{ "Event": { "published": true, "date": "2022-04-06", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-04-06", "timestamp": 1649289782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "79ca29db-0151-4fac-b1ef-9d5a3718f026", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8717a332-b598-11ec-8e58-42010a9c0032", "comment": "Malware payload (a310Logger)", "timestamp": 1649242724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649242724, "uuid": "a7d79af2-553c-4ea6-ad16-c8398d9cef74", "comment": "Malware payload (a310Logger)", "value": "1c91e5d2ec946bebc3f2d3c86f561ad9", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649242724, "uuid": "8bae6368-09fd-44a4-a67a-9b82db823231", "comment": "Malware payload (a310Logger)", "value": "00050076a05669ce423524fae8c5d6cd1ee3aa837551d2c7441f1b91c95e77f3", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649242724, "uuid": "724f2479-9be1-4473-b791-87b6d35f9963", "comment": "Malware payload (a310Logger)", "value": "0f997064da90f57dd60497a4083eb0c9d58a6e21", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649242724, "uuid": "e1d6e223-41c2-4bc0-a125-30c213011a0d", "comment": "Malware payload (a310Logger)", "value": "b225a301150bbbe37d4411398c9782da1b182b434cfc1d1fef9c93dcb6390b50e4182a7d1adf326876af7764152ee880", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649242724, "uuid": "b461ce49-4a95-4edd-b2f8-c19397950fb1", "value": "T17E544B0027EC8B9AF2FE4BB8D4B01265C3B1B466B83EDB4E5D4465ED2923740D945BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649242724, "uuid": "a3372510-31cb-45d9-9e5c-c3f51635efc8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649242724, "uuid": "e11bc7f2-bc62-466a-a0f0-33648e101061", "value": "6144:3f+BLtABPDOpJTNN6eTSUdZ/pOlYeJqlA1D0Sjk:ypYSSUdZ/olYet1D9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649242724, "uuid": "e3349baa-0e69-4ed4-b806-c6aabe87fd74", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649242724, "uuid": "8779e000-2737-4964-aa91-0f29397108b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649242724, "uuid": "5aad1353-7cba-4d29-be8c-2d764458a9c3", "value": "MIDNIGHT FREE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "142b3c81-b5b8-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649256275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256275, "uuid": "1c004bc4-2f66-4e07-8d8e-f0177bb56b61", "comment": "Malware payload (AgentTesla)", "value": "04b4cedaaf3396509b42428cde6bcef9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256275, "uuid": "4d20074c-e29c-4f85-8a6e-5c19a6e635a3", "comment": "Malware payload (AgentTesla)", "value": "00be19964da4c324da4d07d01bb79abec41b4b03fbddaac3b870ed363b4921fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256275, "uuid": "08eb3fde-f70b-40cf-91f0-789b6b125b24", "comment": "Malware payload (AgentTesla)", "value": "d6e68929b995eccb2d96af937719031c46751733", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256275, "uuid": "ff27a690-cb59-4bde-8281-84b27e0b926b", "comment": "Malware payload (AgentTesla)", "value": "a418e08a47fa5ef411e53179af5884e2d5c3871328f3b85afe3976f48ac3a7c982bd730a6175696e253055a1298c4781", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256275, "uuid": "6f25de8b-af1f-4044-9234-fd40917534a5", "value": "T1B6C412097F64DD67C9A12B364DB0C6349778EC182E2AC30767E2FF6F78367816A46241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256275, "uuid": "6d77e380-3bed-4c4c-8111-2cbc9de8283b", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256275, "uuid": "8df9f1aa-61e9-4375-a5ee-54d760ad73f0", "value": "12288:INpkyijuZ+cAkMA89T1g+gu96gEWEoRv9Jh81TWUKz:INhas/BM79xg+8gEWEoRvHh81TUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649256275, "uuid": "37f408e2-e896-4101-b769-9c0f8433155e", "value": 559076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649256275, "uuid": "fae527b2-8fdd-4b0f-971a-912f0b6970b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256275, "uuid": "950eca73-e974-4df4-8977-24d31df9a5b5", "value": "Offer request-4040.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5b7db1a-b5e9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277645, "uuid": "d813bc29-537d-4fc7-8577-4565e5e4c264", "comment": "Malware payload", "value": "1ddef0c9b808f30a766fb81bf3be69a5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277645, "uuid": "a1866603-595b-4f75-9aea-4465da4f69a8", "comment": "Malware payload", "value": "0148915aa8bffcd91cbc7c4036f902b5fa23d5b394a1a827f939c85c0f87aba6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277645, "uuid": "75fddf60-d405-4249-b192-98075fab36bb", "comment": "Malware payload", "value": "6396f08e6d76d68de909cda7ca3f579a6ce08522", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277645, "uuid": "60a2f989-c023-4b64-9831-60e5a90ef640", "comment": "Malware payload", "value": "2a0a6186c7bc42b8a0500c507bc071d258b21f0310ed8fde048d211b13fbbe303240651594031b1a418987b1a18f9ad1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277645, "uuid": "07cc406d-2e7c-44cf-b074-b7ec3538010a", "value": "T1AAA1F850112C1AB07246597ED26FFB52B80EC81B09777B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277645, "uuid": "622d85c0-1f70-4bcc-b8d8-c362d5b7021a", "value": "96:9wRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:2RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277645, "uuid": "5587bb41-663f-4a06-aba4-61d2a31c2da2", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277645, "uuid": "53ef8d56-c6ac-4227-9a09-a6154f278a3b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277645, "uuid": "80d8139d-6065-432c-9638-f90b7f0dae4b", "value": "0148915aa8bffcd91cbc7c4036f902b5fa23d5b394a1a827f939c85c0f87aba6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18623b14-b5bd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649258430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258430, "uuid": "0cbdfa64-5e75-4c07-8848-77cadf327913", "comment": "Malware payload", "value": "0949babb72327dba5057880d06fb03d1", "object_relation": "md5", "Tag": [ { "name": "FRA", "colour": "#FC6B68", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258430, "uuid": "477a309b-2eb3-4fd8-ad8c-41baa0733661", "comment": "Malware payload", "value": "0196a7e9b0ccc51e7c8f69ac0de9ddc45f2d543680fb4dde8a45465fb5d16054", "object_relation": "sha256", "Tag": [ { "name": "FRA", "colour": "#FC6B68", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258430, "uuid": "3d1542b4-cb8d-44e6-ab50-be4e4a04ae3c", "comment": "Malware payload", "value": "b662ca88835ec32ee7d05bbba52b5eb895c689e6", "object_relation": "sha1", "Tag": [ { "name": "FRA", "colour": "#FC6B68", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258430, "uuid": "af61ac62-344b-4f94-900d-bb5dba5db819", "comment": "Malware payload", "value": "acb54a57957339172040206b2069fcd18a942cb31028d96c8296d5d5096093ade977fa667f567f72dff55c1b36b54da4", "object_relation": "sha3-384", "Tag": [ { "name": "FRA", "colour": "#FC6B68", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258430, "uuid": "77593cc4-9afd-4727-84bf-fed8ff3a0137", "value": "T166B28DD12AB54DEE1854443E4F982FDA6020B6DC506AF9EC644BCBCC109BF604EB87E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258430, "uuid": "6ea0ff5e-b41b-4c84-8e31-18db5ebb0ffd", "value": "48:Z0UZ0UZ0UZ0UZ0UZ0UZ0UZ0UZ0UZ0UZ0UZ0UnNfrF8ox4L20UZ0UZ0UZ0UZ0UZ0S:nNfrF8oxea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649258430, "uuid": "83b244fd-b61c-4cbd-92f3-614d1a90292e", "value": 24883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649258430, "uuid": "7766f04e-2943-4fe8-8b51-288d4c36d0b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258430, "uuid": "fff40219-6f0f-4230-ad01-08604dd61092", "value": "Votre relev\u00e9 fiscal.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e95c0b-b5e2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274362, "uuid": "0e7cce3c-58a9-4ddf-97e9-6084f49090b6", "comment": "Malware payload", "value": "b5fc2b6b71f92ecca7e7c7eae86ada26", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274362, "uuid": "9f64881a-6e06-4f64-9762-962ec3b56e3f", "comment": "Malware payload", "value": "025eed745d2991b6b081614153f309e9492dfd12c772ae72d0af4bde37786db1", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274362, "uuid": "1ce5f4a1-561a-4667-bece-73d162486784", "comment": "Malware payload", "value": "e20224af2ba31c26ec32aace86f25bcda822c325", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274362, "uuid": "fd0e02b7-078c-481c-b0f5-14dfe50f1085", "comment": "Malware payload", "value": "037085662ca7c5a3d920a795a442df97514e6093d384c5fd53a559cf9373aa107361a6660ff4f1b07397da035e10a062", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274362, "uuid": "c7b9cacd-07ea-48a2-9b3a-c737685d57f2", "value": "T15AA5330C0275B8FCF95E062937634EE0C2F972E5F94261D2A2641DA85D3F5BD03AF962", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274362, "uuid": "b4442afa-b6e4-43f8-9dfa-60f000fd768d", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfpK:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274362, "uuid": "1291a7bd-2596-4346-aeab-07dd282a38f0", "value": 2265088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274362, "uuid": "47a63d9e-04f2-4cab-83e6-0a554bba21fb", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274362, "uuid": "57cdf911-1a0f-45b8-9710-d7b313318d76", "value": "025eed745d2991b6b081614153f309e9492dfd12c772ae72d0af4bde37786db1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db581e2-b5e2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274357, "uuid": "eb1df4b9-5be4-43f2-a6db-8c5ff592a102", "comment": "Malware payload", "value": "5ff57bc796cc24ac6b5cfcb7f8c24c5c", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274357, "uuid": "5f262c22-8dac-44da-975b-5d64660b622a", "comment": "Malware payload", "value": "029c62fa0fb60afd14beb5e91c5edf8e740b37d4c74a1b9b339a25cc889664f2", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274357, "uuid": "7caf57f9-440d-473f-9612-c54b5e9019ba", "comment": "Malware payload", "value": "49f89bb60301eb9b13fcad68e3a736de0f7bfd9e", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274357, "uuid": "3ec35ce1-b5c1-48fc-ab36-44d038aaffcf", "comment": "Malware payload", "value": "ed737e94e81ec39cf8ce4826ae3002f21048d176027c214fd91722133ba31440f14f30ef58c73c0af3ec56c4cd3208a6", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274357, "uuid": "c389ab46-ea53-4e1b-a421-820f999cb16e", "value": "T160A533B5B6DE30BD9AA8B17767FFC924303BA2CDA0558BE06DB611CE14021319AD4F1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274357, "uuid": "f241052e-ca1c-4676-869b-81b59855263a", "value": "49152:HT0+oOBiXLUNaRHKmjsbS21i2F/ecE+0n9aFctnpbbTruN3MKA:Hos909Qg6ecEZHy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274357, "uuid": "8a646f3d-30d9-4e30-84e9-77936f55d11b", "value": 