d5b-80d6-9792f0f6b3d9", "comment": "Malware payload (AgentTesla)", "value": "d78769b26e77516795f357967d1ebac5921db94f4a84185386672c550a498be6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692116245, "uuid": "45aa260b-307f-457d-bd3f-0b6c241c2753", "comment": "Malware payload (AgentTesla)", "value": "d12ad2b4c11e717e6720f15ee578de7ab065a56f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692116245, "uuid": "ca75f311-a8d3-4fd8-913c-c5788552c424", "comment": "Malware payload (AgentTesla)", "value": "9bd5ce3bf5b765137ec8b6f2b32d9796328e2ba6ccc9ffe2c45c2640de2c8aaa7aeaa9fd2683469ec9ea63e7e5b2a2ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692116245, "uuid": "6ebdd455-79ff-4964-9c55-3008df10b449", "value": "T14AD4220AB73C6F22D13ED3F96812154587756E8B2A32D36CCDA210C736A5F916B90F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692116245, "uuid": "70422941-6f75-4771-a71a-8d2351b4cedd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692116245, "uuid": "c44e2bb9-03ff-4741-ad59-d3ebe3ec7ef2", "value": "12288:/yHaV/Oe9Dfw13SO7oMeK/6RSs3XFvKkA3BgfTQtGHDyKDcQR:/yFepYiOfsR3XFvqxUTQgHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692116245, "uuid": "ba1f2307-99bc-4722-907c-1c320944c7b9", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692116245, "uuid": "6a362d0c-4d46-4a22-b97f-c0da21654572", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692116245, "uuid": "e81315dd-a3e6-46e7-8eee-43e5b3e41159", "value": "invoice copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af9663d6-3b5a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1692097117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097117, "uuid": "92e7403d-6c03-4572-9169-09f30df8e321", "comment": "Malware payload (Gafgyt)", "value": "45508800e079a18e779476063ac2a7f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097117, "uuid": "946b44bd-7bc7-44e2-a47e-8743b8b5869d", "comment": "Malware payload (Gafgyt)", "value": "d80be2cee5d2aad0d5f7eb5f68fb76cf9493343a4df465c125325f50e9e02dd0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097117, "uuid": "b56a7ee7-8376-4727-b754-ea5c29a9095a", "comment": "Malware payload (Gafgyt)", "value": "f1ce5fdcfb05f73d83bac316764e00d76260b906", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097117, "uuid": "68791599-0903-4b50-829f-085e7d604545", "comment": "Malware payload (Gafgyt)", "value": "90101ee6346367067f4744036ecbddc476e18a28236070076cf0cfce5724719e21e140a2a8fca0f340e4e894ea178824", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692097117, "uuid": "1aae84b4-1b1a-4150-a12d-4a758886d307", "value": "T1C4A33A37BB130A23C0CA547212E30731BBB5D3D928FA5247BAA16DEC6F166803566FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692097117, "uuid": "1c1cb5e6-219c-4c27-b84d-41375df3add4", "value": "1536:xfRuqNM5h7t/RiRt4nWphaQoRKzO6F6OXj6ufeRTe:OqN8jRiRRphaQoRKzO6F6OXGufcTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692097117, "uuid": "f8f909e3-5d88-4d31-8658-634e63d3147d", "value": 102442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692097117, "uuid": "89806f86-a98f-41ee-8f06-ca2eb11d8ff8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692097117, "uuid": "03ac779b-454c-4ce2-9e55-50e49e2e5c8a", "value": "45508800e079a18e779476063ac2a7f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab43f39-3b67-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692102665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102665, "uuid": "53cb8600-f6c4-410c-90dd-28fc4884d5fb", "comment": "Malware payload (AgentTesla)", "value": "d78d90977bd9addab19038a3367f7804", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102665, "uuid": "66854583-9cf6-43d9-9cc2-a286d9c8f8e2", "comment": "Malware payload (AgentTesla)", "value": "d88ca1dd2194d68703b49f6aeb18e8d2a08132d5f348b9d0cfaa96b90a87384d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102665, "uuid": "32a36119-6d57-4385-bb56-2ced11bc8e8c", "comment": "Malware payload (AgentTesla)", "value": "6dd92106494804fedff7c76d8f94b0bf63c50ef6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692102665, "uuid": "cecbc41e-e339-452b-96a0-985d2ebe8704", "comment": "Malware payload (AgentTesla)", "value": "b3fd13e420a8f0d3be0b0035ecda114a9aad6f7d2e44cc17c7123babac12d7a9de8f62110b6dec35df8d4e98036573b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102665, "uuid": "bc7549a2-f6d8-42a4-a878-5b9046327c4c", "value": "T19DB41204B6BC2F52D5BAD3F9CA10855643B8656FA573E34C9EE270D60E26B201B11F2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102665, "uuid": "35aa84d4-6e2e-4e4b-b22f-6306fdd251f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102665, "uuid": "cac7451d-9717-41bf-86b6-a22572e86535", "value": "12288:WyFV/OUAdO5DrcMFfsuS65OsYQiAZZXH/KmizaGhtD5ph0toL:WyyjdO58+sf6kJmimizRDhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692102665, "uuid": "717de05c-6ce5-45e7-955f-f5e980d1f825", "value": 540160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692102665, "uuid": "cbba3db8-e991-4300-b1a5-b5872c46b3c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692102665, "uuid": "33f44cf4-3d66-4b62-8e79-e80d4eb33ce8", "value": "d78d90977bd9addab19038a3367f7804", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf762f2-3b47-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692088976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692088976, "uuid": "58d6e7b8-2b98-4a2c-b652-35fb7128cf7f", "comment": "Malware payload (AgentTesla)", "value": "db1fd83e3a974fd10434471ed0f327e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692088976, "uuid": "a480ed50-68af-4e30-af04-11c8e7630595", "comment": "Malware payload (AgentTesla)", "value": "d937b12e3eb1af2267ec3056f84a62d66f620273a068820b9c650b42391365ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692088976, "uuid": "47d09764-d16d-4020-b1e5-fd1d60a93ac6", "comment": "Malware payload (AgentTesla)", "value": "0da2cfd97df2fa8cb4baf57665670ab528101fb9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692088976, "uuid": "d08d5e51-de86-4b4b-9995-d30f63a23699", "comment": "Malware payload (AgentTesla)", "value": "71c2b9c62aceec1106e3ab2dc4bc91e3d280d2633b48a9f668e27ca505a8d01a6b3df3d9e7497542273aa94a7dfbe408", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692088976, "uuid": "a0ecdea0-380c-4127-8d0b-5ad0d3507c67", "value": "T1CEE3170BB78B87B2C6410739D6EB52104374D79BF363C24BB08DA3161B137E9A97664B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692088976, "uuid": "80b9ae00-c3da-4b25-809a-81c63c16fbad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692088976, "uuid": "0674fd77-3867-44cd-9188-bf2fbfd05a96", "value": "1536:nHJNA3mEUR1WLJtuWJEwofBydR8feSNV15DVQA2pG9VmVGMonFNdl5PAaZ/Sv939:Hk3rURItwWJ7os6NvlgY9UjufhAP8tG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692088976, "uuid": "317af259-c693-47d4-9790-f65031342793", "value": 155136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692088976, "uuid": "27434dfc-323a-4434-8e58-ab667e0b1ea8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692088976, "uuid": "98096b49-d556-4132-b172-a0c9abadb04e", "value": "PO_08152023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be5b52bb-3b60-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Blackmoon)", "timestamp": 1692099719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692099719, "uuid": "258c64be-f477-45b1-acb7-700be5f3b874", "comment": "Malware payload (Blackmoon)", "value": "5c8358c87a869fe25557566d0de77ce1", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692099719, "uuid": "6d712b3d-1bd3-4911-b04d-556c34d5c31c", "comment": "Malware payload (Blackmoon)", "value": "d9a9a5a6a320d4c5922ddad4d083c9c8480e89b21bd4a1859c6f2effeb6c419a", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692099719, "uuid": "0c2a2d46-5e02-4b99-b56d-5cc3e829af44", "comment": "Malware payload (Blackmoon)", "value": "5d32e29ff462df91fe36b2dbeeaf4dd6bf0ac9cf", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692099719, "uuid": "f5bca7e3-77e0-4c94-a58f-be5b0559e8a4", "comment": "Malware payload (Blackmoon)", "value": "7ad793fa4febfcf050653e3d374e644d102ea3ae73cdc8fdcfc9b6ed91854b2aae4206b0f296daf3a3c783c2c759af4d", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692099719, "uuid": "02f064eb-2aa3-4195-8e9b-417d380aeb9a", "value": "T16B057C986C80AC5EF3E859F166A6FAE410EE4F949DCC500EA5D4EE8F3D7FADB1420411", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692099719, "uuid": "0473a7b1-5aeb-425e-9da5-c1f101b4debe", "value": "858c3161847e1552d45ef2a1c68d4fe3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692099719, "uuid": "b3211de7-8095-4178-95f6-bc202b6da8e6", "value": "12288:ypQfW2/Rsn/Uvf+PQzxhbPkQayP2K8yI6DMt++VV43Q/7FpRIze:mD2pFvgixh7B+Kk6DOy3Q/Ke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692099719, "uuid": "b1df05e6-e9b3-47ee-b86e-3db9012dbec4", "value": 824832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692099719, "uuid": "5c6c564b-62a3-4280-9d1e-7c71c26dcd8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692099719, "uuid": "3d03d6d8-4bcf-40fa-b4d2-041a9d1ac2ed", "value": "SecuriteInfo.com.FileRepMalware.26467.10529", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cfc8964-3b69-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692103340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103340, "uuid": "b06660c4-22f3-4842-b40e-fd8d50ee2424", "comment": "Malware payload (AgentTesla)", "value": "ba64ba13b5ab09b06a7f192eadeed5b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103340, "uuid": "898faca8-3cf6-48aa-94e4-0317f0af34d8", "comment": "Malware payload (AgentTesla)", "value": "da795a34307c4aba4f6c0c08d4c88c8de35ab1d919f834e4901aea42a35a1562", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103340, "uuid": "667f023c-1fff-431c-97a4-6758cbbf93a9", "comment": "Malware payload (AgentTesla)", "value": "0ad7f5b07e7bb6c2cda816d973f67a08771cbd58", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103340, "uuid": "3af4c1fa-7110-403d-adc0-d76813f4007a", "comment": "Malware payload (AgentTesla)", "value": "1837e9bd3a850603411dc6b28ba8c55d9e20052386eadb7207c85a85d9cc474dd811db452c082f8e97c6177945f30aa1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103340, "uuid": "682b9e90-799e-4c0d-a075-205c64caaca6", "value": "T1A8F3080FBA4A95BDD9410F79C69B7218C364DE9EB333C34B714D23B21B027E9966520B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103340, "uuid": "0648bddc-5088-4deb-9e9b-96867ce03ab7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103340, "uuid": "2a1e5f41-2753-45c7-96f4-970d3735756b", "value": "3072:V3VHTTniiaFk3lVf2OClv5Rb1VBeZsfhAP8tx:V3hHnihkrf2pTbnVAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103340, "uuid": "8da23a6c-59a4-4779-a24e-49951fb23f87", "value": 158720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103340, "uuid": "0f437c82-5740-40cc-8957-05e63e53ba97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103340, "uuid": "ec3cea21-afcf-4471-a13c-c11c58b8084e", "value": "VergiOdemesi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4415e56-3b5c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692097957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097957, "uuid": "b027a79a-f442-4834-9f0f-cd50091c1148", "comment": "Malware payload (Formbook)", "value": "07fbb97d08d871a849e1220875fb87cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097957, "uuid": "57c115aa-371f-4140-8bb3-647d5e62a83b", "comment": "Malware payload (Formbook)", "value": "dade1a3b53b651efe40452781b07585baab2f75133c1d8be528a4ebb942b595e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097957, "uuid": "b63c24bc-cb9e-4004-8fa7-9cfaf429379a", "comment": "Malware payload (Formbook)", "value": "21adb43dbb43ca4bfa8b61fba1f409adeb1f481b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097957, "uuid": "bd71aa87-89ba-4fc5-ba57-fe6f7e0af80f", "comment": "Malware payload (Formbook)", "value": "cd9d84e93fb6588a52fb920edde35a973131411172d198c99335cf65989f2ef03aae6636cdd40a44d45bc4cd39cca6d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692097957, "uuid": "0149f870-d870-42b5-a835-2b561b427054", "value": "T1A5C42209B0BC9F23D97ED3FB25518C9907B0A52F6261E3DE9EE220D02A617951B51F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692097957, "uuid": "8cc5d16b-1da0-4c53-9c65-f75cd4612792", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692097957, "uuid": "972d435f-9665-41fb-8fbb-9c1b7b8302fe", "value": "12288:nyBV/O6NRlJb6tzSyyKyefNLfr/tytpWLpTsXo5PDmVx5QSjZtws9:nyO6NRI+VKyeFLfrFDpTsXo5PGxbws9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692097957, "uuid": "873845df-3cd5-4b3e-9e61-a7133e5479b1", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692097957, "uuid": "c2fad835-17a5-4dbf-83f6-b4137caa24de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692097957, "uuid": "8dcf3048-69cb-47f3-b03c-17d4b8eaa4b1", "value": "0045.