2076672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274357, "uuid": "ccfb7ec6-3a09-4709-a0da-3ba7565e7814", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274357, "uuid": "610e6b76-7f26-4ec4-a218-945c540d521f", "value": "029c62fa0fb60afd14beb5e91c5edf8e740b37d4c74a1b9b339a25cc889664f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a7d8ee-b545-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649207069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649207069, "uuid": "ce58db03-eac5-467a-8076-e92f301ba602", "comment": "Malware payload (Heodo)", "value": "7b970d697821fa3732ad636f5d0e0149", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649207069, "uuid": "6d3472c5-6b86-4185-811f-3fbdd2c6addc", "comment": "Malware payload (Heodo)", "value": "051a280dffb84c7b7bf98804fd66405b6705d901ee40a4eb188d74ce69322189", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649207069, "uuid": "0c77cf7b-5f41-4c97-829d-dd9e2df8489b", "comment": "Malware payload (Heodo)", "value": "0a61eb2a03c615478ed6d4c1a491afbf356e95d2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649207069, "uuid": "3a532935-56ec-419a-8550-11420056e192", "comment": "Malware payload (Heodo)", "value": "e2a38c0f4839e48a7bd6d921726a2036220d25b29af7bb0d2cecf27b58df6cd840449460858c2bb814e52baf9b75745a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649207069, "uuid": "80cdf60f-1755-4e2e-97c5-6906f226fe61", "value": "T1B084D4A35BC3C077E41B06B9C65A5118B157CA32375AAADF37C1671ECA3C3A2B738161", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649207069, "uuid": "dcbba7b5-bfed-4519-948a-524e75c163e0", "value": "6144:wGOAWAyzLzHKwJrCf9dJJjI1rQlzLOu7H7pLYsDgiZ+/TccZr40HOnUqSEnyk3up:wGOAWAyzLzHKwJrCf9dJJjI1rMpUsN+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649207069, "uuid": "371b7c31-8920-498f-b8b9-aa48deb63959", "value": 374200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649207069, "uuid": "1621278d-c0ba-4cea-b170-9b16d71a6c09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649207069, "uuid": "e8b8cbb6-866e-41b4-b2a9-0d9bf0c91665", "value": "emotet_exe_e4_051a280dffb84c7b7bf98804fd66405b6705d901ee40a4eb188d74ce69322189_2022-04-06__010424.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e2c375-b5bc-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1649258100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258100, "uuid": "24d72b34-612c-4e76-84a1-75cb60302e9f", "comment": "Malware payload (RemcosRAT)", "value": "92f49ded24ce107d8171d285af16f8f5", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258100, "uuid": "c3ad500e-76eb-4c55-8629-8c46e9cdec64", "comment": "Malware payload (RemcosRAT)", "value": "054521a730b4728c27665f78db5d499e1c0913a2a150118fd138096b3050cbfa", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258100, "uuid": "26739a3f-1334-4e3d-bd17-a637ff811d19", "comment": "Malware payload (RemcosRAT)", "value": "e056eda91a30ecabe3089225e0d7e227dce689a1", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258100, "uuid": "3be5f133-c782-4bd7-8b49-49e26099df4f", "comment": "Malware payload (RemcosRAT)", "value": "24cbb626b19038ae66147ecbff5fb8fe1c4f668c444d6cca0f24ef8c76ad21b5e52607527234871eb5aae38cedee6a48", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258100, "uuid": "f4ac9e6b-92aa-4b82-bf9b-813b32da4ca5", "value": "T19B1402496711C26DE6E9923B5F90E1FAE1AEFC3ACF15C4085122736D4B316E1EC60F16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258100, "uuid": "e3ac5ec2-dac3-4668-9092-6473225e7611", "value": "3072:pqUKQQmJaqArm+Uit5q5D3+z4gkFjM+4unuwRCSGkymsLhkvcu7BubGxW7:vQqaq7+Fte3+z414uzMSGkyZkvcu7uGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649258100, "uuid": "e9366b63-a405-483e-986b-580434478066", "value": 192232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649258100, "uuid": "2a1e9b8a-cfae-4678-8005-bcce4b6367a5", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258100, "uuid": "628805f7-0948-4930-a71e-8552aba2fb94", "value": "Transfer Details 04062022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "400827ff-b5e2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274388, "uuid": "10a1e2b9-ac75-4f96-89e2-67ab939c4a37", "comment": "Malware payload", "value": "931efff1431954b6764af151d618c737", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274388, "uuid": "7d612e16-ef0a-4a95-8dab-5686df30a6ef", "comment": "Malware payload", "value": "05bc2115be4b1040478184c56d729d6140a88f167417a8236f40475b2caeae2c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274388, "uuid": "84d699a6-b4a5-4dfe-8c3f-dae1e2da9414", "comment": "Malware payload", "value": "a9d33dc671651c293b37e588fa6ddfac9b9080df", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274388, "uuid": "0a3cc4a7-c2d5-4450-a194-8704dcb148c8", "comment": "Malware payload", "value": "9dea32f7ce5b0cc77014a45cc63aba055da93830b008c2cb38555c1d02c72e14341ce40ad03835cc57c4a8689db3f475", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274388, "uuid": "fe32a0f4-2181-4db9-9185-08ffea292d2c", "value": "T1B9A1F850112C1AB07246597AD26FFA52B40EC81B09777B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274388, "uuid": "09498feb-bada-4ff0-8248-96074635adb2", "value": "96:xRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:xRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274388, "uuid": "0b249dc0-261f-4313-9627-21e772705191", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274388, "uuid": "a7f46dfb-4c77-4fe0-9620-e16603fa2e99", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274388, "uuid": "82b24119-0c8b-45bf-b044-b4c3273bfe72", "value": "05bc2115be4b1040478184c56d729d6140a88f167417a8236f40475b2caeae2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69112fec-b604-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649289060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649289060, "uuid": "ff8b9e5c-496a-4118-bb2b-4f3c16c07839", "comment": "Malware payload", "value": "419769a1366d6e974c5a144e77890a5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649289060, "uuid": "16f15fcc-31c8-4b77-afcc-aa46d8a2798b", "comment": "Malware payload", "value": "06752b36ed94122e6f92d742737a7691c9db3fd8b45c9a1b945e4d5b993b72fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649289060, "uuid": "7b7f3440-1e18-42a8-bdbe-e2512ff18d11", "comment": "Malware payload", "value": "50562047004ec7502e33b6aaf153b24e3f5c815a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649289060, "uuid": "edd2b0bf-4df0-45b3-afe0-efa12c6e2a2f", "comment": "Malware payload", "value": "235be5f0169f9d87831b21c5390e906fef5e6c7529342d14a4419f8a754a465d95b6a556bed4ffa4833e8522bc3cddc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649289060, "uuid": "58116ec5-3674-4198-adaa-519862a41b1a", "value": "T1DF64D0A7A354C9A2E74986B0A823CCB95D283D35DE41B66BA3C4BF5F3C3424A345531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649289060, "uuid": "76055ca8-1893-4a30-9c5d-2d5217c37a5c", "value": "9fd5cb5334ece8ebdfe4a1c7a3eaab7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649289060, "uuid": "1237ac1c-b99d-4eac-8875-e52a090d17bd", "value": "6144:wmEdSunAqHdroKcykhPBbiMV5xzr2fXFxN:w4ujKyUp+gOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649289060, "uuid": "5bc6e004-10c2-45bc-bd3b-cb77a9a858d3", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649289060, "uuid": "6d599bdb-efa1-49e5-a2ea-21be0711af6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649289060, "uuid": "5c3a872a-e370-4deb-8afd-8958b2ec34f2", "value": "06752b36ed94122e6f92d742737a7691c9db3fd8b45c9a1b945e4d5b993b72fc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "263801d5-b5e2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274345, "uuid": "d517e4ee-a7fb-4396-b930-177bf5f7691a", "comment": "Malware payload", "value": "c443e798acaefc7b33422963a0a8ab29", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274345, "uuid": "ce4b06f6-b1c3-4fc8-afc0-e7d209b8e346", "comment": "Malware payload", "value": "0727c44cc6def023dd24bbff411f680ed245b29863f381bfbea4d43152b9171a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274345, "uuid": "1329bc4d-bf62-44cd-a161-5790f034b814", "comment": "Malware payload", "value": "2a6c2a749382d8a5ed091a19029ce96f6b0db425", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274345, "uuid": "02a36433-7039-41e5-963d-9f9aa44fa162", "comment": "Malware payload", "value": "3ae70be7d5ec27644ac562402253ece0f61868f772cee7abd5e80dec9283991b4076e534641881ca2a9c7c4e6bda0c51", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274345, "uuid": "d0080187-7142-40ed-863f-633e056b831a", "value": "T1AAA1E750112C1AB17246697AD26FFB52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274345, "uuid": "0225bd93-f92a-4db2-8761-d8664c46eeb2", "value": "96:fRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:fRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274345, "uuid": "18a991d2-6db4-4c7f-bdba-089153ec795e", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274345, "uuid": "8187d383-b762-4448-b7f2-28ee57cfeba9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274345, "uuid": "6db911a1-756e-41d4-901c-87a87fb176eb", "value": "0727c44cc6def023dd24bbff411f680ed245b29863f381bfbea4d43152b9171a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d77738-b5e2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274335, "uuid": "d5d05449-3de0-46e1-8bb6-f8cf50da5657", "comment": "Malware payload", "value": "5e1285a962039efabc9760b848a27783", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274335, "uuid": "f9d8006b-c59c-4c17-8653-35325b09c183", "comment": "Malware payload", "value": "07501ada6bb9f6e6350698571a4ff3572cf284cc9085514df9e0e108de40789d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274335, "uuid": "d0a7840d-66df-477b-8b06-ee55885195bc", "comment": "Malware payload", "value": "9e92389dbd3dcf66345067af97c36d2a24bf7458", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274335, "uuid": "c83f7b56-ffd3-4436-aa8b-5bdee854d02a", "comment": "Malware