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e6a2f1-3b57-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692095673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095673, "uuid": "4e0c3570-8155-4a6f-bc1c-8c88328bbaca", "comment": "Malware payload (AgentTesla)", "value": "79747753f64e2bd81a488214af41b3f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095673, "uuid": "95d3e5c9-af4f-496d-8948-5601f5509be4", "comment": "Malware payload (AgentTesla)", "value": "dc72c3da125cac80b5cafb89d523c7b77b357f551fa4366efcd1fd83b568e942", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095673, "uuid": "aa479c0a-1285-4c2f-8767-90fd6a6f324a", "comment": "Malware payload (AgentTesla)", "value": "07e56abca89e7db93f8a0d82ea2bb0b31ec814a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095673, "uuid": "05b8deaf-fff9-4acc-afbb-7c45b0dc0215", "comment": "Malware payload (AgentTesla)", "value": "9388258616a892d216d56d84a5a37b3c80ebd01428227af99ea7d535314b52f7e8216cc8da4c1c38e8e43ed5793ff398", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095673, "uuid": "b6369c82-61db-46b9-a848-bbed12218c1d", "value": "T1E7B41218F2FD3B26C17AD7F9506149B903B8BDA6B552E21DCCE320D20D64B906B81F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095673, "uuid": "431f3a6c-4630-4b46-bb0c-32fd83053b3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095673, "uuid": "edf07024-1275-4bba-8128-bbcb70d392c7", "value": "12288:9yWV/Os3341y2HD/bsPze+NcHszLAERP714+1TjnD:9yRHy2jzsL7TlRP5VN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692095673, "uuid": "09e27e37-61e4-45b4-bb79-3592d7e720a4", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692095673, "uuid": "63499b13-49b4-4870-8924-a07cebb7d84f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095673, "uuid": "f9605596-bc74-4f57-b0aa-164df637fc1f", "value": "SecuriteInfo.com.Trojan.PackedNET.2273.21950.25588", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe68cb7-3b69-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692103318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103318, "uuid": "18be7b51-c8c7-4f41-b27d-88dc23f051b7", "comment": "Malware payload (AgentTesla)", "value": "5689ad77747f797c7fce700583f816a4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103318, "uuid": "5d79aaa0-8cd4-4871-b8b9-8ba36ef173a2", "comment": "Malware payload (AgentTesla)", "value": "dc7443935ed909e177df4ee104aa44d63ae47cf482b2d03fe0cff0bc3a1fbfc7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103318, "uuid": "fff5af2f-8c82-49a1-a12f-bbde953d24b1", "comment": "Malware payload (AgentTesla)", "value": "0c50fdc9f2e15c8a08c55d4eb4677282e544de4d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103318, "uuid": "61a0f7a9-0052-47f4-9b69-f60dca0a2b44", "comment": "Malware payload (AgentTesla)", "value": "042e601d0747da329988eef869d55d68de4e46b7d5f3f12e9a0983cd2fa14d8f01e329208361dda9832ace1e1e293189", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103318, "uuid": "f44a72ef-a6fc-48a5-a2d3-3d8240f9ac30", "value": "T124D4230B586A176F79EE992AC8C40FB1FA1B23175C5F2FD0B53B483C46514831DCAA6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103318, "uuid": "7d08d2be-6f2a-43c5-b6bb-3c5347e578d6", "value": "12288:ITIKpW2H8A00G0lx3dgcxaCnF/FrIVN7CbT3AR3fkO15GrnxV60fus/y2:EIKpW2H8A/b3aK5IRfDdCl/y2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103318, "uuid": "4fc95638-3c3b-42a1-9484-ab6d5bbca795", "value": 639918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103318, "uuid": "27bd4a72-db36-492b-b5bb-85d66f91600d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103318, "uuid": "f9f0cf49-a998-410c-82e8-324cd29fbb83", "value": "NUEVO PEDIDO - CF0002.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00bce9b3-3b4d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692091240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692091240, "uuid": "0e39719a-4daa-49fa-b8be-a066e82d3d81", "comment": "Malware payload (AgentTesla)", "value": "51341bb801e5d6b9804ab4d3fb74301a", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692091240, "uuid": "62723cf0-ec87-47e6-bd39-6ad033a43250", "comment": "Malware payload (AgentTesla)", "value": "dd80004119d19214664bcf3a51cd2f6139338aab132b42d273cbfb002cfd5f21", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692091240, "uuid": "cd1d7e97-3487-4477-b19a-21c6a546a8c9", "comment": "Malware payload (AgentTesla)", "value": "2a8119a672efa49b26fe4fe2c8a0053b3c427242", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692091240, "uuid": "1ee18c45-48c7-4ec2-9b3a-d44ad8663ef3", "comment": "Malware payload (AgentTesla)", "value": "7f0ffb356633dc052781f059613d3eb00809fd2f02caaf8a65c939b65c92dfed9f33ee65ab6f4a9237b9e4366b336f31", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692091240, "uuid": "c5c78ff8-e8ea-440a-a8f5-1ae87696de97", "value": "T17E2533D163CD4C11604B49FB803AE690479912EC4C7679D6EF4BAB834425FF9EA93F0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692091240, "uuid": "6dd2f56c-1c27-4eb0-9e9c-e5e127e52bed", "value": "24576:nnmOgrSN4YeZrEcvhZYHFj5axxDrCgboQHVhEm7YAeN:n2rK4YedEIfcjaxDrC+HVsZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692091240, "uuid": "b591a9ca-eca0-440c-a907-45294e3edc75", "value": 973036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692091240, "uuid": "27606314-fb03-4c6b-b446-f03533138980", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692091240, "uuid": "f7e057e1-0dc6-4196-9a05-624452e23518", "value": "Purchase Order_sk1109811.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "093e0683-3b77-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692109293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692109293, "uuid": "5c7a8e64-9ed7-4af8-b3a5-84d39549b396", "comment": "Malware payload", "value": "8ef3946d648fa916053375d12fcddb93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692109293, "uuid": "c2046092-30c1-4046-921d-b3f3fbfbc1cd", "comment": "Malware payload", "value": "dd90752743e7c85b5b51d66e6a203c6744404a9112ecf5a595ff09c3ecb273fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692109293, "uuid": "c65ea01b-2547-4feb-9f60-7f48d49445ac", "comment": "Malware payload", "value": "6b514eaa84bee88d2a4981af55b69e7017db11ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692109293, "uuid": "043f6d5f-fe4d-41a4-85cc-26499a8beed0", "comment": "Malware payload", "value": "d157001341606e2f190894087bc27deee54dd7061616ed94ace117669ddef53a77ed4a44cac47de29e2916505a7f9c82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692109293, "uuid": "c7fca584-9cd3-4824-bb63-c289c9435c99", "value": "T143D42398D6D6908AFC5202B16FBDF220DEF35225153EB68733402F18BC759E5CA1EB09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692109293, "uuid": "123deda6-056e-4a12-8e58-16bb14fd6af8", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692109293, "uuid": "d378f242-d947-47a7-aa1f-9a636ae8a69b", "value": "12288:ZYDfySvj5gDpdD7SW+6Yr9B2iQCowzEfe8pNuLUy1AhEIozIM:ZYDKCgD/D7SxPhB3QC9Em8NuT1ARM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692109293, "uuid": "2c6a81d2-9390-4c3b-b5a8-ed39b3c4c177", "value": 640919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692109293, "uuid": "4a165d36-cbc7-497e-bbae-0750b9ddd585", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692109293, "uuid": "106a8eb8-c968-4389-8f4b-387fabf82980", "value": "INQUIRY - MV LORD MOUNTBATTEN - MB-SPA50-23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a23e0789-3b52-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692093659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692093659, "uuid": "9e93287b-4947-4ee7-9b33-85b6b3f1d74c", "comment": "Malware payload", "value": "c3d599e34bf7f555542bc1b42484294c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692093659, "uuid": "e37f5b12-2a5c-4bf6-9042-95c934d5e26e", "comment": "Malware payload", "value": "de1150ca2ed05747c1e97ac73b22f2656bcda0f33c5f7a72367ea775626a21fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692093659, "uuid": "2bc06e25-8a00-4eb8-8004-e20655ddac91", "comment": "Malware payload", "value": "2bf5c7d578201d35268fdbb4c37ac580c2aa3c36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692093659, "uuid": "17c51f3e-9f59-4317-96ce-843b29747a5c", "comment": "Malware payload", "value": "3dcff4d1d0b8a1c78cdd68d46a9c081cdf028e0c779785d0471cc2e3d8046596f8d28e510b5d3d997ce62d9f415a9af9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692093659, "uuid": "67ec422e-ab83-4e84-bec6-707695d0804f", "value": "T1D8459CF12B46FCFBFBA87934900029683FAC7997B5C541CDAACC616E1A675608CF5C24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692093659, "uuid": "916d85b8-f2d3-45ce-8ac0-726731d58732", "value": "dc6f2b08e9eb636a24bc43d348d9d431", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692093659, "uuid": "19b62991-cf58-48dc-9467-7fd3f486a026", "value": "12288:2HaYIhJ4saI+x9fqSiiTL7JEfWo6CaAfHyk3uSEXQh4BmU5IPcPCbegXRVH6S:2HM6SSlTLdE+XAfHyk3ubXQjUCpe0V1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692093659, "uuid": "aabe77d1-9f12-4b17-9926-53703c7930ff", "value": 1247744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692093659, "uuid": "7c6fb40a-43a1-485c-b927-601709a1cf98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692093659, "uuid": "72e6735a-e3fd-4154-9d0f-55392bc0fe53", "value": "de1150ca2ed05747c1e97ac73b22f2656bcda0f33c5f7a72367ea775626a21fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c610f31-3b6a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692103903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103903, "uuid": "5320aac2-2eb5-4f79-89c9-2ae3037da0fb", "comment": "Malware payload (Formbook)", "value": "ddf1b4b5a60e6c0584fb4ab5282e8d36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103903, "uuid": "fd186140-02d6-4fca-b5e4-ffd871a50df0", "comment": "Malware payload (Formbook)", "value": "de361195aca3d3d04494a26d2023ecdc0bf09cf56f379813d19b2c256ee18df8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103903, "uuid": "0af92ab2-e3d9-46a8-8e3f-aa910ceed8fd", "comment": "Malware payload (Formbook)", "value": "6eb939ef00e3373cc9aadee9b355b5435f6a9db4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103903, "uuid": "d01fda2e-c71d-4d75-bc73-02935d28c6c6", "comment": "Malware payload (Formbook)", "value": "09ac7afd03d99a71835a1a9a50bdd519ce3ea37fd31001e28c748dc1c3d3545167db6e2b2baebb750db75c3bae66ee0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103903, "uuid": "4419a371-3bd5-4e06-bc05-0d3b516c7294", "value": "T19FC4235276E47CAADC7CD5F56860882A4778505B26A3EFCC8DC920D90EF77004BA4B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103903, "uuid": "94f73a21-b8a2-45ec-8032-5fa332b045f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103903, "uuid": "ef997ed1-dfeb-4f5e-a1b8-fb00b09ebe59", "value": "12288:MPV/OArfbPM+SN5ttOqbDqeN/PfZu3B4Sgk4bWCAna7:lA/M+qrtOq6eNfZEBOk40a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103903, "uuid": "7f15574a-3e2e-4aa2-94e0-24b3a4cd2be6", "value": 567808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103903, "uuid": "3fc49869-0096-455e-97fe-4ec399db713c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103903, "uuid": "e1ca0bd8-c91f-42d4-b77c-771c85dbd201", "value": "ddf1b4b5a60e6c0584fb4ab5282e8d36.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43759a75-3b8f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692119699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119699, "uuid": "c4429926-9aa2-4e2c-9072-bfa6041d7885", "comment": "Malware payload (Mirai)", "value": "a009d1b2276b5f05609b859e62b08e50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119699, "uuid": "d60b02f7-a7b4-4ea5-9d5b-767d17fd9ff6", "comment": "Malware payload (Mirai)", "value": "e03181825a6d121d14ee457d7ca60935b9eb9980d537a5c4f0412f6390c25a9f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119699, "uuid": "793290aa-bfd0-4928-ad6c-923070dc279c", "comment": "Malware payload (Mirai)", "value": "aa83d75e31d6a7859e088e212c43138aced7054f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119699, "uuid": "d380616f-87ed-4467-b73f-75d27fafc97c", "comment": "Malware payload (Mirai)", "value": "ce07bd047342658d47b4624b90bbd8506ec10e57c1971b847c53ded7217684946283bac7cdc454f38bd9aa6545d05e2e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692119699, "uuid": "0b2dfb2c-4268-44dd-a015-e4d5c948eb80", "value": "T156C30845FC509B17C6C612BBFB5E428D7B2A1798D2EE72039D156F20378B96B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692119699, "uuid": "b3f93241-da5b-4012-9cc9-eb6789dca2ee", "value": "1536:22nHJ2ctPexdnoUZFoAUIE4Vsme3TGQb+jc3uPrRVULAlPKSwyw29dGm2etcGoUV:22nkp4IFoj4bOaQb+oA7UiuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692119699, "uuid": "3ab4cbd6-36a5-4ad5-8839-fca7a21bae85", "value": 125324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692119699, "uuid": "4fce6971-549b-480c-b4c0-3f52c1342b5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692119699, "uuid": "c253180d-2fe3-4d8b-a54e-799606218dfc", "value": "a009d1b2276b5f05609b859e62b08e50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bd7c81a-3b69-11ee-a6f9-42010a9c0055", "comment": "Malware payload (STRRAT)", "timestamp": 1692103365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103365, "uuid": "371aef31-d543-4ecc-8f73-5827f737b7e3", "comment": "Malware payload (STRRAT)", "value": "bf2aafbc6cabb078c9d1d22816f3c283", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103365, "uuid": "90086333-0c32-4c9f-9dea-4d0d1f57a67c", "comment": "Malware payload (STRRAT)", "value": "e0dfd392c5f20f15124383ce843d3ae1f2a5150712ad29c0cf9c5c9b013981a2", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103365, "uuid": "04515f4a-5128-4c2c-bdb0-c8b022a4657a", "comment": "Malware payload (STRRAT)", "value": "a0fc2bdc4ed550dd4e48dac0ed7ff829901d8954", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103365, "uuid": "07a1eb73-9b3f-43be-9152-80774081acf9", "comment": "Malware payload (STRRAT)", "value": "3c978d35635f329f024efb007607b6b133548c6114f65b4559e2f7a20be47c9cbd7766d0e63a15003e425a18b00309a2", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103365, "uuid": "38a15556-92b3-4ab6-89a0-986dbe38cb42", "value": "T14504F11EBEDAC5F8C11B85B2501E826AF04C11ADD041E02B76FCA81559B1CAF1F67ACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103365, "uuid": "265080ff-b5c8-40c8-beb8-7e42af1108d6", "value": "3072:7W9eWvrBxdrRHpbwnoUtVwX0z3eZUpSuzEtCg3G5wPMSyZcoMbIpCH/ezy1:7yT3drRHpbwNI0zuZU0NggW0yZfVpCHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103365, "uuid": "8ae3075a-23ee-46f2-b529-6320819f036d", "value": 175635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103365, "uuid": "14707e7d-3d4d-4b28-a096-bfe709f25df7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103365, "uuid": "7c463042-3d9a-45a3-b5c5-490b461a5572", "value": "PO6608004 Rev.1 - Kohler KD400C2 Quo.2329-201222103937.