payload", "value": "6fcf173941979e75481339b029c63508f3236bd700a90301d4e8daa8f391d62165cbf1d1af9ce48f9043da5dc4fbb7a6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274335, "uuid": "4a51739e-179a-4339-9e62-f6af9d43e684", "value": "T1CAA1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274335, "uuid": "30cb3b65-b4ce-4aa3-a9d1-31d344a63002", "value": "96:+RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:+RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274335, "uuid": "9d59560c-8db0-4121-94ea-c2cd55936ba5", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274335, "uuid": "b75b009c-1ff4-41d0-9fb4-ec6909f8afac", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274335, "uuid": "24807d72-d9de-4706-a98e-fd95e96f2c99", "value": "07501ada6bb9f6e6350698571a4ff3572cf284cc9085514df9e0e108de40789d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ff96b4b-b5c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649262389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262389, "uuid": "d32f121f-3ede-41a4-8435-ffd982861f1b", "comment": "Malware payload (Loki)", "value": "0511b04aacd92a48059cc43838eb2db2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262389, "uuid": "324752b4-290b-4307-aca9-ec24c3994dff", "comment": "Malware payload (Loki)", "value": "09835f2df5b04e474aecc529e674f22f7d90348dcb9e45ea475b77a43448938e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262389, "uuid": "e17dba37-88df-4b30-9439-6be124c3ea0a", "comment": "Malware payload (Loki)", "value": "e8ceff7ad2766faae5bd2647c3f56e2331e77184", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262389, "uuid": "691eac52-575d-44ed-861c-9f4539005427", "comment": "Malware payload (Loki)", "value": "0728d16985f30076346a8994e2dcddcac97366889f4d53ff62b1bb4703769b3ad0fa1eb9af6ae003767ec5af6d83afe6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262389, "uuid": "7f612dcd-c892-42c6-8723-247a23f1181d", "value": "T1733412613554C8A3E1F31A331DEB0AF21BFB86632232471F17045F9D79B9BA2855E750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262389, "uuid": "b6fd347a-6c04-4083-8b9f-4d4af6a57409", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262389, "uuid": "980bee49-548b-4b9a-b3e8-ca818a93c6b5", "value": "6144:HNeZmHNyz8bI041Sf3bKYE93o6ebiH3bL3L9oB:HNlt+8b4S/bKNBoryOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262389, "uuid": "90b20647-7b36-4060-9258-52a3da5c74a2", "value": 238226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262389, "uuid": "d5644c0e-3fc7-48fb-b964-cf264feda543", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262389, "uuid": "60fa00a8-7877-4db5-b9be-ad69600b517d", "value": "0511b04aacd92a48059cc43838eb2db2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d25bfc5-b5e2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274383, "uuid": "553e5936-43b8-47bf-8009-a6bffe4b7db5", "comment": "Malware payload", "value": "25da79be6f34c79f1bedf527adb54a87", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274383, "uuid": "1507dbc8-18eb-4a4d-9c8b-eebf18c4e0a1", "comment": "Malware payload", "value": "09e165e231970f221a31f7f5d66ca7258082a0125cb89b244b6aa24a633900d4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274383, "uuid": "93e9c113-5539-457b-b189-8ebce9b4a434", "comment": "Malware payload", "value": "af1bebef36232fbcdb2d641867bf330bb3d0e4a0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274383, "uuid": "d8bc4802-c1fd-4fb6-91ae-9031e3bc8f8d", "comment": "Malware payload", "value": "239008a9706523f093535371708d23b9cc21cae41627d8d8def4a3fca5c02be10edf917df67a94eff9ee4424e0598c3f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274383, "uuid": "029f926a-837e-4dff-8725-514e61163f11", "value": "T1B8418ACA61724E323C57DE9377B9889470E2509624C99FD69EDC3CED5C4ED84B046A82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274383, "uuid": "c80df9b6-2280-480b-b94a-24499211e1fc", "value": "24:vlyE3/ryBMvPWHsDrjHTU9n/CVNjVNWJcEVplT4PMm:vIEvrP+MDrzTU9/CVNjVNUcEVp14Px", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274383, "uuid": "79a195f7-4167-4be5-86ef-eaf7805b28e0", "value": 2130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274383, "uuid": "123404a7-e939-40b3-805a-dd5992f31ae1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274383, "uuid": "91bab529-9b16-4375-9869-6ddfcb334b76", "value": "09e165e231970f221a31f7f5d66ca7258082a0125cb89b244b6aa24a633900d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9fd2cc1-b601-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649287934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649287934, "uuid": "b79b8b68-a7b9-4e85-92a8-78c705e50814", "comment": "Malware payload (Loki)", "value": "efbb7a8945f7e660a66b3104646b0888", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649287934, "uuid": "c1c0d34b-a348-4e10-ad70-10e6281de233", "comment": "Malware payload (Loki)", "value": "09fe9a232d5da8964adf27be668c66bd375dc4db3f6c325a1cc746449727e80d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649287934, "uuid": "41d22e88-dd54-4bf6-91ed-09fee3cc2dfd", "comment": "Malware payload (Loki)", "value": "fa59749525fbfd179730828fbf2668a89558c371", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649287934, "uuid": "a979f15d-5e57-498a-9d0c-cc960072b89f", "comment": "Malware payload (Loki)", "value": "44be7f4c25f92c1ab7780a4b7f37d9f7ebe809ae88de299efbbaad9b99cf4626a049b1395487184671c6a30b739c7d60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649287934, "uuid": "76536cf0-438c-49cc-b17f-f0881a8754ae", "value": "T1CB940229B7FBE51AC69E577390E2464543B09603E163EB8E3BC915DD07033E61A42BC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649287934, "uuid": "7e5c7bf2-1a97-4656-ad46-d6b109298029", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649287934, "uuid": "a2d84248-8c3f-46b9-a448-9eda438991c1", "value": "12288:B5sT3ruF1xpVOydiGv9ntAbfw5pmieeOVPQrX/DoF:FxE0nWfwmDeOWr7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649287934, "uuid": "7b814687-57bf-4905-aaec-ad0225c48bf5", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649287934, "uuid": "598d0a81-e5e5-4b2d-bdbc-5e671d966ef7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649287934, "uuid": "c06d857e-a92d-4a5b-b989-c8ea283b9077", "value": "SecuriteInfo.com.Trojan.PWS.Siggen3.14573.5286.28373", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55caf8f7-b5e2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274424, "uuid": "dbe348c0-71bd-426d-b604-717c7e33c0e0", "comment": "Malware payload", "value": "161345e0cb07ad4dfb668318023131ad", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274424, "uuid": "f7d0f539-8d49-4689-82c2-88ed6b41e071", "comment": "Malware payload", "value": "0a86d496fc1b0ed8d0f544089d2b858b52a5482564ba3dde7e81c2cef9fce4ed", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274424, "uuid": "5ab8d393-b164-4697-a41c-41e4e0732e22", "comment": "Malware payload", "value": "3347fdb4a289dc475519713e415d992a810f6405", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274424, "uuid": "0640a7a9-7b92-4ffd-b10b-abf685c12dfd", "comment": "Malware payload", "value": "1130d586fd5997b2f2a6ef247fceb5e01b805a2bda3917c7aec646425cdec0b2c9d9db53f5e08316c782de35886c4397", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274424, "uuid": "bea131ba-92e2-4fcd-89e5-427675274019", "value": "T1ECA1F750112C1AB47246697AD26FFB52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274424, "uuid": "cedd1793-3977-4e6c-b475-2d7968dcb761", "value": "96:QRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:QRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274424, "uuid": "d0a1eb01-7c7b-4265-b8f1-d24f9f5e94a3", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274424, "uuid": "9242e868-799a-42e5-8d78-5dbcb11a604a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274424, "uuid": "75f1eda5-984f-4256-a482-c802043af239", "value": "0a86d496fc1b0ed8d0f544089d2b858b52a5482564ba3dde7e81c2cef9fce4ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc8720e3-b5c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649262624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262624, "uuid": "689f4dac-d6ad-495f-98b3-33ecba8b9d56", "comment": "Malware payload (Loki)", "value": "8c45355db17908df5c5dadd7700838df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262624, "uuid": "11d3e806-1f93-44d7-b084-709d692a3993", "comment": "Malware payload (Loki)", "value": "0b2aff86c515b71698f1424efd441e0592b063462d9173f98b9142e24a178c29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262624, "uuid": "22172ba5-0076-4f68-9f48-18ebb4fdabdf", "comment": "Malware payload (Loki)", "value": "280ff96666621ffeb9fef1b3cdebbb0212ebebe8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262624, "uuid": "ff50a2c0-0256-4ce9-9f82-3821455df5b0", "comment": "Malware payload (Loki)", "value": "ce4e1970a76b21ef6d4a7638b53597a5c8365ecc9fb35423d2cf89201a8dd32f5a963ca919098e8b7b2256e5e700aa04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262624, "uuid": "d7bbcc8b-bb24-45ea-967b-5dc65ed84014", "value": "T1F934124417A1DAA3E4E526710A7EE7266CDFF26E2078170F2B208F5C7D74991CB0E762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262624, "uuid": "16bb6fb5-0fb4-44f0-a984-f93e29116926", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262624, "uuid": "3129f5fa-6264-4638-9a0a-5da6287c0e79", "value": "6144:HNeZmMOsh5jEJTtsLHFXo6S06hl9uPK2WBH6TphQf4+htav:HNlByZ05sjFXpSZhluK2G6TphIXhwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262624, "uuid": "bdbd6755-000f-4e6c-a097-e677b9696c3a", "value": 236282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262624, "uuid": "55f2f363-0424-4036-b2df-a8b666198d39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262624, "uuid": "7e1b0128-fa63-42bb-9bf8-e0b064eb8c9f", "value": "8c45355db17908df5c5dadd7700838df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be27be5e-b5a1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649246682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246682, "uuid": "d6d9dafd-67db-4392-ba74-cb61dbfe6a80", "comment": "Malware payload (AgentTesla)", "value": "263c852dff1d9f47bbdb7582ebfdef7b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246682, "uuid": "a60ae1e4-039f-4caa-949c-5377ef11ec7e", "comment": "Malware payload (AgentTesla)", "value": "0b646d54e95616324d7350ae0789de1e12e9f93ece6170d81462d608978d92af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246682, "uuid": "5463ed85-52e3-47d9-9d90-2eab1a045daf", "comment": "Malware payload (AgentTesla)", "value": "a02a821edde661c89ca5d3c3b99f43655c5c7c16", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246682, "uuid": "97afcfd5-e8f4-4a2f-b145-e70631880386", "comment": "Malware payload (AgentTesla)", "value": "1144becd3633ac614d878cce69e08e6d4417f33d967338db32add7ad71a9485f23d7e548164a1a53f7c1daf8ca8571c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246682, "uuid": "be2df2ec-5b03-4010-96c7-9ce3d90993ab", "value": "T17014A27326FC31F7E1A80B3844971A1A1F20BF766A33D90EAA7579F42375FA14426E41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246682, "uuid": "4f4cba99-7a47-449f-9425-24d5ce70b7d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246682, "uuid": "1c84d00b-b7c4-4178-93c0-7445246ec4df", "value": "1536:Mvo5Ee+8jyopdhrKmFs8biBMrXWWWDZk:MQ5nyGrK6bidk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246682, "uuid": "f06c92d5-6974-40b3-83fa-ee483d299a5e", "value": 