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "050c5e03-3b65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692101555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101555, "uuid": "fe536eb8-0146-4298-90e7-431824216cc6", "comment": "Malware payload (AgentTesla)", "value": "30443cbfdff4997867216993a2e03e6a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101555, "uuid": "e0c04e3a-96e9-4856-978d-130b2fe750a8", "comment": "Malware payload (AgentTesla)", "value": "e0ed5480649bac717c4ba8fd6e9ea5abb907870cfeb125d13de7e5fedf8fae7d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101555, "uuid": "93124298-4dd2-4f2f-8507-d1616ceb248c", "comment": "Malware payload (AgentTesla)", "value": "b9a25eabb89cdbcf747a7cf459bf371788a2bf02", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101555, "uuid": "278ad345-ded1-4d1d-b76d-5e8b5a816dcf", "comment": "Malware payload (AgentTesla)", "value": "09e8c1d49d5f92d6f7465305c22c435e0455befe824a7ccc1c3e3edc8fd4c23c8ac6aee6734ec135fc33f9c2318fb450", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101555, "uuid": "2cbf501b-f3bc-4a93-8cb3-f16d35bb464c", "value": "T16DD42212554CDA41EB3C4BFB38644A2C47B3B35E4264F2AE8FA55CDF4467F0E9A60A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101555, "uuid": "5e04d717-21c1-416a-942c-eff7e2e284cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101555, "uuid": "480f3b0e-36d7-4df2-9637-4ee3a444fc0a", "value": "12288:7hBpkogUNWIXK0N3TzJuv8I7cMcSfMPqvhYRqu7dtP:N2ujzJu9cMVfJJfu7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692101555, "uuid": "2763b8b2-d2ff-4b06-b76e-1731a60eb991", "value": 646144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692101555, "uuid": "189438ea-67cb-403e-9cd0-39e67e044507", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101555, "uuid": "1e6d0d22-c33a-4582-b3d2-f75568baf92a", "value": "Scanned #00461070823.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3b1ee47-3b68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692103244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103244, "uuid": "09ac62e2-b980-4e86-a325-683e40279ad7", "comment": "Malware payload (AgentTesla)", "value": "9523915d2c374900933fb5f8eb051368", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103244, "uuid": "0090567a-a832-4eb7-b80b-2b57a95f13fb", "comment": "Malware payload (AgentTesla)", "value": "e14bdb099bcba1125747da3bbbc7bca054a48b233dd8add38d19284cb8040120", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103244, "uuid": "f224fd99-4228-476e-b748-9bf6f3abf581", "comment": "Malware payload (AgentTesla)", "value": "4b6950bb57a4330032d2f5265e8141eaddd55286", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103244, "uuid": "231acbf0-cab0-4530-b094-cd62edafba80", "comment": "Malware payload (AgentTesla)", "value": "daa760230ba68c1f8e1c178a3186cc659fec4a9eb187e51cbd3a5fa6d4c197348bb7c78124e2eebbfeb9d54ed3968a90", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103244, "uuid": "5d3c954a-93c0-4c5a-934b-061bc618e30a", "value": "T117E4F17E5FC9FF96C43D0B3A8542257453F1C0526232E3AD7DD900E54BA2BC68AE216E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103244, "uuid": "9466d828-3787-4b88-8164-0b5e58cafc16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103244, "uuid": "1272d811-7a1e-4c3a-afc2-b3773fd7c26b", "value": "12288:d/wIaZergPM2kSB4QGZ1Zb+Px9Y3v2z1f07uD:UeEg8J9Y3v2z1f07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103244, "uuid": "344b49a6-4de9-4068-8630-f814001d4198", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103244, "uuid": "cc4305a9-a825-4f23-8d64-2ae3d5656194", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103244, "uuid": "0689de9c-d021-48b7-af72-975939c1b6fa", "value": "Doc53660015082023.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec31c737-3b40-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692086052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692086052, "uuid": "8e46501f-289c-4c74-b25b-90c9333a241c", "comment": "Malware payload", "value": "7e8479d4ab9513c27846ef003223ae44", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692086052, "uuid": "8d9ad1b2-625d-4cff-8432-d005b973af7e", "comment": "Malware payload", "value": "e1ed4f1dafa8764fff2103bb226c7577ee3faa15b6a3eefbcf383426d4395573", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692086052, "uuid": "c96cd423-cf17-49ee-b521-24f31235a317", "comment": "Malware payload", "value": "0c1691dad33e7e31b7cffded5126161dae6ca925", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692086052, "uuid": "0f208160-a0c5-4f72-bfff-3405facf5897", "comment": "Malware payload", "value": "5bdc5ac99b196e756b28b594e90ff5428a15e97f87e71cbb894db48d2a7716eea4260589b5d80c3c980cd04ba3cb48aa", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692086052, "uuid": "7efb6816-a7e9-4d93-8388-12f8a0ad7992", "value": "T112D423DF0EF9647BF8F4187FB2664460DEDE34CE8842A2B954C188B496D817580CAE79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692086052, "uuid": "b8901fd8-81e1-45b2-9690-8ad3caca50a9", "value": "12288:A39PzYk8D+gBg0G0PQ4p2XPpRRNHgd65t8REF7eaUSfsBuK:S9Pzj03p2/phnGREF7nBsz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692086052, "uuid": "5670895b-2f05-4fb5-9de8-9a93782b5764", "value": 603225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692086052, "uuid": "9f3cfa9e-31b9-4e4c-af99-0822a854fe07", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692086052, "uuid": "df9209ac-f840-48ca-b4fc-8cf3e78e5caf", "value": "Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f74353-3b71-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692106729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106729, "uuid": "6b863ced-c3d9-402e-8632-49ec80712a9d", "comment": "Malware payload (AgentTesla)", "value": "1acad3b72f208a87d858d2ab3abc90f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106729, "uuid": "c685f513-c808-4540-96d6-ec099053a912", "comment": "Malware payload (AgentTesla)", "value": "e1fae54e9fb4d1c3d42119a980b7992cbadfda5c7051de61a2d1cef9d251c173", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106729, "uuid": "8eb8f295-3cbb-4038-a70a-94f7e95d0c61", "comment": "Malware payload (AgentTesla)", "value": "0fe6d586f2df23bf8dd3835b4b219ec3c69530e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106729, "uuid": "67969059-ca28-4d8d-a13d-4287e9028248", "comment": "Malware payload (AgentTesla)", "value": "579f6e8fbe00d52d6f2695f5a6c6a0f20794c97246d12bf7998123f19b6a6437069fbc2098c3e400800e6b6844911cd8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106729, "uuid": "55899836-9981-4d5a-8bd1-7385fcac7d67", "value": "T189D4129AA2EC2B22D53EFBFF15115A0647B274BF2267E29D8DD530E52610B481760F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106729, "uuid": "fa5fa1dc-37d4-4ab5-8560-177df147f1fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106729, "uuid": "a9d1cd0f-6fcd-430e-b5f2-23d76a07258c", "value": "12288:py9dV/OKfAsnQu8Ym2w8sR19y4K2kS6HYZfOZI+upTubIze:pygKfAsnQuDmPRG4K2kf4lOZIWbIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692106729, "uuid": "26633334-011e-4e7b-add5-3d9c98134dd6", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692106729, "uuid": "806f58d7-a80d-4119-89a5-4e23cdd100b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106729, "uuid": "bf184e14-9903-49ee-93ac-739453aae7d2", "value": "PO--080523-FM 06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea283645-3bbc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692139306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692139306, "uuid": "c60d93c7-4a85-444a-97f0-55c85f8f00f0", "comment": "Malware payload (Mirai)", "value": "bbaa34f3d9f4695838d68d710f77abc2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692139306, "uuid": "687234cb-b269-4404-ad23-9cabb33b6185", "comment": "Malware payload (Mirai)", "value": "e2ee55a6095a6cab833b984d8c484f640b750e0467cc0b216f8db38534a51846", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692139306, "uuid": "0fc2276f-aa51-42ee-97e8-70ca5daeef70", "comment": "Malware payload (Mirai)", "value": "2a258b040268c632ad6509f1b56f3f51f572e36a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692139306, "uuid": "47eb9f4d-dfbd-407e-94da-17c411af58cc", "comment": "Malware payload (Mirai)", "value": "ed68d001b9f0fbb20ffbabef0e070251fb891103f7db5a7a0e981c388762fd01c6f9e8fe160cd3903a830000971e7927", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692139306, "uuid": "63729186-fc4d-43e3-b545-37c4dd1c9a44", "value": "T157D30A56F8819B12D5C111BAFE1E124E37131B78E2DE73026D246F747B8B8BB0E3A915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692139306, "uuid": "62f78b26-7c22-40d6-b343-42df3a10225b", "value": "3072:2UEKxKxXYDI7gqaDOBW//bSNC+3YbRVO:2/zxXyI73aCs8X3YbRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692139306, "uuid": "9c1b7586-0720-477d-919c-e5881128f66f", "value": 136828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692139306, "uuid": "e8bf615e-a71f-41e1-91e2-a14b1ba6b425", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692139306, "uuid": "0213b066-0693-4e6f-ae68-595e970545ae", "value": "cundi.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "051a76a9-3b69-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692103273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103273, "uuid": "346efb91-1f58-4689-8db0-1524e4168005", "comment": "Malware payload (AgentTesla)", "value": "7ff9c9800249680b3c17a911cb25f246", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103273, "uuid": "086722e1-abfc-4b77-b358-a02b26c83457", "comment": "Malware payload (AgentTesla)", "value": "e32abd041b0db3fbec59ff3c27d72189fab54948cb5d2b332fb9eb985cfe94e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103273, "uuid": "73c2dc7d-54be-4aea-9e6e-61c50086a336", "comment": "Malware payload (AgentTesla)", "value": "ba4b5e230f41d26c21fb9f691908eead340777c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103273, "uuid": "dadea88c-a821-4008-acd1-0c884049b8db", "comment": "Malware payload (AgentTesla)", "value": "ec8225f18291487f814089093a58d49d981ca4f60ef6b31794662500da54d032e9d58eab0d51e5171290d5972e137d2f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103273, "uuid": "f29b9a95-15aa-487f-863e-fea8496c2f6d", "value": "T1DAD423D140A7120DFB005692978D684E6D9B77CB39DEC9ADDC1B2CBF8167F822056A3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103273, "uuid": "83cc3fd7-12a7-4f77-88e1-0a81e8abb1a7", "value": "12288:EanWnTEaMa0Fm2gDT0cxMAjd74xbnUgu2GJJlmmR+K:rN3gkWMAjd74xbUg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103273, "uuid": "71e662a1-76d6-48b9-974d-89f26a687936", "value": 624375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103273, "uuid": "ed242285-bfb3-4c88-a340-baa1948355f5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103273, "uuid": "13000415-49aa-4e74-98e9-f0ed1384c6d8", "value": "Order-CPR # 001220000976.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab3d4ed0-3b78-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692109995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692109995, "uuid": "82d550a8-75d9-4560-b146-a5e56a4710ea", "comment": "Malware payload", "value": "9bf676847bad02bcf7bae2bd18b0b8f1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692109995, "uuid": "217d2426-9a2f-4ae8-ab9b-bbf5430c50b1", "comment": "Malware payload", "value": "e3ea65b38a4eb605164d335f9b6cd6a16011e49fa33817aca5c4b1a4c62e0202", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692109995, "uuid": "6c205f2f-673a-4254-9be0-755331534cdb", "comment": "Malware payload", "value": "aa7b927e5281d4bbfa44f2cfee0fb5891a1d034b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692109995, "uuid": "ae057c71-1a09-48f1-80d7-7b9aa5beb938", "comment": "Malware payload", "value": "0b4d460cd95a454d9a9a629d819cef5d13905ff96185445f5d149a493ad17a583a9fa1f9f43079f04c7c6d0769fec397", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692109995, "uuid": "985aa4ab-3f66-4854-b2cc-5eeeb1a7525d", "value": "T19742287EF5931193EA590B7A46E7988D177C1907326330BFEB00C0161E95297F892AF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692109995, "uuid": "36efbc0d-7724-47e6-beef-d80eaec0056f", "value": "f010843a52db470e0d3050e7610f589f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692109995, "uuid": "5de98b49-80b1-48cf-aa64-b46d39237351", "value": "192:xbrJY1kp1VlAcUlJGvwdAA4MZAywUCRzbwbwGSv/0NhL:xbsgKRBAypYGSv/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692109995, "uuid": "b78b2e88-95a6-4802-9bb3-35c5bc0a79bd", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692109995, "uuid": "91507b3e-972d-4eba-b8a9-7db0df575fcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692109995, "uuid": "4c41bb27-4f80-4f00-a058-1ed8cb32b222", "value": "SecuriteInfo.com.Win32.MalwareX-gen.19044.8947", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50aaeec9-3b8f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692119721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119721, "uuid": "6d9ed081-3486-4155-89c0-4bbd814d34a3", "comment": "Malware payload (Mirai)", "value": "5fcd83254a95cd4d329ca146c42f5bee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119721, "uuid": "91e6bbd5-4c56-41d4-8f13-b73a7b799315", "comment": "Malware payload (Mirai)", "value": "e43f9bf8f92d20d1cec04961a2b86c0dd4b3f21da7fa3e998ba655c02b456aff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119721, "uuid": "9f46928d-6748-4895-bd16-40da26f335e7", "comment": "Malware payload (Mirai)", "value": "d4ad65ce1460805f003ca46b5e517bda7824a33c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692119721, "uuid": "c974938a-9b56-49ab-9c3e-987260b60c2b", "comment": "Malware payload (Mirai)", "value": "1224cfd89bc1f255ce8973182cf7a921ae1142580be45fff05996cd524b78d7655dbf76e80f7ccf2fbae706c4693f4dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692119721, "uuid": "ca8ac907-d70a-407d-81d8-844130b6b1ad", "value": "T147B34A73CC69AF68C658D5B8B0B18F792B53A954814B1FBE55B2C2788043DCDF6093B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692119721, "uuid": "41a5dff0-21a4-4a13-8c94-5280b133693a", "value": "1536:Ya7fuxAyyUsE0JOQCQKnuBQMPd7nllWShNKah5tY:Yw0ySoOQSngdZlWIKaxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692119721, "uuid": "86b75203-d7f9-4750-9bcc-607099af3c7b", "value": 109676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692119721, "uuid": "1abec49a-85c7-4133-848a-db7c47d38553", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692119721, "uuid": "1a348f20-1bd7-4c5e-abdb-a18b714c611e", "value": "5fcd83254a95cd4d329ca146c42f5bee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0f24511-3b5a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692097146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097146, "uuid": "97571e4b-826b-4ca3-922b-6e3429c871bc", "comment": "Malware payload (Mirai)", "value": "b8d46595e89d4a8c8d09efd090aa9c5b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097146, "uuid": "279e8702-fd4f-43c2-a6cd-2f54a9839ef7", "comment": "Malware payload (Mirai)", "value": "e46d919f718ca2ee5c1100af6760d0c8d83283116713813f78355aadaf2c4163", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097146, "uuid": "a463d0d6-87cc-43da-a52a-cbc5f5b07012", "comment": "Malware payload (Mirai)", "value": "fbe58b76e6184bd0ed28960facc0173a48e1cfb0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692097146, "uuid": "eb4337a5-115e-405f-848b-790f3efc8747", "comment": "Malware payload (Mirai)", "value": "88264d78cff41c35d3eddbed18ac736b74f290466f9ae4f028ea664669ccca2984508c457239d367d8609ddb0a78b88b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692097146, "uuid": "6c5c27ff-52ae-49ef-8860-7657a4f7599a", "value": "T137C33B06F5108753C1C2177AB79F561A77232BF897DB3312A6247FB82BC279A0E39950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692097146, "uuid": "b3d3fa8d-850e-422f-8930-6510964bc792", "value": "3072:idwracAAviNmLpMQ1x55hKHKSrbqlAdmyDQUJ1UX4Tn:SwraFgikx55hKHKnlAdmyDQUJ1a4Tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692097146, "uuid": "12b8a14a-0be9-4a45-b6b7-20d8c879a200", "value": 118932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692097146, "uuid": "f18305a4-2f88-4f19-bbd6-806fa20fef28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692097146, "uuid": "78112510-df9b-457f-a4ca-50b4200fd8a3", "value": "b8d46595e89d4a8c8d09efd090aa9c5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f8af711-3b76-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692108982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692108982, "uuid": "ad5f5eb3-f3a1-4b8c-9338-ced3ab545fc7", "comment": "Malware payload (AgentTesla)", "value": "0147a07a73420f3e8d8e51854febbada", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692108982, "uuid": "0dc67f68-23dc-48a6-939b-70ba0ca91727", "comment": "Malware payload (AgentTesla)", "value": "e527429778922bb01ac30e48f6b412beb136dde49addae00fed5745e33b6783e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692108982, "uuid": "ca05ed89-0419-46f6-b780-97f609061058", "comment": "Malware payload (AgentTesla)", "value": "7f7dd2f19c12bf9afcc637fa27a7fe054a07c2e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692108982, "uuid": "b80d6d58-6ba2-455e-8029-4e6dde885828", "comment": "Malware payload (AgentTesla)", "value": "0393120e47f18c15c806af656a8c2b6d0e7140802d2c1af3253535a71f7f617eab8e3cbf65383a15a1da0f6df94b2a0b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692108982, "uuid": "1162c262-dff5-4d33-9c42-4d61f441f043", "value": "T1F3C423767921B881F9EAFDEAB270F78F8D3047D8170C5E56CE1D9E0A02924B18ED4749", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692108982, "uuid": "ae47295f-e39d-4391-993e-7ceb1a414b6a", "value": "12288:DFHRJ/2DUlpqtwiYOgaBReI3kpKdU7eoUEzoR4jxWYdCmS1uaNELWvCTtqOOBtHs:D7mMpCw3Ogc8z58R4VTUh8cELWvCpJOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692108982, "uuid": "3493a8d9-74de-4838-9577-d582ea996d3b", "value": 556648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692108982, "uuid": "eebb6c71-a6f1-4855-a6e0-50eca1189e0d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692108982, "uuid": "f07bff58-d757-4784-a725-97a9c36399ff", "value": "ACCOUNTING STATEMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de96169-3b7b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1692111019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111019, "uuid": "7d50813b-b7c6-43dd-ae52-a69afeb45fd0", "comment": "Malware payload (RemcosRAT)", "value": "50346e063e8fc6dc7b1559eefcb2a95a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111019, "uuid": "ee77f456-be23-48f6-b342-9025d9b9c9d9", "comment": "Malware payload (RemcosRAT)", "value": "e5da419608fcf10dd33a0292a84e2453bfe44301d4e2fa28cf9d286a091cb107", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111019, "uuid": "a245ef8f-40c8-4e1a-a4ac-818ddccbf551", "comment": "Malware payload (RemcosRAT)", "value": "a7642cb23397582fdeb31c30a7605da371d58abb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111019, "uuid": "97dfc987-eff0-4973-a548-f571ec1fa9af", "comment": "Malware payload (RemcosRAT)", "value": "d95b04c2878ab418e4f00ef4c6d15024cb21ccbae8613be116161fcb715a31c54e4d98680ba3e19125ed6fb496390dd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111019, "uuid": "9bc303ce-67f4-4d4d-930e-96cf445c684c", "value": "T1E9A4BF02BAC1C072D57651300D2AF775DAF9BD20183A457BB3DA1D9BFD70190B63AAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111019, "uuid": "56ef67f7-9e9d-41fe-bb7f-16d664d2ecec", "value": "04d77d421b8e5297898a3fce39d74267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111019, "uuid": "672916a9-b6a8-4097-a897-561db850c8a7", "value": "12288:TRXxReZj3WZfj/2eSseWFaIe2+f8CL47bs/ZO2RDU:Tx7cyF2eSsewS8W47eZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692111019, "uuid": "f42a738e-d2f3-4a28-a5e4-183aecce78ca", "value": 492544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692111019, "uuid": "e6dd5006-7ec5-4ce2-b46d-38abe20352bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111019, "uuid": "4fac85b2-dff7-4952-b6cd-f3e269871cf5", "value": "decode_d56d082d46b8ee0d58cdbeb01c11857c1df2ace197c9c8968cf94df3608997eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3f9af4a-3bc4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692142705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142705, "uuid": "66c21906-1132-4da5-bc7f-e20b5c1a9509", "comment": "Malware payload (Mirai)", "value": "4e23b41550645fa93f4b4bff681817b6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142705, "uuid": "c5b714fa-ea7f-4dec-9f9d-f46f18adadd1", "comment": "Malware payload (Mirai)", "value": "e5e7a09adb0ed98da0104c95599e43552040e44c53ec232e020f7930012578d3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142705, "uuid": "aa83cd97-cd42-4d4a-bce4-704c14439438", "comment": "Malware payload (Mirai)", "value": "4b9bde5390d425c3e4e9e9ddbe486d28dd5527c3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142705, "uuid": "bb27b79c-ba2e-4131-b996-bc6ba51b3f70", "comment": "Malware payload (Mirai)", "value": "4930390af59f1b78a8eb2c4ace432271696fb3c83a72ecfecc1b39cf2db1838e11f623e189ca02799f49ca98f8732d84", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692142705, "uuid": "36b718e2-d486-432c-a1d9-a4a115e4aa86", "value": "T1D1A37DC4F643D0F6E85305B15077AB369B32E4B5202ADA42D3759E32EC62911EA1FB6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692142705, "uuid": "d2732142-ba91-4fa4-83c9-b45941a27ee6", "value": "1536:m3YQ38LN2MW7iBqSLLhch8yQ/m3slqwjSqt2gl6oJkSjxIr/:aT38Lc7kqSXeJam3AqwjFEgXxjo/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692142705, "uuid": "de797ef8-6694-4847-9d82-b33d4d8c1160", "value": 105484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692142705, "uuid": "d79368c8-e89b-4965-bd05-bb34ba0918ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692142705, "uuid": "8eabb117-fc67-4fdd-8f6b-d06774bc9540", "value": "x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10ea2727-3b7b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692111024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111024, "uuid": "8d8eb334-6afe-40ae-86ac-dd3abc1d0f98", "comment": "Malware payload", "value": "26f06f14fd7bfa3c137c2f83d6d718bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111024, "uuid": "30ef5ce4-aa1f-46ea-bdfd-2affc769d656", "comment": "Malware payload", "value": "e62f4d59d04e257681742ed303ea92069080ea021809b1651fdae0e95ad6b7c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111024, "uuid": "a70d7241-ebce-447b-a743-6859cd206e63", "comment": "Malware payload", "value": "e984f563152feff5df5554a1c7964cbdb82f60a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111024, "uuid": "2078b6c3-b5da-443a-98dc-66485f27e2fe", "comment": "Malware payload", "value": "089cc271708e7903250e028fbf1be94fe636f3be220bc80835d6098c6dd99c4fd70fe8782a683e540a0ee7dd9c3d0515", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111024, "uuid": "3f788590-e041-40b1-a36c-0a178bc4591a", "value": "T118235B003798C53AE2FD4BB5ADF2A2408675D6672D03C6596CC860EA2B13FC596136FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111024, "uuid": "640772d4-3fdf-445b-87ab-d6b3af36ef9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111024, "uuid": "af2c99bb-0ce7-4c27-b5cf-e3c34fbf46ae", "value": "768:V96mxUTILWCaS+DihoRiAK8YbJgeJrmu+qVGIPBfBuvEgK/JzZVc6KN:V96AKWuizbGkGmBfBunkJzZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692111024, "uuid": "e194d097-b77e-4a46-a8fb-e176dc0a1f91", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692111024, "uuid": "26ba0724-7ba6-4e45-bfaa-4f3f3f0b95a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111024, "uuid": "0f707cdc-eec3-409f-b344-1aaec606ddba", "value": "decode_da721f195f41b72d8f2813eaa2c8388786bf5dffe6cbf59633a61a45576273f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f253ac0a-3b7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1692110973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110973, "uuid": "30deb300-ad3d-4c63-b142-c952c9f01f9c", "comment": "Malware payload (RemcosRAT)", "value": "2c66c2e50f97fa6875d743bb9112f14d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110973, "uuid": "ab7ae217-e4e4-49a7-a88a-472693ed692e", "comment": "Malware payload (RemcosRAT)", "value": "e63794351a4cbd5a14a5dd264911b5e2ce21020b48eeba7d3fee00e8e55990e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110973, "uuid": "7b71e3fb-db1c-4fb3-b7ec-8f57ae874d84", "comment": "Malware payload (RemcosRAT)", "value": "f19a7bd777b0c2691298956d28a3216a604248a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110973, "uuid": "94dfe1e7-f317-4bb0-aea6-5248b74de193", "comment": "Malware payload (RemcosRAT)", "value": "971c7f666998812fa4b2cfa3ae37d40ca82bd1bb55828fafb3effc0a7552a46854b05c87ea7a57ed96c17c75d1d1518c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110973, "uuid": "3a679038-4088-4e80-8d83-9c112c7dd349", "value": "T166A4BF02BAC1C072D57651300D2AF775DAF9BD20183A457BB3DA1D9BFD70190B63AAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110973, "uuid": "7f40f7e0-2746-4ad4-80f8-bef5a8cb5c97", "value": "04d77d421b8e5297898a3fce39d74267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110973, "uuid": "fc4cf639-c3a0-4eb5-acf0-9222af46270f", "value": "12288:9RXxReZj3WZfj/2eSseWFaIe2+f8CL47bs/ZO23DU:9x7cyF2eSsewS8W47eZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692110973, "uuid": "2015f472-fc88-49b6-848a-15a77587f266", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692110973, "uuid": "8ef8538d-ac2d-440c-a263-8ed0a73fdda7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110973, "uuid": "6080d4c5-1d8a-4adc-8254-bea99ebf9a95", "value": "decode_2b602fecf39c4c8d15683632bc262a59d87b92f6c1a07779fee08030bf1fb954", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4100436-3b65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1692101956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101956, "uuid": "d3396c6b-65c8-456f-8a20-63f1f7b161a9", "comment": "Malware payload (SnakeKeylogger)", "value": "85b26134f7bc67f61f28f1148deb5d62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101956, "uuid": "04e3496b-3edb-457e-bbdb-3727724a0166", "comment": "Malware payload (SnakeKeylogger)", "value": "e68187fa7d7293996751255a331a96cf766d07d45d835570403b8c1363a72d69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101956, "uuid": "7d97b695-479f-4fb2-9fe0-503b7f10c10f", "comment": "Malware payload (SnakeKeylogger)", "value": "7fcc580ad880adf48ddddab31e767f7fc23d55c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101956, "uuid": "8ddc972d-4dca-4258-bf2c-f16d9385275c", "comment": "Malware payload (SnakeKeylogger)", "value": "836655effe18bad9f1d4c67209bb0c42bd022c944377a6ce1e4bfc87fa2bddb897939cdb513c58ef3a343b08846867fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101956, "uuid": "0bb2bd7e-8ec7-4665-8bef-1c78d68ae443", "value": "T104341221ABE0E5E3D29306331C3D9B9BAEF3F6166065D61B43505F187A23511E81F713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101956, "uuid": "f05aeefe-f5c2-403b-b3ee-b68eb09052d0", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101956, "uuid": "19e35dc2-91b9-4a2b-a256-04f47b96cf52", "value": "6144:pYa6wXcQqoWLcNncuFfJgxXpp/ieaRYE8nBstDjnT:pYCc+cPXniSBCnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692101956, "uuid": "4c5d1172-6a87-492f-8a8c-ed3a63ca7679", "value": 236913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692101956, "uuid": "ed91f741-efc2-4f4c-bed8-2c1da7eacc1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101956, "uuid": "831f52a5-55bf-4139-81c4-9f9103715c2c", "value": "SLK567899876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620dfb8d-3b78-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692109872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692109872, "uuid": "8dec30f1-7ba8-46bd-a6dd-7ab2aa88c26c", "comment": "Malware payload", "value": "d3cd91754b33eee640f641c18058be63", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692109872, "uuid": "9577b00f-7266-41ae-953c-275f3a8010d3", "comment": "Malware payload", "value": "e70059ee5cc277a868d41445bae79ee8d2d86b798c0a89442d23ce22d47f5026", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692109872, "uuid": "4aeeed85-f9f3-4af8-8238-99e0465efae3", "comment": "Malware payload", "value": "13f7319fe396efe25934d576d9734ced1f0f1684", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692109872, "uuid": "42356749-0d5b-45b4-bbf4-7b96fc9fae6b", "comment": "Malware payload", "value": "157b2fcda4343198cc992a686aa46dd8a0961d1c8762d1530d0c699151b6fba86dd190a3f310e14a62ca767ccdcdb283", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692109872, "uuid": "e7df2346-0dad-4004-90b6-fdc9be4637bc", "value": "T179D16C2D7275101FCB6CE438A85C4A53F90E74626A2E621FF461F7E331479B86E3B908", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692109872, "uuid": "12d64f13-0eba-46d4-b251-4aef86e8af32", "value": "96:zsFn1e74MmAXucKLHt4EfgBYfw3jZCvfHvTxtwhtiD2UdJoYjNIKOmGgFYgze7rm:zYn1SecdYfwCnbwtS2UPR2GFe7QLz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692109872, "uuid": "b9154476-ef56-4e75-b661-4a45e6be9556", "value": 6481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692109872, "uuid": "32f94f09-bd76-415e-9eb4-e2207dab3e98", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692109872, "uuid": "3ad8e1df-799f-423c-a4bf-f6acba6fe17f", "value": "Braemar MTM Report.