203776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246682, "uuid": "d1de0347-5654-450b-8b04-19a551ea0916", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246682, "uuid": "3a3a485a-6240-40da-a677-f37a186f8eb3", "value": "New Purchase Order - April_06_2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d2c3feb-b596-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1649241849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649241849, "uuid": "f12bb270-d1a0-45ca-ad2d-5696476d3e2b", "comment": "Malware payload (AveMariaRAT)", "value": "5016a372458c81a13e1adaa0baf5aa15", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649241849, "uuid": "7d13d513-d01f-44db-b078-58a7cd7cdd95", "comment": "Malware payload (AveMariaRAT)", "value": "0bb09b028f6802d5f9a967dd0a51f89f3b8fb939315abad0706c22e21651e376", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649241849, "uuid": "4d13fdb5-5229-40d9-baba-7eb957e6db74", "comment": "Malware payload (AveMariaRAT)", "value": "5a491e0c563d0838d15bf3933b663cb10a285523", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649241849, "uuid": "29d72802-9a5d-4708-9247-090947c32266", "comment": "Malware payload (AveMariaRAT)", "value": "7643baa8eb138fe94f47a6aac30ddfd9660a0432b612c63bf4131070bb78169c8f42bafdc737405513b8ca8e110aca18", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649241849, "uuid": "b278513c-8589-428a-9cda-a49d9620fa34", "value": "T18A941246FB27CA72C5EE227395C5404803F29B037B13CB0F79E92769A5123F74A91AD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649241849, "uuid": "4c9e6db9-2385-415b-b24f-4a49d3bb9c78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649241849, "uuid": "83d68a41-a4ee-406a-bec6-5c73a4b39cfb", "value": "12288:60K+6aZEKYxwozvrE0RX6UhhQGcQh8OF0Vw:p1EHwobXNhhQnQhDF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649241849, "uuid": "2a5b0aa1-1182-4780-a9ee-0e63576e6cf5", "value": 429568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649241849, "uuid": "e3a0bf19-d7d8-4280-82c7-0eb506ff77f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649241849, "uuid": "c5bfa6f4-9c6f-4bae-ab07-1e79f4147f7c", "value": "DHL2022040600011.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99261d52-b572-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649226434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649226434, "uuid": "05afb520-bdcb-45f7-9e58-55592a6782d7", "comment": "Malware payload (Heodo)", "value": "a902d972f90a2dbef94146b37259de06", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649226434, "uuid": "3767c9c2-4f35-41cd-8e34-516ef6ba2b73", "comment": "Malware payload (Heodo)", "value": "0c3d0bfee76908150930fa6f8446a954b9d975f25c6bb5163b09ff79a1db25bf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649226434, "uuid": "d96660f7-351c-4f56-8d55-1e9e91834603", "comment": "Malware payload (Heodo)", "value": "60d21a1b6e9f76139737afb91a5c943b51ecdc4d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649226434, "uuid": "2b006cb5-dcda-411e-9412-a3069461fa16", "comment": "Malware payload (Heodo)", "value": "03be1b957f2043287cb77a91633038bbc8f491be4ffb0090e8e7b8375052f030d53396eefc1cffc40568675b117ba883", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649226434, "uuid": "4d1b91bc-d572-44fb-ab06-7995ed66e75b", "value": "T1BEB43BA23453C8B3C7FDB37109828E59AF61E69497B31253E990053AFE788F6A3705C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649226434, "uuid": "1a9af236-4902-4f0f-a64b-31d6bd3f41a9", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649226434, "uuid": "7b21387c-d82f-46dc-8dbd-12cd5f1b6c07", "value": "6144:bTSIaQIvz1Q+X4LJMByRR3AplChL4OSrDYAfk7+21YTBfr0H8NcBcaEP5O:Wvz1CLJyyvmMLSrBg34ruGbP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649226434, "uuid": "d00a489a-b094-41db-9bc7-031ff98f02ec", "value": 539224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649226434, "uuid": "55b3d347-061a-4814-85fc-1e0279e45774", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649226434, "uuid": "92dfafe7-5621-4c5e-a9f6-2c4cb287d7ce", "value": "emotet_exe_e5_0c3d0bfee76908150930fa6f8446a954b9d975f25c6bb5163b09ff79a1db25bf_2022-04-06__062708.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6bbffa2-b5bc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649258373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258373, "uuid": "0f1e6fb6-a892-49b3-a38f-faccc10e4da0", "comment": "Malware payload", "value": "fbb9db04a7092467900765dfec834a75", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258373, "uuid": "c27f6cfe-a3b5-40d6-bb02-230728836697", "comment": "Malware payload", "value": "0c425d6c6bce93fad4f32c275db574e8b3161a1ae55a9a957d50020b516d3e2c", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258373, "uuid": "33cecd88-3928-4567-a0f6-bada3e58965e", "comment": "Malware payload", "value": "87ffdc03b8035ca1ea741144c206bc00bcb77f13", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258373, "uuid": "97911177-37ae-4b53-bc8a-3ec9c2d195b0", "comment": "Malware payload", "value": "76f697aa973e2553853cde86ebd87b34faaa4248da79e6d34ed198b747c45ee0e247e435b1ef1924d13906774c6aa366", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258373, "uuid": "98e8cc6b-6625-478f-84a3-e14ecdcb2ffa", "value": "T1E3C48D57F7C7FAB0E6BE827A86B1891C527774520260A78F674072896D23392493DF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258373, "uuid": "47b61383-3f00-4af7-888b-c2c2fbf026c3", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258373, "uuid": "fe60e8e0-b9cd-4985-8306-17f06b52f9ef", "value": "12288:ln/zDvGHAykHSzLW/4+8bzbBSreMdd+fgFK/UqW:pzbGHAzHAjX15HcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649258373, "uuid": "905f123f-e320-4905-ae14-2504b23d3186", "value": 566784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649258373, "uuid": "5e3c60fd-777c-4b3f-873b-61713e6a6652", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258373, "uuid": "b6a3c254-e176-4029-a218-2cf65320df5f", "value": "PO.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58fe308f-b5de-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649272712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649272712, "uuid": "fa52daec-3093-47d6-adba-1a72a69dad7c", "comment": "Malware payload", "value": "327e181d948ff5f7a280267d503ef617", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649272712, "uuid": "7bc51e59-e063-47b7-acdd-5d397fea6af9", "comment": "Malware payload", "value": "0c4624fdad728743915d3c15afb1257021f351b7dbe358908e395f4f5f2c93ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649272712, "uuid": "dc1ed793-7f9e-4aa6-809e-86673dc28e49", "comment": "Malware payload", "value": "248277e1c6d929163685d052203fc36c1842df09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649272712, "uuid": "3c383a15-41c5-47e9-8e51-75151968c29e", "comment": "Malware payload", "value": "55bccb068944829cc92e9fc5458c8f5820754fb1b312b6974db6f00245e5ae7720d533b2c508a704b65e7bc72a52d9dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649272712, "uuid": "512da210-b292-4c49-9e5f-2edfa3db4aff", "value": "T187A6E0E12F0710AFCB1518745083592EE1A52772869FF863EFD678F8BB13D911A89F09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649272712, "uuid": "3a9e0b91-f371-49f9-912e-4e5d7e2f168f", "value": "92abf5ad90fc2838b3b0b9a065cff363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649272712, "uuid": "75d2e2d9-235f-4b39-9995-10e93f7e86e8", "value": "196608:qXH/SXTX81QsWILAmKiRpNc1ONIMfWb7u2:LsZXAmDpt2Bu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649272712, "uuid": "f210c616-6046-4146-aedc-cb52087378fc", "value": 9670656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649272712, "uuid": "06bd2558-8485-48a2-b2c1-1495e9e07816", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649272712, "uuid": "04651ff2-e17b-4b98-9cb8-b16b0cdbe3b9", "value": "0c4624fdad728743915d3c15afb1257021f351b7dbe358908e395f4f5f2c93ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc02fc83-b5e1-11ec-8e58-42010a9c0032", "comment": "Malware payload (CoinMiner)", "timestamp": 1649274193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274193, "uuid": "3a7e1d0d-2200-4b72-9651-7ea1ae90133c", "comment": "Malware payload (CoinMiner)", "value": "2a8c4f09fc61aafd787d048074991586", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274193, "uuid": "d932a05d-ae23-434d-ac0e-b0c4d541baf3", "comment": "Malware payload (CoinMiner)", "value": "0c7f538046b3f8b8fdc1efa8d98298240bbe0b09b09e6ddccfc20d67d4abb701", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274193, "uuid": "2537b637-2377-45f1-9c21-c193819de050", "comment": "Malware payload (CoinMiner)", "value": "cd901c876104f6cd71e65a4a2784ae74d1996a4b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274193, "uuid": "bd96c2b7-76df-4fbd-be04-1a5858bfd776", "comment": "Malware payload (CoinMiner)", "value": "7b73817882371725963313582d26113ddcd0e98d8b5a37bd71c1b2f4d92f3b884bfcdc80994ec272af9963a02713c2e8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274193, "uuid": "05e2bed7-0c4a-4c84-8ad6-d6290776b9ab", "value": "T1845633467322A973CCB3530F948678AB3AB37BDC61794C734CC1A6C30A44536BB49BA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274193, "uuid": "1d137afd-097e-4d8b-ad0c-b7a6ee228dd1", "value": "98304:q13V3a0rqRIZ+wrvNoGRtKzIVLplxsVmHOx+IK4Wpi5WVHpC/tBYVZpaLEItyfAN:q13V3HrqR4NlEzIJprsVmHUWkQJC4H8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274193, "uuid": "9308b581-e459-45e0-b76e-71800b24e62e", "value": 6135808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274193, "uuid": "315ab8c2-8774-42c9-91b4-88d45f4664f6", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274193, "uuid": "039713eb-cb6a-4b30-bd47-a6b5907b64c3", "value": "0c7f538046b3f8b8fdc1efa8d98298240bbe0b09b09e6ddccfc20d67d4abb701.gzip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5122465a-b5e2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274417, "uuid": "b3c5a847-9061-415b-bca7-693880e77ce4", "comment": "Malware payload", "value": "77e4598a2501daf7e553fbc97a2700ef", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274417, "uuid": "9a231334-7e30-479e-80f8-58e45b45d879", "comment": "Malware payload", "value": "0e2ecdbfcf8af879196c4afd6ae6234374a57a9cbb0d6ac3e3d67a933f5b193e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274417, "uuid": "e47c2bbc-b41f-42c9-9eef-884587b688d4", "comment": "Malware