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2bd76ca-3bbc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692139293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692139293, "uuid": "7ae21995-19d6-46b9-8eca-72d29ffa0b30", "comment": "Malware payload (Mirai)", "value": "945d6c25b913c64f5b34d8047200e792", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692139293, "uuid": "39750014-6b41-4840-affd-0774290cf4fc", "comment": "Malware payload (Mirai)", "value": "e8670d4c4a5b42c7dbcffbcef7789abbc2fb78faf7cac74063b11ed1860b21d5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692139293, "uuid": "90850484-7a17-45c1-a913-3988f2f10087", "comment": "Malware payload (Mirai)", "value": "25089c1a109e1f717300c61336bcd5601ef94285", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692139293, "uuid": "e476886b-829c-421a-878b-576e3eb40663", "comment": "Malware payload (Mirai)", "value": "16d3d345421621ac2360445e65c6e531573d30896acbeb8c654be37994ce07e2d48b71ddfbc86bc49f750b56290e309f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692139293, "uuid": "58ae7f55-8ac1-49f8-9e43-d6a40824e6b9", "value": "T18C835BC6F683C4F5EC5305B2603ADF369B33E0BA106DEE42C7299935EC52511EA16B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692139293, "uuid": "8004209b-9cd7-40f9-9d15-e491ee4745c2", "value": "1536:R5EbezB/05ur9bcTyfobda36M/jOUSitEOg:R5EEB/0EBBfyc3H6BAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692139293, "uuid": "0ab366ef-feb4-41b4-9302-2dfd59436bb6", "value": 88424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692139293, "uuid": "030140c6-f48a-4ee5-8a86-8f0143afb596", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692139293, "uuid": "411a2028-a464-4975-b27d-d3f51cfdddb0", "value": "cundi.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "445d563e-3b65-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692101661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101661, "uuid": "4d7364e4-9625-4315-9079-af15c2ad0dae", "comment": "Malware payload (AgentTesla)", "value": "fc98c6badc51c146e702e9e322aa4815", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101661, "uuid": "4676cab6-2c8c-4f81-9f01-c307b0d27158", "comment": "Malware payload (AgentTesla)", "value": "e980dca39325f7ac56abb2f2a6600aa449b3f3dc5ba9754711e70bf94289a01e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101661, "uuid": "6e0f4274-2840-4c29-acb9-b471ad16edbe", "comment": "Malware payload (AgentTesla)", "value": "7d9fc8ed0e30d21014e25cd585eda60a426bf263", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101661, "uuid": "305c45a5-9598-4353-a041-1563bc505bf4", "comment": "Malware payload (AgentTesla)", "value": "391022e62d098a1dd64e318ef6831da90ed30bc9fb9e80d0d81deb71af690a8f5d05f2281ec17edcd91855f952799be4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101661, "uuid": "c1ae311e-ac04-4938-8fe9-86df468a49b3", "value": "T11CC4236825F17DDA3243AD432CD41601C5DA30EE1741D2A4FC64A66D2B9FC593FFA3A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101661, "uuid": "4ac5ac0b-2b7b-4357-ae9f-c33112d5a674", "value": "12288:Av/fhme3RaJfMmOgaFBektBmgmakdKIe49e5uZU7Uq53ixu4Hb7rf6Zg:Av/Jm1DOgkjkfc1Me5yk+7rfMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692101661, "uuid": "5c814424-ee02-4e2a-8c1c-f94cf024fa70", "value": 558322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692101661, "uuid": "44d7e639-7c21-4ff5-8454-6162ff945200", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101661, "uuid": "87b87c0c-e3e3-4c4a-a3de-295f25b968b8", "value": "Payment Copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8320316-3b3c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692084300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692084300, "uuid": "0c226165-a590-43d5-8973-faa9ba4fba03", "comment": "Malware payload (AgentTesla)", "value": "ab9c6d0aa5ff0157bbf78ebaaff09cb5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692084300, "uuid": "3c26a9f3-beb8-4d76-910b-a28386f8b0d2", "comment": "Malware payload (AgentTesla)", "value": "e993a3c9d5843541d742dfd2a0603004cb24431cc152e54042056f33ab1ac9e4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692084300, "uuid": "de66d892-d508-4637-a9b3-71e91faba75d", "comment": "Malware payload (AgentTesla)", "value": "5e3a6ab47d3e592bc509366cce5dc60eedada093", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692084300, "uuid": "65a7d2b0-d501-4adc-8639-048231970477", "comment": "Malware payload (AgentTesla)", "value": "4f1655e46f54ed5f0a811c1537715cec8ec1de6861dacd2f2267320be62d81cc8ca072b84cfdc93306f07c656f954526", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692084300, "uuid": "fccd55d8-1518-43c6-881b-d91ee023eb86", "value": "T190C423CAEC5D5BEFC910DA62ED0475962580AECEC607F8BA4ECC09C4817E6635F0952E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692084300, "uuid": "2fc7c841-0acb-4db4-a025-89553d60310d", "value": "12288:GyG8xiSOVfblAAJMUABsYAvxZVPCwNPx+Y+/mcts:GyG0s/AAeUAO9vxZRN5uts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692084300, "uuid": "91280aa4-2e3c-4b31-96f5-f8fe6afb2c47", "value": 546834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692084300, "uuid": "b6ba5744-77d8-4f55-a623-1fae52b49277", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692084300, "uuid": "0c3363a0-01b3-43c9-a9ba-631a4d4b012e", "value": "swift copy 01429619.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ae6772-3b7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1692110958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110958, "uuid": "c62f46b9-40d8-4830-b597-30eeb002f11a", "comment": "Malware payload (njrat)", "value": "14c4e906889f3571e4948a5d5ae96a33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110958, "uuid": "6f93f943-60b6-4902-b5f6-f264e261d3a5", "comment": "Malware payload (njrat)", "value": "ea0bca71a5a4b7e0e4dad6ccc64ffc2dc940e83d7ae54449e9bf6f3ed1ccc568", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110958, "uuid": "1f48a11c-b32c-4228-b3db-07ec05b10c00", "comment": "Malware payload (njrat)", "value": "5698dd999cafc1aa6ab7ef5bf519ef29a2cd5660", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692110958, "uuid": "9cdb36f9-6310-40d0-aaa5-39e658b1fbb9", "comment": "Malware payload (njrat)", "value": "a553d86d4b4624803bbcae2c7bc66070cb0776ed01c1ee780f865a530c51ddd13a28c9bc17f47c3085b60819341a2c88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110958, "uuid": "47cef45e-cc75-40d7-85ea-6b08b0813e23", "value": "T1EFE208467BA58229C2BC5AFC8CB313110772E3438572EB6F5CDC88CA4FA76D44651EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110958, "uuid": "eb88ec82-84ec-4528-9405-93af37f4ab85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110958, "uuid": "0d541ba5-c1ef-4bf9-8287-a3849ce68451", "value": "384:80bUe5XB4e0XHOnNc4DuzpP161WTotTUFQqz9vObby:pT9BuuSsQCPNby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692110958, "uuid": "c1f96285-3b2d-4c14-b72d-9cd0438a1af2", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692110958, "uuid": "25d46250-25f0-4971-89bd-0d8f585e1445", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692110958, "uuid": "cd7988fe-2da3-4e6f-8ac4-85e2856d2406", "value": "decode_0efa21e9d1405f8455b10ed08c703da0c7ce143e76f3ce0d024f0e285f5699a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6f9174-3b68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692103262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103262, "uuid": "811952c7-eeee-45fc-9290-14cc1d6666a9", "comment": "Malware payload (AgentTesla)", "value": "0a16a231ef534ebd30286ee35fcc4c05", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103262, "uuid": "5d6eb750-d441-4199-95a3-32b6c0ab4b4d", "comment": "Malware payload (AgentTesla)", "value": "eaa8d605e009671ac9b05efb064de9b85ff6350c6ea23d08ab4421cf5e8e0293", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103262, "uuid": "5751574c-7585-48e8-9a09-4350ad071954", "comment": "Malware payload (AgentTesla)", "value": "df0e98d046046d60b8038f45e12ca9fca25d595d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103262, "uuid": "01c145a3-c41c-46e8-b7c1-7e2bbdf59795", "comment": "Malware payload (AgentTesla)", "value": "c4bcc2eca5dd1ee4d9132f574728c40907e18ce62fba168bf7c695ec60d0f4ce9f7dc46d4196966e6ec09ed3aa8f9e4b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103262, "uuid": "f989174f-98a2-4dc0-bbe7-95acef152322", "value": "T1E4D42362E8E1E1D8CF2D6DE9E365047214C0261D1F359B40F62A2278987FFEB98D4DB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103262, "uuid": "b6451e43-c858-43ad-a3ba-74b91d544c50", "value": "12288:nlGZYXaAbtXVmjCLmzAJ2lGwi7nKVdS/mxvZxKJnVKACxE6PSDCUblwE:nlxXrxXVGVAJ2lGwsnMdS/8vZkLCnPSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103262, "uuid": "01a0a88e-796a-47ce-b263-82cd5e11e4cd", "value": 600163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103262, "uuid": "faac52a2-8061-48b6-91ad-1143dd6cb5a5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103262, "uuid": "8206f279-83b2-4640-850c-582e0c027b5f", "value": "nuevo pedido 0717.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d36b34-3bbc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692139304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692139304, "uuid": "b448856e-9c82-46ef-b2ae-5204e3e6bb3d", "comment": "Malware payload (Mirai)", "value": "24290c695fc74bf4657e2485ac4bdb76", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692139304, "uuid": "920e5bf1-72b0-456d-9f64-e21b34d08192", "comment": "Malware payload (Mirai)", "value": "eb24caabc7475dd51267d03b3a52d9cad2e7791fc8cebedb7964e585362e9250", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692139304, "uuid": "ed071559-b94e-478b-a0b2-b7927d81533c", "comment": "Malware payload (Mirai)", "value": "f0003e7470860ad2e3a55cd547c8384030217703", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692139304, "uuid": "333a1081-0fa9-40c7-85b1-12ec2d29f471", "comment": "Malware payload (Mirai)", "value": "64d8a873ddac069ccdf872993ff0715f1767ece9c9463f2ec19619836b859bd61ced8a0f6172f632943aaf635e91daf3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692139304, "uuid": "700e0a6b-f1d3-46f2-b899-0915fc123b6d", "value": "T176041946EA414B13C49627BAFADF420133239B9497E773069528AFF43F8779E4F22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692139304, "uuid": "3c63eccc-765d-4d30-ae63-f0b0c40265ac", "value": "3072:yi4dj2qfT8jkfax5mF2kUzP6ym2BVA8/SGRv32oBM/RcFI:42qYYfax5mFnUj3BK8/fnBM/Rcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692139304, "uuid": "052652af-024c-4518-af42-425114565504", "value": 174413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692139304, "uuid": "246423d4-8b53-434f-84e5-16a1d3d747eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692139304, "uuid": "96d2fbed-8a36-4db6-94d1-ffd1235b6c6a", "value": "cundi.