payload", "value": "fb646c89230bafa3aa6673856e8c17c2232b42aa", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274417, "uuid": "a7b2a97f-63c1-4d79-94ae-cbf3ae0cdda0", "comment": "Malware payload", "value": "6cb6397c4dae3bbf2ea3269ab3512cc64d5c56c17c5bdb2f662b500d944a585da15df4386d6345f505a7e6a53fb714e5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274417, "uuid": "2520f7b2-3a95-4ad0-ad35-acb96b51425d", "value": "T197513DC1E8F726307EB7A89323EB1C1636D195A019F1BD4D61E8B8BC4DAFD0516C41EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274417, "uuid": "b27801b4-dbff-4deb-aa8b-90fe19c4bb67", "value": "48:+A5fzAc36zCqkozjuHzHJQzsMhzVj+z+xozUKLzDl0zY8xzFU5z9h4zEpwzMZVZI:+W7v3wCqfjuTHJ2sM9Vj8+x+UK/DlCYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274417, "uuid": "4cfbe66f-9ee6-4d2f-ba4b-02ed4e67aa09", "value": 3007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274417, "uuid": "2a013109-f973-45ec-b296-c89a7799623b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274417, "uuid": "5d35055e-62ff-49b9-92ad-396433c7f1c5", "value": "0e2ecdbfcf8af879196c4afd6ae6234374a57a9cbb0d6ac3e3d67a933f5b193e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "480a5992-b5e2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274401, "uuid": "3f4eea4f-abcb-4888-9b0a-43691f4c7f4c", "comment": "Malware payload", "value": "75358ab1777f1e2eee03de3a8b86294b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274401, "uuid": "f6d9a375-f8f3-4fbf-ba97-8ef506ef3b12", "comment": "Malware payload", "value": "0e9e4e3eebbe87edaa27370f2c33e6bfc7ced9b3df876edbacd0022e045ea0cd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274401, "uuid": "58c2149c-67ef-4615-a064-65ce26db1d12", "comment": "Malware payload", "value": "e12a72a98a2f4c434482b3040a5753a99e07bf5f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274401, "uuid": "d1ce75f0-2c64-4653-a29d-46bbf3fafd3d", "comment": "Malware payload", "value": "a70e5dd6052f947db35d7fa0791c65a3e39fa1de239fb435c44273b695982d96b54b09a210558ea668d697721cd701e8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274401, "uuid": "40047a41-841c-4877-ad8c-1cb4d7ecdfbd", "value": "T10351F5C41393C2B67F91D97AA1BB082DF0D5896364E5FD11ADE8B8F8828CE643170A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274401, "uuid": "fd1f994c-f0ee-4d50-9da5-062689e8a153", "value": "24:vSz0z2sSz2Wz2XCQSzSTzdVJSz8zTSzBzbaLSz8Tzf1ksSzjzSSzVzkSzYzZSzqc:vZ7TlB2aLF1JjbNoQ1dkfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274401, "uuid": "d866060b-4056-4434-8e1e-b261e5d85d9b", "value": 2492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274401, "uuid": "ca65ab7b-8753-4b76-80f7-74bcef062788", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274401, "uuid": "2749b0cc-cae3-4f0e-9473-abcd04314e1c", "value": "0e9e4e3eebbe87edaa27370f2c33e6bfc7ced9b3df876edbacd0022e045ea0cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa8b2af-b5b4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649254837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649254837, "uuid": "51b2611a-697d-4f79-9b2b-873e5441f51b", "comment": "Malware payload (Formbook)", "value": "85b75823b24aff15534f35143beb9a94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649254837, "uuid": "03b7be48-bce7-439c-869a-cbc8bd03350a", "comment": "Malware payload (Formbook)", "value": "0eb3aea0d96d9fb004f9c3b63ff3cd49b5f35262102104aab0f39b8f7797a5b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649254837, "uuid": "8db337be-cd47-495e-b499-1383b48b7a86", "comment": "Malware payload (Formbook)", "value": "9aec1a49e9336ecc3d75e4513a7e56774a58f44a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649254837, "uuid": "2e68a61c-f983-4307-af23-2c85526ef7d8", "comment": "Malware payload (Formbook)", "value": "761e549ebb70beb24074e38768dd12190b8ce8791594a8b44c261cd94117b33c2e55163e33b4fcf403ad51ab01a8ce53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649254837, "uuid": "c81a2166-5863-4a6a-b61a-34eceb5fee16", "value": "T1D23412057BECD477C582CA333929736BCDDAA62620449B4713948B8AB6267C0C45F7F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649254837, "uuid": "56fca49e-1131-4952-b14c-4e8573b233a2", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649254837, "uuid": "da515611-c066-4f7f-b5c2-e69e830db5ff", "value": "6144:HNeZm1EQkYDvcH4q63ISMBAl79DbaXwtgY3tK:HNl1bDYb7BAl9DbMwFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649254837, "uuid": "9e42c36d-46c3-45da-ba45-cea24543f845", "value": 246832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649254837, "uuid": "886f6f50-1b8f-4042-b380-ff16efd8b89b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649254837, "uuid": "2c997983-0a6f-41e0-9f73-0b5db11797bb", "value": "shxt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253d5a67-b5bc-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1649258022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258022, "uuid": "a34f5dd6-adc8-4ae8-a865-e5bc388676d2", "comment": "Malware payload (RemcosRAT)", "value": "e773096a93ca10eccd9a4213c51fee02", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258022, "uuid": "5e5d586a-da72-4ce2-bbd1-b9496ec3fe45", "comment": "Malware payload (RemcosRAT)", "value": "0f0d40304fc53e1990ed8b499803d14f91d0bb65daad57bfea11837a43083d30", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258022, "uuid": "bfabaea8-ea34-4081-9f3c-d67930420ba0", "comment": "Malware payload (RemcosRAT)", "value": "cb68a449fb503928f8bd69a87dfbe4d4d497fd74", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258022, "uuid": "4579ce3c-bda9-4a78-bf99-377c8cf8c8f0", "comment": "Malware payload (RemcosRAT)", "value": "64cd49656fd670af3ba6571e7b6c98798a9fd50488058d804c5e4cddc263fa17cc51b1d3de08065654e335a041d749c2", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258022, "uuid": "4a204508-2dc5-457a-90c9-2bf4150c0e5d", "value": "T128141217F4CB415FE8524F3E4E22DA77940EEDBF305135A720E1BF0659B62910EA9B60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258022, "uuid": "c25a6479-2077-4c31-8dad-4fd6e130eb55", "value": "3072:7kQBY32qBfgfIOFDMdT3PYHKV7GqO+QN+tHT0aJyYB:Iu22+tOMdjPpV7QpktHTN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649258022, "uuid": "d4f5283a-e40e-401a-85e4-a49c3632f75f", "value": 192200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649258022, "uuid": "89c62d9d-3210-4aa2-af86-0141fbb4f900", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258022, "uuid": "384a2133-4484-4172-bea5-d7c474fd04cd", "value": "Customs Clearance Shipment 2035907134.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a389a1fe-b569-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649222586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222586, "uuid": "6daf834c-8d77-4bbf-943e-205ff737ff86", "comment": "Malware payload (Formbook)", "value": "e49f64c777d767438ebf30cfed35046c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222586, "uuid": "bccb6a8d-70c1-435a-848d-95dd95205a4c", "comment": "Malware payload (Formbook)", "value": "0f26fc2304b6625ef379ab4b0725e57d814a4e87035b6d15215067f3f3321af0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222586, "uuid": "a52e8f05-b060-4dbb-9c24-20bc2355dded", "comment": "Malware payload (Formbook)", "value": "2798c228b3f041f4302667ce3d71a276878c3a20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222586, "uuid": "d86a2a2f-47cf-468d-a59c-7f4a2d080bc1", "comment": "Malware payload (Formbook)", "value": "c23e1d00be79b461871a34fd02825707d2a376266609d246bb48b6a3297ba75270d2fde37b27e889a23e33739bf198bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222586, "uuid": "dd9fc590-5e24-47cb-9b54-06a26c715518", "value": "T10E14FA02257CA8C3F69C6C73A8DC875E1EE06C6C4676502DF647B6E9E53F143E6212E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222586, "uuid": "b5d47122-d36f-4ae5-84e7-2d7c7005ce51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222586, "uuid": "96109f63-a199-4917-801f-f376371afb03", "value": "768:5PgPp+gXOlrLUgx1fjy7QcNlS1Br/k0DblnhwDq2PrW6/4/Ve6ame3EkGVBKc:KPp+gel8gjy7VNgvr/BDb9hgWS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649222586, "uuid": "7cbdf6bf-b998-437a-ac1f-082dbbeca7ad", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649222586, "uuid": "d552ab54-cae6-440c-ad1c-9b7ecb52217f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222586, "uuid": "f344ac0a-458c-48fe-b625-6f167d64a48f", "value": "PURCHASE ORDER = 62048-2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "747cbb70-b552-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649212628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649212628, "uuid": "cd5fa8d8-3b0f-4291-b958-a1f73eb0017b", "comment": "Malware payload (Heodo)", "value": "5afbe6ae3318317aaae06cc7426eac04", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649212628, "uuid": "21f39a6d-1482-4e89-b79b-9857c39157d9", "comment": "Malware payload (Heodo)", "value": "106d6442437fda34e7eee71c567d96df106a71a400e85915f3be5366a7092c9f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649212628, "uuid": "dbb82088-1dab-41fb-ba26-071a8eb63f2a", "comment": "Malware payload (Heodo)", "value": "3f54e296a03db68c82c1f9a0d8c6efdfe3e3794c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649212628, "uuid": "3aaebd69-51b3-4468-88a4-9ee1b354044b", "comment": "Malware payload (Heodo)", "value": "31996866ed5eb88c7bd730391415f4bb21952a3193f056427e9489735dfa24b6a551849f0e70fad849412d522611fdb5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649212628, "uuid": "41f83ae8-bf22-48fb-ab5c-8e8a15b7741d", "value": "T13D748C2761E280B2E7E222718F0A2FBEF3F9D61447765EC3476159081A32DDBD33A615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649212628, "uuid": "e36ac7d3-ca73-4eaf-9463-cdbbb1440e49", "value": "3072:yh5ovprihI9qEsgbucjzu3Ysn33YjGIbduXvhT5yR2ruxtGfQ1rSFkmFSYZi8sUQ:y7k2Lgb63B3IjZbdup5yEqWQUMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649212628, "uuid": "0860a081-4248-4617-9227-5deeceeeb6e1", "value": 364334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649212628, "uuid": "500ee4fd-9bb5-498e-86fc-bf937f000367", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649212628, "uuid": "e2675d31-472d-4923-ab84-b1721fe23bf4", "value": "emotet_exe_e5_106d6442437fda34e7eee71c567d96df106a71a400e85915f3be5366a7092c9f_2022-04-06__023704.