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1979926-3bc4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692142701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142701, "uuid": "e7a7e355-383d-49b4-9e75-948583b26a1f", "comment": "Malware payload (Mirai)", "value": "2bba3916955f2214a2fc3af65c38267d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142701, "uuid": "dffc7097-2a5b-4406-b377-033c3ca3299d", "comment": "Malware payload (Mirai)", "value": "ec0a7955bb57ce7b88e77027b94fa24317aa1bce81e0875378e15b8e301e1a76", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142701, "uuid": "2ad5422c-76e4-4457-805a-92cba00175db", "comment": "Malware payload (Mirai)", "value": "e810360157e559543f151383f2a0115c20dfff3a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142701, "uuid": "7d518e17-172b-4fb7-84ab-1e921b0d7eca", "comment": "Malware payload (Mirai)", "value": "ce5aa97e2cb6a04a0ec3e9debf2249fe50c49bc0436575d7cc18dbfb23dcb2c594893d05227ed8ef4e23bff1ff391bb9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692142701, "uuid": "dfe2a29d-99f9-47c1-a181-31803d9af7fa", "value": "T16614D90AAB610FBBDCAFDD3702E90B0539CCA55722A43B363674D528F54A54B49E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692142701, "uuid": "6a3461f7-184b-4832-b0f5-6a532100439a", "value": "3072:JGjOrHFOpwWQZdN+z9+JjFx6KgcsyvWuTWMofeozUr:JGjOswWQZdN+zO6FcsGJotw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692142701, "uuid": "d3441ab4-c733-40ba-8cd0-2662d23d65f7", "value": 198684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692142701, "uuid": "f426f24d-7178-400e-9fce-38e519356642", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692142701, "uuid": "b18d0d23-11c9-422c-9f8b-c94598dc6550", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308a301f-3b31-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RiseProStealer)", "timestamp": 1692079294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692079294, "uuid": "94ae1d59-5d46-42c7-baaa-881b7a4b1399", "comment": "Malware payload (RiseProStealer)", "value": "4155520471d9fc535e2c951d93e848cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692079294, "uuid": "80dc7b9f-2a9c-490c-af19-af6d5f7f9202", "comment": "Malware payload (RiseProStealer)", "value": "ec7ff734cf045b4323fb6796f58fd8e184c4975d25a8dc86c6ec5dda68557835", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692079294, "uuid": "758e3e81-d7e3-40ca-a92f-62fcf5cde2b0", "comment": "Malware payload (RiseProStealer)", "value": "ca91eedb5e526689df3aa57b14e73cb767170a1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692079294, "uuid": "09438ea2-a62e-4f09-9bf7-5ac09e9d09fb", "comment": "Malware payload (RiseProStealer)", "value": "eea040f805015473bfd20a7c839b973d096a04bf2627d512ea72cc970227a583f39e6448b9a97156e00b6c94bc70b80a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692079294, "uuid": "8f55735a-2068-464e-9e61-23fb258cd413", "value": "T18805011373E07C63E5219B328E2A86F8772DB9184F192756223BAF2F1BB11B1C572751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692079294, "uuid": "dbb50043-4b05-4376-be04-3ed8485111cc", "value": "1e9f8c80f7736eb1ac6d7b21abe9e53a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692079294, "uuid": "96bcb8b4-dad4-46ef-a41b-b7ee84f56596", "value": "12288:Hz1jZC5wLIM8rIC/noR9JG5eWpi2m8EHDwI6Y1w8f:TzCuIMqICwRLGEWUSEHDwRF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692079294, "uuid": "023cb459-6dcb-4ff3-afce-0b0c3cec4fe4", "value": 808960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692079294, "uuid": "99e0e412-594a-4dd9-9d04-ac1d2d672d04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692079294, "uuid": "739ff41d-9a0d-4f7d-a8a8-69fd4db4b1ef", "value": "4155520471d9fc535e2c951d93e848cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51490aaa-3b6a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1692103831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103831, "uuid": "47790829-a891-49f0-ae47-423ece997fdb", "comment": "Malware payload (Smoke Loader)", "value": "3280d7e005fb531c18d83404e43100ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103831, "uuid": "15419ca4-8f66-4d65-82b8-4a9fa3933b04", "comment": "Malware payload (Smoke Loader)", "value": "ecf13d15fd55aead548da52da3b0904f9671a4af5237a11a8b8fc23233ae546f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103831, "uuid": "41c014df-b523-4ac4-97cb-529e67d88c97", "comment": "Malware payload (Smoke Loader)", "value": "76ee293988b9b27d26c7c44a29b4f7295d7cf6ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103831, "uuid": "c829f94a-0f8a-44d6-89f0-e859c4549f05", "comment": "Malware payload (Smoke Loader)", "value": "42cbd05615a206c8759cb4e64e759a0dbe1d15d4cec49c05a793f78238c42afe0f88ed37ca1ed1a1b90d7d3f16c9e50a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103831, "uuid": "cbd98ac0-8a65-4ac1-a7d7-b05fd16fffc5", "value": "T16B446D1373E07C22E5268A329E2EC6F8371EF9254E59775A122BAF2F17B11B1C163750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103831, "uuid": "d845f7f6-0144-4abe-85c2-019e844ce84e", "value": "1e9f8c80f7736eb1ac6d7b21abe9e53a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103831, "uuid": "a8a1dc81-1f7d-4f84-ba6c-5837714cdee6", "value": "3072:Zgv3OeOqXmKrfaPPzBBTeIsqhdsNmoZqE5lkx/EUpN/xdNu4:Q2KrfaPVTsk8BH52cUptjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103831, "uuid": "7666263f-b75c-44d7-870e-c5e70452e846", "value": 257024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103831, "uuid": "839cc072-7dda-4f67-9550-3b415f77dcda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103831, "uuid": "74931ac9-f884-4d4f-95f0-326434656a20", "value": "3280d7e005fb531c18d83404e43100ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbf20f33-3b70-11ee-a6f9-42010a9c0055", "comment": "Malware payload (PredatorStealer)", "timestamp": 1692106613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106613, "uuid": "f4e644ca-cd5b-4c3b-8a14-bb58d96557ef", "comment": "Malware payload (PredatorStealer)", "value": "e36ce22684d90063256005787dc6f20b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PredatorStealer", "colour": "#904552", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106613, "uuid": "8eb5934b-f745-428a-aabe-d6eee50772c1", "comment": "Malware payload (PredatorStealer)", "value": "edbcfe1171767f6e2a18266e14039c5fecfd0922fd5eca64971a901ea2d9d8aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PredatorStealer", "colour": "#904552", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106613, "uuid": "a49dd592-b308-499f-b506-830aa1608d18", "comment": "Malware payload (PredatorStealer)", "value": "bc7647d15e52e72bf36fda20e782965a2e7e47ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PredatorStealer", "colour": "#904552", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692106613, "uuid": "203a9265-103f-4911-acb6-5e7e11fa5e4b", "comment": "Malware payload (PredatorStealer)", "value": "32fcbad4bce48336629794b1f71d52a86a868fded30c4c1213ffd24f36600b888fc5fc6d7eeea85f2fc92f589fba79eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PredatorStealer", "colour": "#904552", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106613, "uuid": "fe729089-4f11-45bf-8350-ff36ad5d5d8f", "value": "T10ED4CF4C7B06E77CCA17AAB6576BFF4E6C9C6830EF16209151D92BA873783016A1113F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106613, "uuid": "6cdd4ce2-4d9c-421e-b494-09d740ce7abb", "value": "9d5209305baa82e6aa42b57ce93fd250", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106613, "uuid": "2a364bc3-1de1-46ef-9abc-8504c1defdd9", "value": "12288:D8t1GmK3ENAdy1YWEt3IRiRwxahJCKxXoRwh3CX7wBO09yrxR+tmtR:D8vGz3EACLEtMEDxVoR0SMwjTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692106613, "uuid": "e1a0b489-bd61-469c-960e-6754fecf1474", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692106613, "uuid": "28590b2e-28df-421c-92e5-99837aa7c04c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692106613, "uuid": "be15e7b4-9906-4b35-9fa7-8f69bb1294a1", "value": "SecuriteInfo.com.Win32.PWSX-gen.23246.19502", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b4e5dd8-3b81-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692113645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692113645, "uuid": "17311ac7-aac6-430d-b3e7-f3c57667f9d6", "comment": "Malware payload", "value": "b0e9caea8fd19f84db5a9e8479a080a7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692113645, "uuid": "d0ca2015-e1bc-4000-9f9e-a19026e6a312", "comment": "Malware payload", "value": "ede6e01cf799d6b96b8e57c0804c91ed11e46e56d4b3ade8f5d7727fc5286edf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692113645, "uuid": "065a052e-fd93-47a6-a4d7-fdad816c3ad5", "comment": "Malware payload", "value": "57d3720db7fa56bca29a200b8156cb2e064170ea", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692113645, "uuid": "9931c56d-9477-4e48-be5e-88a6b6007690", "comment": "Malware payload", "value": "188557637fd0ff1b4991f366b4ec507d1ad9b4c8b3fb2fac2f92ade452845f69d20655176d87ade327b7ed879bbe8d68", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692113645, "uuid": "1cd159d5-d7c3-48ff-9d4c-9c1704f3c12d", "value": "T11A526C7272A75099DF0B4FF11D834C6947BC7B21C24101E9FBD8A5895E9AA83F4C23D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692113645, "uuid": "1ad764e0-2f34-4096-ba87-d3dafcde95ea", "value": "ef426f15136c05e55b613bc027fab15a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692113645, "uuid": "9d23cfcc-c870-42c3-95db-5ad1fd69da4b", "value": "384:Wcw2K3QfiQGh5X7v95zcJmLnbIe66qXMyUHwSFrEykN:Wcwd3bQ65rv95wsLnse6D9SqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692113645, "uuid": "cd35b6a2-7170-4844-b640-eaa11f7c4f79", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692113645, "uuid": "1fb3616b-ff78-4a51-a687-427d5f0e54b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692113645, "uuid": "2ec5cccc-d576-48ff-a5e9-bb9426984125", "value": "SecuriteInfo.com.Win32.PWSX-gen.28639.5048", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5fa2239-3b57-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1692095920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095920, "uuid": "20faa4d2-bace-4c3a-9ee9-70d1f1e040e5", "comment": "Malware payload (NetSupport)", "value": "bf593750943ea0cd89198db2e728c97c", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095920, "uuid": "30851031-eca6-4846-8d2c-33f765a64434", "comment": "Malware payload (NetSupport)", "value": "f0b4453ccc588c8e3304576ea4ccd6d79ffd7c64daee240201a799cbbd08b492", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095920, "uuid": "0d1b7306-eb6d-44ba-9e10-055b8f9a7649", "comment": "Malware payload (NetSupport)", "value": "c9314ae8f7bf3067a1f042240c2bde212f73e3c8", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692095920, "uuid": "bb23ab12-a8af-4f7e-95ed-d54ba064eabf", "comment": "Malware payload (NetSupport)", "value": "f889ecf80609dc80cf26b7e53490005ee77d179dc73322026ecc73358bf2ddc2bca7ac357b188b83fe983689166b56bf", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095920, "uuid": "a5b0e86a-8582-41de-ab6c-5cf814140eae", "value": "T1B542C015A99EA401D98AE9BA17DC360515C9FEAC83E72291BE344CDEE8A94A047C443A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095920, "uuid": "ae54c26f-2840-4933-89a7-20234282e674", "value": "192:uvHTQ3MQRCFODptHyQ55nfvQoBa96NPidU73OsFjn+VX/b2VGcdpWtwZ:u/UdSO1YQDvDy6kdSFCVX/mGHtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692095920, "uuid": "3fb01789-97b8-41bb-970f-dac593da9cc3", "value": 12417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692095920, "uuid": "bb1c8adc-6775-4ef6-8d29-d68d02756907", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692095920, "uuid": "e36bf7e0-631e-4a19-823b-8f63ff262a59", "value": "nine-life2990.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f668509e-3b77-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1692109691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692109691, "uuid": "fc45a85e-204e-4318-9724-5fa213d8e8d2", "comment": "Malware payload (Smoke Loader)", "value": "6db607cb7cbb8ce031eb3d83431e629c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692109691, "uuid": "be18b817-3a59-4780-a414-507390d5f4d0", "comment": "Malware payload (Smoke Loader)", "value": "f11a5c709b4786c2230fdbca87418f56cfacf4e2dcb885d417354c7b7088757e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692109691, "uuid": "6db3d2aa-b84b-4ec7-9af9-d4a441f1574a", "comment": "Malware payload (Smoke Loader)", "value": "6183682d9251be54e63a2b98b786617296694a9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692109691, "uuid": "c08162ed-ac15-4c30-9178-45c800d60f4f", "comment": "Malware payload (Smoke Loader)", "value": "447e89bd10007e0abb0c81f7d07854726c4c509459d08071b8bbb6d34857aabceec224ec842f9475e59906f0dcdf96d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692109691, "uuid": "8b1883b7-9aa3-46c1-8e4b-3be19a625f0c", "value": "T13434D011B983F071C88750714874EAB46EBFBC3557A4499B77AC2F7F6E302919BB6202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692109691, "uuid": "4e69e593-b7d5-4069-84e8-c1b2713e2257", "value": "7d6df4fc54c54990fefdaf7d1c8b703b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692109691, "uuid": "647d749f-fd9c-48e6-afc9-593059d2b875", "value": "3072:PoXEvpyZLyXGofChr8AhEeGZEe8qY91js+d1j5kLt:UDLlUqr8EEtqe8qY7/dUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692109691, "uuid": "7ab34c95-520b-4acb-8bc8-ac7fb1d5d456", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692109691, "uuid": "a59fb65a-6c61-4d56-a05e-9afbd5790610", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692109691, "uuid": "fce9576e-d2be-4a5c-9aab-52a1023e73a6", "value": "6523.