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a58ec82-b5b1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649253387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253387, "uuid": "a8e7a88b-b52e-4341-8eba-e10cfd814283", "comment": "Malware payload (Loki)", "value": "b347d8b2e90e11981f6895be59b5f30c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253387, "uuid": "6476647e-03fd-4c0d-a4d0-b1e68fdf839b", "comment": "Malware payload (Loki)", "value": "10ccac80baa31a7a96f2b73fe158db6b699f27f9b89af9692a0ccc152802fb12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253387, "uuid": "7837b0a3-7fc7-4a51-9479-a1a746e4c45f", "comment": "Malware payload (Loki)", "value": "fecff17fe981b71deaa00b7522833f2a9c3ffee7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253387, "uuid": "e852826f-06bf-4044-a775-a327858a2c5d", "comment": "Malware payload (Loki)", "value": "27da9816946eeb72db28fff0792e4bc8cf4d1adb6832b8944ee1ac6990e4275b2981fb87db0aa4b06a543c0809042ee8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253387, "uuid": "a215b888-4d34-4c7f-bccd-fb30a49dc3e3", "value": "T142341241B390D0B7E8320A711DB96B6BABFD25114624D35F2B55BF9E3A322C18F0D396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253387, "uuid": "83975b7b-33f3-43ae-b89a-fca1ccbb2be5", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253387, "uuid": "4bbcb3a0-0435-4398-87c5-88be014f7112", "value": "6144:HNeZmtzTH8yzLyIjNv3Sy+BsSuLagm4ZPvX/yMB6Z:HNltzTH8ULLjU1spaIPvLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649253387, "uuid": "1f9aef15-ec49-486c-be03-185900affb10", "value": 238935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649253387, "uuid": "3cf88849-6ec4-434e-aff8-7ddaeead77a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253387, "uuid": "73b39a99-e8c6-457f-9a89-4ad94ab2d019", "value": "loader1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e43ae5-b5e9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649277572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277572, "uuid": "6db49617-3717-4e81-b898-f24456b8af04", "comment": "Malware payload (Mirai)", "value": "dda67737ba230fcf341276ab55be5c52", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277572, "uuid": "bdb91eba-c010-4ae0-9308-868a389553c1", "comment": "Malware payload (Mirai)", "value": "11ffba1f1609b12dcaf4d2fdc7af5eb6a5330c2b9ceb56cebd095b2bac15bd02", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277572, "uuid": "e752fee8-8871-41c8-bfa3-e951780b2e53", "comment": "Malware payload (Mirai)", "value": "d1b7a0322153850f8594e61bd5fe714871d7da19", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277572, "uuid": "802c80eb-3023-4470-84b0-b082402cb787", "comment": "Malware payload (Mirai)", "value": "84159af246a91cbe8991dc08a8cb252fb4eb1aa950bf6b9f3afcce8642e03895271c77e5f769b462ec447ece23ef1ac6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277572, "uuid": "b11fc3c6-527c-4e8b-9aeb-482766217ab1", "value": "T183B2D0E9E197DAF7DFEF7E7009CAC5D177E84FD839628E122190AF81025641A1A05ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277572, "uuid": "783bc2dc-6e0f-423f-a68f-7d5a980a7069", "value": "384:MO+EYgpIs0QiReRy77S2O68RlH74L796xn1BmSki6E4xikanjtyrM4uVcqgw05VN:M9Y8QRUS2O68I6hiSkREBh/4uVcqgw0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277572, "uuid": "8ec2dce6-1368-4d00-9da6-51bb00732df2", "value": 23944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277572, "uuid": "b0acc60d-d0e9-40dd-95ca-0201c91e4844", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277572, "uuid": "98a701f3-c1a4-4b40-983d-8fd02de6a6b3", "value": "dda67737ba230fcf341276ab55be5c52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e97e7c4-b5e9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649277553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277553, "uuid": "2d2a4a98-f74f-4e5a-b18e-91e0158b0867", "comment": "Malware payload (Mirai)", "value": "6ab3156fd7be39bd8ba30a82ab7cc36f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277553, "uuid": "f8048865-d449-43fc-9a00-a365ecc889a0", "comment": "Malware payload (Mirai)", "value": "123b4e1ea951573da5433f2e027fa0d45e2d24c2b3cdc2b15738bfd5ede6a2e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277553, "uuid": "722106a4-9afa-4a23-b309-26aac48dcd12", "comment": "Malware payload (Mirai)", "value": "95e9dbeb7e6c8d0c072d7073631aedb1b77113b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277553, "uuid": "3d2f5aca-dc50-4c25-86ca-568f961553a3", "comment": "Malware payload (Mirai)", "value": "a48305ceccfdc6968eb60ec60aa8bf1352da3bed0b71f29c853cf62e60e7769545bbfab227c1a04d79260ae1156b6032", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277553, "uuid": "d2525284-b74c-4a4a-9dd5-f005f7d9c729", "value": "T115C2D015572978E2C373A93AE0358D93B9C74AF8E0762823147C09787E4278317E90EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277553, "uuid": "25f211ea-8285-4a00-9f2d-e822f297880c", "value": "768:7IxWP9G0RJ33ySUm2sKNLpSl+6Hg+l00Kx9q3UELEQ:7IiZnF2sgSl+4lrLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277553, "uuid": "04dff5b6-a7af-41a9-bb33-5ed4154a4fc3", "value": 28204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277553, "uuid": "e39582f2-e28c-442c-a766-efb39039011d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277553, "uuid": "84b0639b-226d-4842-b0cc-6a89075f8854", "value": "6ab3156fd7be39bd8ba30a82ab7cc36f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d643903e-b597-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649242428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649242428, "uuid": "bc0cdf0c-a671-434e-a875-d5b3ba12cbb1", "comment": "Malware payload (AgentTesla)", "value": "fa740e3f4300bd915484f95536cb91fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649242428, "uuid": "dc184f6a-f4d8-4b46-a03f-0d2668ae2a08", "comment": "Malware payload (AgentTesla)", "value": "13d869e013219ccfad6e8c9d85148eda9172a4b3feb85dcecd706c52d7c6ffa5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649242428, "uuid": "547a83cc-5810-4664-ad69-e397a087cc34", "comment": "Malware payload (AgentTesla)", "value": "444194b364c6dbcb2665bf1094699b06cc63a9b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649242428, "uuid": "f53c2abe-7c8b-4ee5-af04-48a68643a197", "comment": "Malware payload (AgentTesla)", "value": "a2c1ec65f0494e0e4faef735595ba105aff697e4d1abc448a4dcdcf6b1b61ba81de8aebbf6a1dde03a8973f3cc01ad18", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649242428, "uuid": "846d7b6f-9b51-40e7-949a-ee47579c4a4d", "value": "T1E325A59DB2F072DFC467C9329AA81C64FAA078B7571BC247902311AD9A1D997CF143F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649242428, "uuid": "a150a3b3-24dd-4d44-b094-96bf8130687e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649242428, "uuid": "6e712f73-cee3-4d5b-850d-0fc1d56aaa7e", "value": "12288:LCwtBYVgNu4+ojOpd3zB9vQ47FgFLLlpX0DrW6l0fiyooaIlFG2ZLyeqhFFj88Mq:LCwtLu4+r3zDD+LzX2W6l0fFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649242428, "uuid": "ae1f9bf6-e230-48f3-9e5d-ac4f0f97b8f2", "value": 985600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649242428, "uuid": "b43af10c-05e7-47ca-a6c5-3c68732661f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649242428, "uuid": "a8375f0f-7b37-4ff8-9581-0a4d87b78480", "value": "STATEMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "392e3e76-b5e2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274376, "uuid": "094a3226-6f2c-46c2-8f03-671d3527ebe2", "comment": "Malware payload", "value": "d6e94481f9c29493077ae8dc8ab0ac37", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274376, "uuid": "786ffed6-1ff4-48b5-909b-69df12bae4f5", "comment": "Malware payload", "value": "14ee6c2dc793b3278baaa43c0f58bca0b315c91065dc157f5819f8cff99cc5be", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274376, "uuid": "4e7b42d8-c929-4ea9-ad9a-f713fc417f93", "comment": "Malware payload", "value": "ac092654902a0fdc086a09d96dcecd56fb3dd9bf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274376, "uuid": "8b9d8cd0-125a-4c7a-98b0-7f9d4f9a8f89", "comment": "Malware payload", "value": "aef2b24e8d8c7c45a724dcea38a2d93e493edd73fca8b84ea88e3211c756c1586627bfe88cc2219f600e3865caee428f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274376, "uuid": "d5ae5b14-1023-49ee-a72b-bd7e6c261a35", "value": "T14CA1E750112C1AB17246697AD26FFB52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274376, "uuid": "128eff9f-ccef-4b97-bcc9-7f9ddd2c5adc", "value": "96:TRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:TRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274376, "uuid": "67ddf18f-ddbb-4f8d-a872-919777850ed8", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274376, "uuid": "8c5c0c59-f6f4-4435-ae9a-a2e8ea7be319", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274376, "uuid": "07c6be86-4c76-4d17-aba6-798d7ea28cae", "value": "14ee6c2dc793b3278baaa43c0f58bca0b315c91065dc157f5819f8cff99cc5be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20585c34-b5c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (ModiLoader)", "timestamp": 1649262309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262309, "uuid": "3c8dc814-05ab-4f10-a70f-5ba4780bfe06", "comment": "Malware payload (ModiLoader)", "value": "0939020c244c42aaf2125a5740c728e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262309, "uuid": "798bc9cc-688b-46c3-9a1e-32b5566ee943", "comment": "Malware payload (ModiLoader)", "value": "14f57ce663a60615abee944ad9c221edc467a12bcb8ef40b5974c4d8355b082a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262309, "uuid": "518c0791-7a35-4713-b275-1502f36b305e", "comment": "Malware payload (ModiLoader)", "value": "2a97a6d25064540e9f0a1898ad560b5fb588d502", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262309, "uuid": "521f273b-0377-4730-90c5-c83935a976ba", "comment": "Malware payload (ModiLoader)", "value": "cb5f3fdcc84ff29ab7f3ebd6245d26757a3ef5d0a41c1fa41b019894d061c2e66c9c76da0964f33fb020fc768bbd16b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262309, "uuid": "251b3390-b819-4d61-9480-2265187fb2a6", "value": "T1C1E4AE10F3C34A72C8371E795D1BA6AA9A317E43BE0D71673AD02E1C5F795823A1D1A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262309, "uuid": "17ffc7a1-da52-4499-9cc1-5a2169193804", "value": "fb9ef474a56916f76519e89c228acc2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262309, "uuid": "1f5fe3d3-a969-41ee-88de-c134010e9292", "value": "12288:lQyjrymhNAiouMnzgVf6KmIMMorwgfDxRbXBpDadB7h2QZec4qO:2gW4AifMnzgVyCMfrws39pDadmQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262309, "uuid": "252ddbae-fe74-4896-82b1-6d0b3382784c", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262309, "uuid": "4f2b5147-ce6f-4344-9c02-0beb032fa78c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262309, "uuid": "9981d097-d00a-42be-81f2-a20769bf2b17", "value": "UPS SHIPMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "921ea7b8-b5e1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274096, "uuid": "93625fc0-ad8c-4d04-b6bd-2affc60bfcf4", "comment": "Malware payload", "value": "f4eae2f741a53ecb758a625c516803a2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274096, "uuid": "d034a516-890a-45d7-b592-e229c840a279", "comment": "Malware payload", "value": "15315f0fc1dabe73e50753c95114b2301bfe2ebde5bac413b41d57611b87260d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274096, "uuid": "811d49ae-a33c-4e33-8202-d8457986235c", "comment": "Malware payload", "value": "b16be6f8db9c42bd547e1c5537648adc346959cd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274096, "uuid": "e5b361cb-30ed-43bf-a67e-fbd45000cbc1", "comment": "Malware payload", "value": "b021f8693d2203306f1f555865fbfa8f27e9cbc4f4e01a37b79f05028c9218808fba7b60fcb93b0d22807662c4515b42", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274096, "uuid": "2ce6d74c-2396-42fa-b6da-5a57eff16e6c", "value": "T1794137CE13A312313DA1D9AF7AA685167180E89AE9D8AD14E5D87DEB81CDF0C71C4643", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274096, "uuid": "42899362-1fff-43f1-9629-9df7dd205ff8", "value": "48:v2R5/RA53mKvP+XYxPqLYFJP56YZR3p73P3YYA:v2JA5LvvPJR3p73M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274096, "uuid": "f83d9530-238d-400b-9003-07f50d93c2f8", "value": 2171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274096, "uuid": "14ecd76d-579f-41df-9bdc-b39e7e298f78", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274096, "uuid": "51d4909d-9562-472a-a29c-dba5e818a7fb", "value": "15315f0fc1dabe73e50753c95114b2301bfe2ebde5bac413b41d57611b87260d.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a336ec95-b5e9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649277561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277561, "uuid": "b7db2ea3-bb58-41b8-bbbd-eda8fc3628ed", "comment": "Malware payload (Mirai)", "value": "694660853fbcf2db5fc1ae0bf360bb39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277561, "uuid": "7371541e-07af-4f04-ba99-2948b360401e", "comment": "Malware payload (Mirai)", "value": "15c7c72eb35c51dab9fb275fb1139f8584a61515b79e8504eb27b21c59813712", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277561, "uuid": "d350163c-58fc-4ce7-8da3-c390b9024403", "comment": "Malware payload (Mirai)", "value": "081e7d6d865d2630b55dc4484eea591f596e4d9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277561, "uuid": "1ec0b5ba-87b7-4c84-a9a2-792203c9caa2", "comment": "Malware payload (Mirai)", "value": "79f35111f69819ed15c4571aeb2f5353e8a6be4771b50270dfaa9b55a3e44c39908ed5ef537db23e2e404a0804b76423", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277561, "uuid": "334ce511-0dde-40d2-853a-9b9a4975e28c", "value": "T19F333ADAB802AD7DF88BE6BE80124E09F23123555053172767A7FDE37E331A49912E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277561, "uuid": "446dc776-2c26-4e46-818a-18c8c7d49f99", "value": "768:jseDHFJlDnn5QX2kzj3pLkQPFmPAgFHupAu8WeTHpy1oJT9H/iH8Iy:owJ1n5QGMNRtm7FupJ8pVy1oJpH/o87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277561, "uuid": "9019850f-cd86-4b95-b490-16441b2cb2c0", "value": 54116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277561, "uuid": "38584402-95a0-4694-9d08-59e94f04d5d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277561, "uuid": "6a550f8d-3a61-4873-bb63-f677645df946", "value": "694660853fbcf2db5fc1ae0bf360bb39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87afdaad-b55a-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1649216096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649216096, "uuid": "c23615fb-2081-4662-aad9-bd291c4fad9d", "comment": "Malware payload (RemcosRAT)", "value": "061715d983951d69648b1e79748e20da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649216096, "uuid": "561fe562-8d13-4706-8bbf-8d0590d7cbfc", "comment": "Malware payload (RemcosRAT)", "value": "16810a489310baaf2af8502734bd0a82128719ac234153666ac453bca42f141b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649216096, "uuid": "2bf73718-dac6-47e6-a3cb-f3b1f7e3aa89", "comment": "Malware payload (RemcosRAT)", "value": "164ea60f4ac8358c419db3f969a4ff9884e7de5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649216096, "uuid": "791e6025-3bb1-43e3-8bae-3bd54f3c1479", "comment": "Malware payload (RemcosRAT)", "value": "d90955e08772a6cae49953c932046da50cddbf1ca4b409f7741b6834e6d6e0092b53a9f8e27977d636661b5b7fc104b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649216096, "uuid": "018550fb-fe5d-446f-9aae-a5f201a52c4a", "value": "T100E39D4263E441B6E4BA67B099F306835A31BC925F78C7EF2384954E0E33BD4A936717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649216096, "uuid": "7f014dc7-135f-4c83-af16-8622a606d3bf", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649216096, "uuid": "9be3f029-4baf-4f95-b96a-875f10f95f9b", "value": "3072:1vGygixsiq1o5GWp1icKAArDZz4N9GhbkrNEk1Jq:XvLp0yN90QED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649216096, "uuid": "f3d55bb4-9059-4242-a712-c5044d5d1ea6", "value": 155136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649216096, "uuid": "796670b5-8533-4a4f-8a95-7023c581f342", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649216096, "uuid": "9f653bf7-22ed-4bb5-a047-0762e2faf9e5", "value": "SecuriteInfo.com.Trojan.MulDrop11.36043.19184.1305", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd43278d-b571-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649226092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649226092, "uuid": "7d9a4087-95c6-4962-9dbb-1f931daf7635", "comment": "Malware payload (RedLineStealer)", "value": "594d7823440e565b0f1379be8f218e33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649226092, "uuid": "1a4ca31f-8efc-45c1-90f0-4eac7a81b8af", "comment": "Malware payload (RedLineStealer)", "value": "16f4a3fc69b8b2b64db781127f898729b4ea712c835a3ffc8b25021106f8245c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649226092, "uuid": "4347f7db-0b10-45d5-9b1a-5708793f30a2", "comment": "Malware payload (RedLineStealer)", "value": "07b3e8fc1d21fbbc13f7271d8eda4794ffa71861", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649226092, "uuid": "1c7a251f-5e35-4556-a32a-c33b52c2f690", "comment": "Malware payload (RedLineStealer)", "value": "0c8bcc62acfedbf214012d6f7e4c611dfe64ba7c9e05762e0b3289ba4450d6b088bc6f4f437bb6760ea1d1ec5a8c8b9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649226092, "uuid": "d16d3cdd-083a-412b-9071-f1178e3a2618", "value": "T1BC2623731255234DE0E5CC29D9377EC57AF6835A8E42B838A9DB7DCA20628E1F213D53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649226092, "uuid": "f27ecc93-d2bf-483d-ab30-4723df407940", "value": "92abf5ad90fc2838b3b0b9a065cff363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649226092, "uuid": "54a265bc-1003-4050-af1e-ea6c3f2207c5", "value": "98304:TQAxuLwL0tHrOYXh06kzYxFGhArz4wSVAdez4dNwMPXK4OZ0Rn5DY:cy3LiLOtz8Iirsjz+NQWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649226092, "uuid": "110f663a-bb2a-4113-b5c1-5c8df31cd8f5", "value": 4614048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649226092, "uuid": "2c91b6f1-ab97-4c4f-98c8-e49371f1099c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649226092, "uuid": "30aa1fe5-1cb5-4c70-a20a-52fa3366b08a", "value": "16f4a3fc69b8b2b64db781127f898729b4ea712c835a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbfbe2ae-b5a1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649246705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246705, "uuid": "b2f360e3-9611-4a81-b529-758122f5f430", "comment": "Malware payload (AgentTesla)", "value": "5f39ae778a31429419e1de2be6e178e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246705, "uuid": "d8794afb-ad29-4d59-9dcf-3d4a5e5a6e14", "comment": "Malware payload (AgentTesla)", "value": "1727f3f11513832df7853df656fbb79c78fbd4480552e0f85091e842ee444439", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246705, "uuid": "c15d92cb-641a-4e3e-ac3d-ae9aefade811", "comment": "Malware payload (AgentTesla)", "value": "49a4da842000a18b440d46570bc085a067885f87", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246705, "uuid": "8cbb6683-11dd-408d-aa77-ecc44a273713", "comment": "Malware payload (AgentTesla)", "value": "e710c72c19970fe492de3883ae26f977ce200f01134632c8306f6dc6b410e753a01f2441852038d614d16ff579b17fdd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246705, "uuid": "b277e4de-b5b3-4203-9dc7-6c8f29a3018a", "value": "T1E98412947BA2D4A6C1A12A721D76C0A1ABBBFC102478DB13FB64BF1C3D376D1A11D712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246705, "uuid": "9d8ef20b-abfb-4e1a-9146-5d648dcf83a9", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246705, "uuid": "f037e962-f5b2-44d6-912b-c3fc6bf2fbe3", "value": "6144:ONeZ7NE9eAw1kdukuV8z3rADbkxn5GK1rIl0ELNZQN0fZxaRY9Bov:ONWWdLuw2gxZIl0kAoZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246705, "uuid": "4389f45f-4331-45c4-bfda-74b95a331f4d", "value": 390127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246705, "uuid": "446d1bed-2549-4e84-9692-30aaef091bd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246705, "uuid": "7848e15d-e550-4862-8176-1d587d52cd27", "value": "P 24788-7432001_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0819e44e-b5e3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274723, "uuid": "0dda6689-366a-4919-8249-07b57a6fa056", "comment": "Malware payload", "value": "c0287fe7be0a635dc79ff18a463ba03e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274723, "uuid": "e35fbdea-1cfb-4d05-b961-f0a8c8a7570c", "comment": "Malware payload", "value": "17851f6e2f6a9a16d8ed2bc1fcc8e898587aaa144490ef683a41b11783565795", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274723, "uuid": "b4d185ce-01d1-47f0-86b5-320e570bd9c9", "comment": "Malware payload", "value": "019a33d9ff093ff51f148d9538339f687c11e24c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274723, "uuid": "9632e7a0-8c7b-47f4-9d85-62894ac588fa", "comment": "Malware payload", "value": "fa415d071dd65431c159bfb1486efd2414534b717e3086cd6e36304a0fc085e354fbab357af6f215b6395cf4e071069f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274723, "uuid": "332f2f36-77e1-4efc-a4bf-f7c2339662b3", "value": "T1B8515BF74062C9363E5511B5A56B342EF085EE678AC53F21B6FDBCF4818CE386471822", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274723, "uuid": "4de7a9be-faf5-4c67-b8fd-f3f5960d5071", "value": "48:vHF4gV/TZGtaLPh1JMQoixHEFQ+KLh3Opfr:vlZp9EaLZT55J2QVNaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274723, "uuid": "bf7093d7-f822-479d-b62a-cecc08647728", "value": 