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aba3a31-3b43-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692087016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692087016, "uuid": "a74bbf11-84d8-4c19-8745-5d3b13a17e99", "comment": "Malware payload", "value": "a7ff066cccb41ee6737a4629dfc7b795", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692087016, "uuid": "c96aac33-844b-4339-bf35-7be82b6f9679", "comment": "Malware payload", "value": "f3af9f82d656fd9c27e4a61ce0f05885123c108fed800bc349dc3bc962a440ea", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692087016, "uuid": "43f9820a-0f53-4037-bd47-bffcf3db6ff9", "comment": "Malware payload", "value": "cb5cad6ceb9c94c2c66bfb521fb233d53e5eb083", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692087016, "uuid": "505ac470-8c93-497c-ae59-7014b33f6208", "comment": "Malware payload", "value": "2e012bea3fd245611a1f8b5eab19ca709e2eb664f9aad675ecb04941cea1fad54258bef28bb7b5ad0a823839e952e5db", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692087016, "uuid": "22c764c2-f72e-40db-84be-e0d4dbf8c904", "value": "T130320A2BA2C013BC425746E8723D25DDE328C5355732EE20658F89396BD4C7ACE7E1E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692087016, "uuid": "009084ac-c8b0-4e01-a884-6438c5df96f3", "value": "192:xTV61wE3VsVqVuU+9C5V0qEPXqJraJFjho/arGEHXpM04nkedjs/kmhU2sTu1hEE:I3VB4nC5V0k4FjhcbEHXpH4nJKRHhEGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692087016, "uuid": "cd2e2fd2-1d6a-423d-b70d-b82f39bb779f", "value": 11482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692087016, "uuid": "47eb0693-da5c-4468-8ff4-14c5a26dfd6d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692087016, "uuid": "856de745-7627-4b68-9164-cf806e59fd9c", "value": "ztoGIndWfMwSwxSvN.flv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d904c9d1-3b68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692103199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103199, "uuid": "090e62ab-bb7d-4006-ad91-165894b0da16", "comment": "Malware payload (AgentTesla)", "value": "1a92188798a08f5f215f583de8e2d8f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103199, "uuid": "fd39d049-1266-4134-94e1-cf49db918112", "comment": "Malware payload (AgentTesla)", "value": "f3b6d3950ed18dabb36fae0e0b75cf010a7833f058f6d5f2573eb17a038f3141", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103199, "uuid": "6b167423-24dd-4459-ac49-4414b2507d90", "comment": "Malware payload (AgentTesla)", "value": "da0ffcbd9d0080151e561517ccbb2d8b34a10614", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103199, "uuid": "19063194-8d4f-4a4a-82a0-7f172ea583b8", "comment": "Malware payload (AgentTesla)", "value": "dd9c167ee2e0795e0006935c463306ecec1d1080d16fe5489a138b37349e106be75088f809ceaed98f4f3d3b4208c046", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103199, "uuid": "20f37cf4-445e-4b51-a9a2-36e5354176c5", "value": "T170D423213EED6DAFC0F5A5FA1521C8B40BB895670C26E7CC8AC61189ADF07B807C575B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103199, "uuid": "52a3659c-78ec-46a6-bb7c-5dea1f6f2c1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103199, "uuid": "76475709-3a9a-464c-8211-6d846059b020", "value": "12288:BPV/OCbLFoxtSAaV/sO1b1mPxjLntLGPuVyu4CijL48NV9GxNe:++LQR2/sYb1oxvZGGpHQta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103199, "uuid": "935eff95-d3cb-4fbb-9f52-6d9cf7391438", "value": 611328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103199, "uuid": "598e17a7-1b36-469a-aee0-a4d4e9177ce6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103199, "uuid": "5dc21476-9773-410a-95c5-893719f55fa6", "value": "Maerskline Invoice_ K22TSI71481.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c70279d-3b48-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692089220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692089220, "uuid": "7385afe5-d42c-47ba-bed1-ec81d26d3798", "comment": "Malware payload (AgentTesla)", "value": "b31ca7e113351804e0b55cd6f4a3beb7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692089220, "uuid": "62798d69-e6b6-4ba0-aad5-d2fc07afd7d9", "comment": "Malware payload (AgentTesla)", "value": "f4138806e15a620850c49a3ba7f5b558071f17f31df4fbc2b861499df6475d4b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692089220, "uuid": "14481ff8-bbe1-40ee-8d18-ec257fd417d9", "comment": "Malware payload (AgentTesla)", "value": "c0ffe81d8a8b90768822f8a5c63191ebab8f97da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692089220, "uuid": "363de0b1-3e43-42cd-95d7-779ebcedd829", "comment": "Malware payload (AgentTesla)", "value": "4bf2c5ccdf47f44fb128ddcd41b8065e1e5b8a82149f6aecceab859fb47f28d15e964bfd5ae780eb9e0f709663ad113b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692089220, "uuid": "7a352d25-78d5-49ef-9eb5-9a8a16f80ca5", "value": "T11BB4236F359613C80A83A72FCF6A4391C6A31F013E561807ACC63FD9B0225D57AE576B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692089220, "uuid": "2a9a4eb4-f673-4c69-b73a-6a243bca8afa", "value": "12288:7WbOqgaBBCy+EcceJZw7OGg2iaHHGmZPC2JmqlF2+N18Mb3LI9qEIFPe:CbOqg++DJCaGcmZaFCFNN18M3mB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692089220, "uuid": "710d7a98-adea-4bf7-8837-b29d87a0d3bd", "value": 512293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692089220, "uuid": "74fa564a-290e-42d3-8336-de02e433ffb6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692089220, "uuid": "4e819b4a-a7c7-4d36-8543-9f82fe12f8d3", "value": "PO H0001.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06c8c4bc-3b7b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692111007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111007, "uuid": "3c640b92-7409-4e29-b6b1-cbad727b8862", "comment": "Malware payload", "value": "8801490d1286a23ca42d0a91d39af602", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111007, "uuid": "ea47a6db-b44c-483f-ad96-56ede8cf721a", "comment": "Malware payload", "value": "f85fa90ff4c4b99f1ba4578a7f5f8cdc3579e934277ebc37e9fdac42c4d113a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111007, "uuid": "45ae3ff7-f5aa-4644-8964-2a7bc0b1bdfb", "comment": "Malware payload", "value": "c2dc58d90302845b1b5eaff241e429b1bc295cba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692111007, "uuid": "1150f816-24ea-4f4d-915b-24a0e880a9de", "comment": "Malware payload", "value": "df4d67d3f9a7f50b3e5bf1091570faddcc652728a7fa8176bd45c573da6623c23b6694b145f42f76d27276508260c1d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111007, "uuid": "ba89cc4f-060b-45cc-8dd2-cb1ff8e889cb", "value": "T17F236E4037DCC13AE2FD4BB5A9F3A24486B5D2676903C6496CC814EA2B13FC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111007, "uuid": "0b49e0a4-933e-430a-9f1f-733485d1b8c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111007, "uuid": "72b93b1e-fb9c-4127-bacf-059e0a374bdc", "value": "768:oq+s3pUtDILNCCa+Diiw5qwXguFnicB8YbigLL5WHnOvFDvEgK/JfZVc6KN:oq+AGtQOiKgmzbFH5GnkDnkJfZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692111007, "uuid": "d9d33193-860c-41f1-a0c3-c22c240261f8", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692111007, "uuid": "9bfebb7c-f541-456a-99b9-0e7f9452eb42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692111007, "uuid": "a16f49ec-26b4-4143-812e-ffec2742cd5f", "value": "decode_bcd9e85f6eeba4d98318ed33476f474331678660bde7fb685e06d25dcb73d31d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62114b05-3b6a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SpyNote)", "timestamp": 1692103859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103859, "uuid": "f698f363-24ee-4f2a-9b92-51d59b225798", "comment": "Malware payload (SpyNote)", "value": "fc3d73f557dddf0ad172f568a9c4717f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103859, "uuid": "5c6e5310-3c99-49f9-8137-0c505ec350f3", "comment": "Malware payload (SpyNote)", "value": "f8684449021b9b0e7b6738f8e894ac214b2d4e40713a2d4a2c5f086703d6c10e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103859, "uuid": "7fdbc577-9bc6-4634-8e46-b1d7004b4988", "comment": "Malware payload (SpyNote)", "value": "ddeee863f001d982d1d2d0b68f290dd7674e0e9c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103859, "uuid": "1d47f421-decb-438e-ab56-2d8c4352be70", "comment": "Malware payload (SpyNote)", "value": "f2bd5c67052693daf3ff472d9be849ce9f2203cf10eb296828d22dddfb16db0a29a35d5fd236e0f47b225a8aa45dd9d9", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103859, "uuid": "09da46f5-7cf1-4467-a3f1-e73a78fca9e5", "value": "T11AB6CF53B916CBC3D47CC3F47E170FA92A171F0895916AEB00153A6E7EB22E209DA5DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103859, "uuid": "18e93fce-ff93-408a-b719-6bb224ace196", "value": "49152:d/pUi+NC+xrlQ533joz/mzpzdGGlQTOgruUoYq40cgBA+5y:d/pUNCwrlWjAmzpzBKT5r0tBAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103859, "uuid": "dde69468-abd7-40a9-8219-593c01f101de", "value": 10768300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103859, "uuid": "5e3e4c04-76e6-4011-812f-4c01da635e92", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103859, "uuid": "b19c82ac-a972-4816-bc7a-5dc23d0e4c1c", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffec13f0-3b68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692103265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103265, "uuid": "a63aa242-8a02-4869-b95a-48dae7c728a8", "comment": "Malware payload (AgentTesla)", "value": "e6f380ba0d38b2f5c63dd708b03fe7ea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103265, "uuid": "55f5ffd0-42bd-4267-99eb-b76ae25171f8", "comment": "Malware payload (AgentTesla)", "value": "f8ee24d3d503b8f46747ff07f769b8be58ad51de60d4c62e2fbc551ee47a2c8e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103265, "uuid": "6402689e-2041-41d4-8928-aedf05460783", "comment": "Malware payload (AgentTesla)", "value": "eab8cd75fd30c3f165a9b590dc99c1cd02f49b06", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103265, "uuid": "8df33608-5ea7-4aee-b730-d38e04de504f", "comment": "Malware payload (AgentTesla)", "value": "0e9ff69c09722b66269ad8cc85451e0c9ae0f9013fa625cdd0f324889900ce95fd6fb005e502946651fed9ad7059ee62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103265, "uuid": "9590ca4c-613c-4c9a-8da8-5c432c6bbfa8", "value": "T18FE4232E68CCE799D3CB34AF8569695A0F2B6E0EB16E05881D7B1A1F4C53CFF6240153", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103265, "uuid": "23898221-085b-41ef-a001-0c3313752528", "value": "12288:3wnW9BGv7BGCZ7AjnGpXetV7ZXUKKaqNxxN5gS897G7E0xNGpXhIuFMlGjHUp74:AdQS7AjnGputVFNeNxxYI7E0xNURXMcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103265, "uuid": "9a01754f-9c2c-441e-8bdf-5570c22a26ba", "value": 677640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103265, "uuid": "d0fab2c2-be0a-4af9-9344-140a0f7a4a93", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103265, "uuid": "9a0263cf-4254-413b-a4f8-0c35c390dc07", "value": "ATTACHMENT.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b94f463d-3b91-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692120756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692120756, "uuid": "ddc156ff-c74b-49d0-9bf1-cc8b9ac30e7e", "comment": "Malware payload (AgentTesla)", "value": "29971b59f02d473149cf7bdef71e837a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692120756, "uuid": "32fa47f2-3a7d-4292-86eb-2779d658fe40", "comment": "Malware payload (AgentTesla)", "value": "f914474e6b67675154294af3856b61d22b8017ba97b055727470caa54c262a96", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692120756, "uuid": "9deb5f58-b623-4080-8c75-0c5e7ebc443d", "comment": "Malware payload (AgentTesla)", "value": "a91874be542ca2a2286ad9c1d595beb2f48043f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692120756, "uuid": "f8aa3df0-9bb8-450f-b327-a8a40acb2ed8", "comment": "Malware payload (AgentTesla)", "value": "9a7a8016aa16b8f28008bf3579df4bea099fc3f9d1fa428e43daff766780c6a8026f81540e9ee54b7a6cc2a1465d1fd3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692120756, "uuid": "72f27ecc-6d34-43cb-b8a3-6563ed9ad4b5", "value": "T153242C123141056AFE773676B55FC93002609FEF936ED70A238B3F664F9236944B7A0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692120756, "uuid": "d048f44b-5652-472c-8f11-30b7681c28ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692120756, "uuid": "941d12f3-9721-47bf-8fea-224c5c70d510", "value": "3072:XhgogMFoQHY5H4iqEwwR2H9EuIfhAP8tgCqXYWXqgy7U6S7NMEihdD4Ceo4NAyNR:XhgxOoQHWHfw9xwAENV45l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692120756, "uuid": "b3e99f72-4705-424a-b36a-7cf80f1b4ce1", "value": 210944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692120756, "uuid": "35f466ec-2eca-40cc-8e7a-88a9bbfa4e3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692120756, "uuid": "88c89d83-3413-4cfa-941f-d66528c97e2e", "value": "SecuriteInfo.com.Trojan.DownLoaderNET.714.31774.13401", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076fc751-3b69-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692103277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103277, "uuid": "20cec33e-13e7-46a1-9e4e-51eda7c35cf6", "comment": "Malware payload (AgentTesla)", "value": "41cfd2414fbd05c1724ade0024857df7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103277, "uuid": "020905a2-69c2-49ed-a89e-7a6ae1542581", "comment": "Malware payload (AgentTesla)", "value": "fa7e805da55bb66c704965bb7d94b75333fe32896d932ebe0d8ed095349a7586", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103277, "uuid": "71036891-3bdb-405d-8c68-e6c4c183cc7d", "comment": "Malware payload (AgentTesla)", "value": "926b095c600aedcfaff9d04f4c4af7498f85024e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103277, "uuid": "bb6e8c6d-aefb-4ccb-a83d-ff843ec5f778", "comment": "Malware payload (AgentTesla)", "value": "f214d3e6eb56c8376d31765f6295b8786276bb5ed2a66a5ab3fcb35155520894c253741048a5921a4bce66b66e50bc93", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103277, "uuid": "f465192d-ce4e-4be5-a74c-85b3c152675c", "value": "T16AD42350FC02B4D9C20BC47341A56B76006BB6CFA7613B68FEB4AF7684D03E29657B48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103277, "uuid": "b4d97a51-55e1-4397-b672-d7bccf460443", "value": "12288:dgnWjnzVvTZ+Imd2ajgju4sYeicXWtEw3mc288soOqtaujdQckBC:SKZYIbajIhsYeVIEZcis+/RCBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103277, "uuid": "64199e2f-7f83-470c-b3d4-7ed6fb6b95b8", "value": 646384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103277, "uuid": "d79303a2-304b-4242-821a-a04b58f6d0fa", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103277, "uuid": "35cc34c5-d849-461d-a699-c240b36ea489", "value": "Quote 080912540.