2895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274723, "uuid": "7ad95ab3-7bdb-4372-9456-2e3212d25818", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274723, "uuid": "ea9752ec-9e43-4398-bc3a-07e2ee563e46", "value": "17851f6e2f6a9a16d8ed2bc1fcc8e898587aaa144490ef683a41b11783565795", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2514125e-b574-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649227098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649227098, "uuid": "f434b442-c57f-4648-a3bf-9c0c2479cd8a", "comment": "Malware payload (Heodo)", "value": "eb44dd731a9bee6057c6ba06e7c8ae15", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649227098, "uuid": "99c212c3-2c86-45c5-b909-37cdf4372512", "comment": "Malware payload (Heodo)", "value": "17996c9c54c05d421dfa607c27836089558a2221c3d9a0838e3705f9b91b9035", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649227098, "uuid": "0fef2cd6-b85d-4dc3-a040-dc76f24e6444", "comment": "Malware payload (Heodo)", "value": "4a99b0f1cb5e47c9b14cd78a11109cb15081cd56", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649227098, "uuid": "dcfdd217-c80e-4c96-87a9-4a5ea94cf24f", "comment": "Malware payload (Heodo)", "value": "aa7988339c514310609d616d5aec71b5d18552a2de3aeec1ee11a9f3617597d4e35867096cb7d31ea6ec502db4de1890", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649227098, "uuid": "f4c55845-3584-4249-8191-f4c13cd396b0", "value": "T1B184FC7D1FAE00A2CC621770146C0FD991ABCA25BB1255FF24892E2E2EB57D74879F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649227098, "uuid": "960d9199-b75e-49a3-a104-50611713b44d", "value": "3072:rA5pcWyfJCALTQMLOuw80g4SY0sjHyKilLGcBZj7BvUBmiOw:iKfJCALkjp1g4SbsLyKilbNUBmBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649227098, "uuid": "37c02b2f-4fa6-48f5-be3a-2479bffe2f50", "value": 392784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649227098, "uuid": "cadad33f-0169-4216-b3e4-304f99bb89d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649227098, "uuid": "41d428b4-d89a-413b-892d-205114b39c30", "value": "emotet_exe_e5_17996c9c54c05d421dfa607c27836089558a2221c3d9a0838e3705f9b91b9035_2022-04-06__063813.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f56da64-b5bc-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649258012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258012, "uuid": "ae6ef716-a9f3-4075-9241-60d1b63249e6", "comment": "Malware payload (AgentTesla)", "value": "25e1b6d79533e220bcde0d92b2de8fb6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258012, "uuid": "546f8013-5635-4a5c-84c2-fb5112c4dbbe", "comment": "Malware payload (AgentTesla)", "value": "189200fb1ad7dca9325e1900cd7e6264258bc7fc5a8687150d66d76ad71d1227", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258012, "uuid": "7d6f7cde-bf04-43c3-81a1-f09b620721df", "comment": "Malware payload (AgentTesla)", "value": "194a11f7e6cb93b2f9e7a582f87273a808febae3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258012, "uuid": "7ea345f2-73a3-4fee-895c-6b428d3326b9", "comment": "Malware payload (AgentTesla)", "value": "075330a990bd7ee0041932859bef8a4c19266d21557a57e78dd66e7dae581fd42cc61d283b1c9e3643224680d62f5282", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258012, "uuid": "00eb2ace-30a7-4d71-b273-11be2409b9fe", "value": "T1AB1412A5B6E1DDE0CDB75838EAE1B40CA138FC9D9410A146B9373B9C19F52B390932B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258012, "uuid": "eb23c459-0f38-4fd8-925a-646071053e3a", "value": "3072:A4pdBUmNxoc6oZ1F+uBPWh0eduUE9wh6KVmIOv74rpu8wkUPGqq6KDTqO+HH1kRZ:rjNxr50uBPQES8fMrg1nfH1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649258012, "uuid": "21d71b9d-d10f-4507-b882-f9883f9b0655", "value": 191336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649258012, "uuid": "ee8d6398-2496-4329-ba44-39b85df5e81f", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258012, "uuid": "0227cc71-b14f-46e3-a33c-3d43a745df9e", "value": "PO XLXS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9bfba1f-b595-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649241574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649241574, "uuid": "d27dee76-0382-4226-b2b4-674642a4168f", "comment": "Malware payload (AgentTesla)", "value": "66a38e6dd8e38c23eea192ed86d57ad5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649241574, "uuid": "b9a3dd92-d338-47a4-b988-7532a95a8665", "comment": "Malware payload (AgentTesla)", "value": "18aef73d29c057771bf93ad9d39bf4abac1c454149474b0b4dee8384da0c5144", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649241574, "uuid": "87ecd5e5-04a4-4fe4-8dff-c9ac81a1ed23", "comment": "Malware payload (AgentTesla)", "value": "a3323687c5f1ed1546ca87a65f9eddf23a5e6b99", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649241574, "uuid": "9af430c1-cd68-4488-b0d6-356963562488", "comment": "Malware payload (AgentTesla)", "value": "90e76a42fa66c6e393c1efba4d3a31657c4925cd1abcf59b1fa1df31aed3b58aadabce14ceee96a4da725876ea03cd1e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649241574, "uuid": "b04516bb-50f4-48eb-968b-18e04ab137a6", "value": "T156C4125AB7B7DC13D47D9BB785D156050370A6136063D78F2ACD06AB4B127E32A82BC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649241574, "uuid": "91c30376-b4b1-4e68-9f05-6526bd92922f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649241574, "uuid": "f0320dfc-bda6-4fe7-968d-45afb6f39898", "value": "12288:iLkMCEwIgWrVt+ESGFjmHMy/OW0U0t5uSWdAs7/NoArhvF:LRIgWBt9eV/O3uT17/Kshv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649241574, "uuid": "956b0aa6-ed94-48c8-939a-9436fe892919", "value": 559616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649241574, "uuid": "39b00c55-0f8e-4ff1-995b-f96ac29969d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649241574, "uuid": "284b4118-addd-41b2-8418-37eab0f5f233", "value": "Suministro Consulta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5209dbe7-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277854, "uuid": "72b40ee7-8627-4f07-bf9e-c485ece4dd65", "comment": "Malware payload", "value": "b94917241bcec94169944e8ce7f0162f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277854, "uuid": "4fbbfb46-5367-49ba-8f0b-85722a8d0598", "comment": "Malware payload", "value": "18ce47cb1bda33ebb3628cd365cfe62f1ae3a0ab6adfbcc055baef17bfc51a76", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277854, "uuid": "e74ece81-a001-41d1-a0aa-11a953e2cd2f", "comment": "Malware payload", "value": "ac97b15f98d9387ca7d22ae13f1bc07243020950", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277854, "uuid": "f3ec613e-6bba-4b13-9fbe-f4de1360cb3c", "comment": "Malware payload", "value": "f7c1b152ce3dfaf80dacccc1f6a47ebfaf716ebf885f214f90ec0802a3f0ff1a4e3d393e252c4ef5dbf6c5ee26fb0fbd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277854, "uuid": "0928f424-bc9b-4294-a8f3-34505b97ae53", "value": "T14DA1F750112C1AB07246697AD26FFB52B80EC81B0A7B7B358473A63C74F9DB8E0796C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277854, "uuid": "0c29d5b0-351d-4c17-a108-b2bdbbcaf80a", "value": "96:DRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:DRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277854, "uuid": "13214dd5-01a3-495b-af5b-649ad647283f", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277854, "uuid": "ee7d2f17-4e27-4fff-9e6e-c990aff612e6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277854, "uuid": "b073104c-3d00-4e41-8381-d1b32251c7b1", "value": "18ce47cb1bda33ebb3628cd365cfe62f1ae3a0ab6adfbcc055baef17bfc51a76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "527dbbdd-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277855, "uuid": "07476581-133a-4f05-af90-0cbf45d6ea2c", "comment": "Malware payload", "value": "a8c388ef089cf6461162cbf0499a91b6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277855, "uuid": "f1c39763-a50f-4f10-9e71-8558fd19b9dd", "comment": "Malware payload", "value": "18d9ac4dc052098f6a02aa38d9ab6672a96c833abc22340728a219ea15cc9e87", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277855, "uuid": "b215d869-2067-4de0-a975-6bd56222f215", "comment": "Malware payload", "value": "c57b6f29e5594c3a1eacd473e8169e4f23832400", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277855, "uuid": "987c6ee4-11d9-45ee-a7ef-6ddb00f6caba", "comment": "Malware payload", "value": "f840ec3baf2419e6ad3e8d091fac8a5c83e2d9fccc0de0b33e55c6bbe0760712e37ff22e934c11b5e0ceb4f88ff9f94f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277855, "uuid": "3bf205d8-385e-4a0b-bd90-9ef52a80afa0", "value": "T16FA1F750112C1AB07346697AD26FFB52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277855, "uuid": "3cb9f70b-3afb-4b78-b8a2-283126ddea49", "value": "96:sRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:sRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277855, "uuid": "1efdc40f-f5c3-433d-a553-da71e3a419b2", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277855, "uuid": "9f62fdab-cd94-4555-8155-2c4c2be54b51", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277855, "uuid": "579151f8-5d5f-4d6c-a485-2c5f05c1f35b", "value": "18d9ac4dc052098f6a02aa38d9ab6672a96c833abc22340728a219ea15cc9e87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad8d0684-b5b9-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649256962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256962, "uuid": "c527a87f-7c0e-41c5-bf8b-d4ded0c59e25", "comment": "Malware payload (SnakeKeylogger)", "value": "dd0490aa795e254cbf8f4b05e9e7ec91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256962, "uuid": "fad3276b-9034-4984-b80e-de9e3baa7ab1", "comment": "Malware payload (SnakeKeylogger)", "value": "1909c5fd49f9d5a391cacde242f6fc9b0be715c3506ed52ae2edc63a57651789", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256962, "uuid": "27eac445-0aa0-490d-b25b-5a773a13c2b8", "comment": "Malware payload (SnakeKeylogger)", "value": "69e27754e1eb260a4587fdc8d1195a0c27e87332", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256962, "uuid": "b667acaa-f6d3-4a4f-9c50-c72f8d00ded8", "comment": "Malware payload (SnakeKeylogger)", "value": "43778fd135f5d84a6edd4fe4113edbc338f22f41b4652b553bd33c2b319bd0b552c132b1dd5f1b8e8aca7d17ec533125", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256962, "uuid": "fe34b8f6-38a4-49ca-94ba-8e591c9b3917", "value": "T1A5A40249BB5BCA13CA6C0E73A1E2054103B1B7139577D38A6BC915AF1BA33E60D427E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256962, "uuid": "2648bc95-aa02-431a-bca5-75d6a4e2e8b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256962, "uuid": "9db7d360-d7d4-40ba-9e92-8c6e7ef5b98b", "value": "6144:ePSbJ6uumtPtv232DK0bB1eBKs8AbITmdyQDyumbrkWJImiA31BKLZt:MSAgtvDKsB+X8AboumbB6miACF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649256962, "uuid": "32c0a07c-b278-4626-92e0-7424b86b1fc