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214e590b-3b69-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692103321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103321, "uuid": "002cd37e-976d-48f5-938a-61f4fc563b8c", "comment": "Malware payload (AgentTesla)", "value": "2623fca6cc2f795a71ac9aaf3257387f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103321, "uuid": "6f3dbfb3-89b2-47ed-819d-a2bb4d359d5a", "comment": "Malware payload (AgentTesla)", "value": "fb079022ee100b50b3048761db972e012f1e3dc2f140f6d5c63a8922ffef7d6b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103321, "uuid": "34c5b353-94b3-48d9-b0f8-c60e3cc3b9f8", "comment": "Malware payload (AgentTesla)", "value": "d447141f6288ec5b8b8ae7385627b42eb18f2f43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103321, "uuid": "f6e4ad13-3c78-4cbb-8efe-1379f8799363", "comment": "Malware payload (AgentTesla)", "value": "0fb291389dbf7ef8954204ab2f9592d3421316cc0908f0e87d5b861ffc12081bd1b1a9ae2c6a8dafb1822d590673c98c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103321, "uuid": "789e7430-693f-4551-b39b-4a801120d739", "value": "T1F7C533ECAA724D476C9172747F690F3D90FCAF4682923411CD66BA22C9E0DC5B646FC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103321, "uuid": "981ddee8-e927-4e47-b714-9c5dc00e6b6c", "value": "49152:K5ZHpNGLvpwN43LMbEHzd46jJgZYwPrJaVjq/FG7ebhdX1:SNop1nHzdJjJgpPrJwjq/XX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103321, "uuid": "868a409b-8063-46b8-960a-74902728f205", "value": 2505609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103321, "uuid": "6b7184eb-9dac-45fb-84f4-bd766d4049ca", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103321, "uuid": "2c371380-5f57-4a54-a6d8-957348067852", "value": "Factura de proforma.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e8aac4-3ba3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692128395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692128395, "uuid": "d7a76dbe-22bc-408a-b7ea-eb0c566b2966", "comment": "Malware payload (Formbook)", "value": "6072355596f3a49926f9bffbaae67427", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692128395, "uuid": "5c142aea-f2c8-43f9-a173-7487ba95798a", "comment": "Malware payload (Formbook)", "value": "fc563ce0d3583e88222493534f0f02d94ca9dab17c906c5deacf7132852b51b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692128395, "uuid": "545f775a-326a-4055-a24e-49c6fab423a8", "comment": "Malware payload (Formbook)", "value": "3e508af8ef5cc535a2d57aafc393868da500cb4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692128395, "uuid": "bd7ba14a-24be-4c16-b04d-9046a665a018", "comment": "Malware payload (Formbook)", "value": "10913260becbdaf807099e2aa60127fa9f03978fd1ac41f1cd8f81195ac8a828082b8d48b35ca79353f2f5ad67528610", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692128395, "uuid": "b62397f8-8828-43f2-9973-edc1ad28d930", "value": "T12F54128D6FB4D057D49207725A798AB39BB61A1328E4270217709FD8FDF0641EB1EB23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692128395, "uuid": "9bf7f625-39b2-4e0a-aea5-29da64c751ce", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692128395, "uuid": "ccddf2fb-0883-47f9-a009-374f9b7868f9", "value": "6144:vYa65RD7J34PQOZcqGNkEMkC7m0QG3a4S/I8LMOQ1J7:vYLvoBAkwC7m0QGP8LMX1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692128395, "uuid": "a6a8dfce-273e-4e5d-8774-061b6295603a", "value": 281213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692128395, "uuid": "f69779f2-f212-4ba5-a092-10eef0fccc97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692128395, "uuid": "4d1a59c0-5118-4042-a7cc-8e6c2c3eba6a", "value": "6072355596f3a49926f9bffbaae67427", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2187adf8-3b43-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Blackmoon)", "timestamp": 1692087000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692087000, "uuid": "c4de5645-0c20-430e-af29-461f2d450674", "comment": "Malware payload (Blackmoon)", "value": "66eb12a7175790214885a0e936df8504", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692087000, "uuid": "09063274-3d46-47bd-9165-fccfcfd089ee", "comment": "Malware payload (Blackmoon)", "value": "fcba6c2aff2a034a1ac6ae3223dbfd366165404984ee0381341277fb7ea7c87c", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692087000, "uuid": "942df36e-2f07-4332-8914-8606744ccb72", "comment": "Malware payload (Blackmoon)", "value": "6954f73b7fc69acacdb9e495fda2672c57c8d132", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692087000, "uuid": "27d2d519-e5f3-4ec0-a5ca-f9139f0a88a6", "comment": "Malware payload (Blackmoon)", "value": "0898ee641dba1d4faf1003b81aa0edcc9fcff7e747023b9eb97fa3283796b980e413a295b9782ea5e7d1b9215ada1656", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692087000, "uuid": "b5a0d3de-ebe5-4936-b8d1-458adb42128d", "value": "T14EA4231096503E53FF6B28F193A377C7A980A2D1565FC02B8DB710BD4BEE6049D72AE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692087000, "uuid": "1c9b4ec1-a638-4de6-91b1-43da72a3760a", "value": "12288:oGy2/LsnXUvfUPgrxhbPkQayPaK8UIFnplh37q4v:oz2Trv2UxhTBSKIDlh37L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692087000, "uuid": "f2e836e0-fc47-4061-9739-50304c4b0d6e", "value": 464595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692087000, "uuid": "18716a9f-0f4a-44a7-a88b-7fd37c677cb1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692087000, "uuid": "9e21fb6a-2d1d-4a1b-84f1-eb7e7802ff03", "value": "\u5b89\u5168\u9690\u60a3\u6574\u6539\u9879\u76ee.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab77b39-3b69-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692103363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103363, "uuid": "1d81f4ce-7576-49ba-a0e7-e54843655a05", "comment": "Malware payload (AgentTesla)", "value": "83414c3d7b1a9558870bdbf121028790", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103363, "uuid": "cb7b48ce-b903-40ae-8dd1-1d7450b1d718", "comment": "Malware payload (AgentTesla)", "value": "fd0b5471a1c071d85663c79307a63dd66b9e67eafcb18c47601e932ef54b40bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103363, "uuid": "c1ecaec8-0ec7-478c-bfdc-e148028c4c14", "comment": "Malware payload (AgentTesla)", "value": "0f93285282f54e0c8480fda717e24ccf1b676fd9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692103363, "uuid": "9d1f1244-053d-446a-ae13-3a14fd2cf21b", "comment": "Malware payload (AgentTesla)", "value": "225a05573d0a7975fa320d89638a9d03dc58e700bbba730e3ce7378072e81e6838ff53daf38b1ff00e91d92a49856e8e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103363, "uuid": "68ceb3f8-faa3-4a2c-bc2f-b7a07b039951", "value": "T1DF55CE067355CF21C51F1671C5A682F4032BEE54EE22D3CB71CDBE153AB33AA6A6124B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103363, "uuid": "a2a62c4a-0247-4684-b74c-139376e6dccd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103363, "uuid": "8ac79dc2-dd76-43ab-b8fc-3a60906a4a65", "value": "24576:7BvPLAGi+Zm0Y9prbel2EYs/mWdhXEqmvArsB/O:rUdbeAXnkW2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692103363, "uuid": "1d23b998-b00e-4513-850a-4802d5ce6e6a", "value": 1321232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692103363, "uuid": "1315e25f-54f7-4e72-be83-cd988ed57afb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692103363, "uuid": "bb5c4d10-666f-4ee9-a020-53738b1cce67", "value": "QUOTATION_AUG7FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47bb3193-3b64-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692101238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101238, "uuid": "b076a9e1-547b-47bf-b553-5682d93cbada", "comment": "Malware payload (AgentTesla)", "value": "7745432624df29d55537746834728200", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101238, "uuid": "daba1188-e22a-400d-aff4-dba93dda3456", "comment": "Malware payload (AgentTesla)", "value": "fdc04dc72884f54a4e553b662f1f186697daf14ef8a2dc367bc584d904c22638", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101238, "uuid": "17d08db3-585f-4544-baea-e7c4ad63dbb9", "comment": "Malware payload (AgentTesla)", "value": "9e8b6be2fe10a60732d72486514acc372604f9fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692101238, "uuid": "e09bacd8-81e1-4fe4-afb9-7cc4755c0d1f", "comment": "Malware payload (AgentTesla)", "value": "69d3f920d571c18a8177e0c674c84e5d85c4c02f043ab4f18eaa375f4d2e948e53e63dcfa94fde11024c4572fa39bde1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101238, "uuid": "084744a8-472c-4164-81cb-a50aeb80ba5e", "value": "T1EB55F103E900DBC3D41D83F87E530EE90F0A6F19E99569DB14663F9B3B70A72099A16D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101238, "uuid": "e594d197-7bb7-463d-bdb8-7440caf5087a", "value": "24576:IaZy0w6VgjKaWlEzp7alZydw6VljKaWlEzp7aUzd6f/b7QAUQp5E/zwkx:IE86VgjKjOzUJ6VljKjOz5dU7/UX/z7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692101238, "uuid": "3f567a59-449b-48f9-83e1-59dd16109991", "value": 1330176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692101238, "uuid": "a064d083-4fb4-4ed4-9be8-021f15cbf703", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692101238, "uuid": "15a1999d-f672-42e8-b4c7-6365ff7d3d3b", "value": "Order 45232429.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5502f7a2-3ba2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692127889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692127889, "uuid": "c0dffc9c-5a59-4ca1-96de-22f0023c01c9", "comment": "Malware payload", "value": "d34cc79c32e7ad12ca8a5e5c4f04fded", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692127889, "uuid": "c669a4b3-7377-4c17-8cbc-6e7903b005af", "comment": "Malware payload", "value": "fdf432e7576bc75fcb800a21af72cf89ac726e78c80650f39ada4917abf2aa40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692127889, "uuid": "7ef08fe0-6cd0-4e77-8549-74335967e4a8", "comment": "Malware payload", "value": "be2eb957d54c83da07d1f5b62625c758e7d056c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692127889, "uuid": "d38b025e-343b-4472-91bb-306aeaa9cef5", "comment": "Malware payload", "value": "8b58832f1caa1e6f37a96dbc45f9bdcdb5f59fe2854484c6bf03aed6af393e43b039c68ff456915a49bb954c59980c9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692127889, "uuid": "8296bbb1-71c3-450c-97bc-8df642e4c6ab", "value": "T168D423D016192713DEBF1D3580646EC291FD4F7BB1872B3928D58C989932EABF224DB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692127889, "uuid": "c771eb2a-6a06-42fb-a2f9-cdd10160ff23", "value": "12288:0LEt3wDh6C+8UM8ihHe8vQrB87Ikxh6IH7+iTDqzxW:Pt3wDh9rf8ihHe8vQrhifTDqzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692127889, "uuid": "51040440-1751-401c-b0f0-e7399f98992d", "value": 599552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692127889, "uuid": "c8df735f-db4d-4b4c-b990-f6dc94d23ca3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692127889, "uuid": "900ac44d-5ff5-4ae9-b221-bed72cf84279", "value": "SecuriteInfo.com.W64.MSIL_Agent.FZI.gen.Eldorado.26307.10954", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d539fc-3b46-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692088378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692088378, "uuid": "0a897eff-d81a-4f87-b922-cc3e863cd496", "comment": "Malware payload (AgentTesla)", "value": "3c33a67723477474dfe2015870bcd687", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692088378, "uuid": "29c35b4d-da59-44fc-88d2-0031bc69ce64", "comment": "Malware payload (AgentTesla)", "value": "fe92612c0c45638d7bdbc9f3ed7d531da042b05c3281d3020c4c3cf4cecddfe8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692088378, "uuid": "d203e880-2747-435b-9b55-39f563e420a7", "comment": "Malware payload (AgentTesla)", "value": "7c6c8e5cf7c1342a4782db4ef2ee1f7e13bd76dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692088378, "uuid": "d40a7b04-f930-4d3e-8ffe-1667f19a78c2", "comment": "Malware payload (AgentTesla)", "value": "d15d7428795f6573a4a791487954f609145e89643ae3293ad090b586578709618776cf1150cff0e14584d209d0594de6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692088378, "uuid": "cae1e964-d014-495a-a13a-95a8bbdfd8e5", "value": "T1CFB4236F359613C80A83A72FCF6A4391C6A31F013E521807ACC63FD9B0625D57AE576B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692088378, "uuid": "c912fbad-6dad-4e5d-b21d-f48afe8b1676", "value": "12288:kWbOqgaBBCy+EcceJZw7OGg2iaHHGmZPC2JmqlF2+N18Mb3LI9qEIFPH:hbOqg++DJCaGcmZaFCFNN18M3mS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692088378, "uuid": "d4056c5a-c9d7-4661-ace8-238ced660146", "value": 512343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692088378, "uuid": "e6965569-334f-458c-9364-265044627f54", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692088378, "uuid": "03eb60fd-40d5-4cd2-aa1b-fc4544277ed5", "value": "CONTAINER LOADING PLAN ETD 31 JUL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f7ef1fb-3bc4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692142482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142482, "uuid": "500769c4-6bf3-46d4-a28b-1bf976332a75", "comment": "Malware payload (Mirai)", "value": "3e9baab92317a597ad7c1129b79d4f8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142482, "uuid": "2f3bfe1e-974e-4a61-a101-4557ce0e98c6", "comment": "Malware payload (Mirai)", "value": "ffa2336432ad7a1930e531269dcfeaa2c029ffbc14a93640aab855379753368e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142482, "uuid": "fc23281a-7700-4fa7-a1fc-04d5c7e40a68", "comment": "Malware payload (Mirai)", "value": "31b0d4925232c7750d124d6a194dce5281ffe38b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692142482, "uuid": "6f4b2851-ae6a-4efd-a5da-51df66da1b72", "comment": "Malware payload (Mirai)", "value": "44d4aa83b6dc2665f02ece845e3ead576ebb935f3953a582608bc795ada270ac3a37d02cb3c554c32a4d882fb98d0b16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692142482, "uuid": "cf4c6771-9ca7-4463-904d-bd5e92261a8a", "value": "T1D0E319D7F900DEFAF80AE33748530905B130BBE245925A373267357BED3A1951867E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692142482, "uuid": "806b4204-7fb7-46c9-8cae-084f45265e05", "value": "3072:aVhXvAVNxZtOaAioWOUHMucACgrq1WVrjbiGLIJeFa4ryDvDxt:EhCNFrHMtA5q18LIJeFJyDLxt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692142482, "uuid": "6ba4f2ad-ddc2-4c87-b8c3-1592a2590271", "value": 145088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692142482, "uuid": "17bdfaf6-7fda-42d3-b6fc-6e553c6cebb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692142482, "uuid": "056ad1a8-a2d7-422a-89a1-23a350761947", "value": "3e9baab92317a597ad7c1129b79d4f8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }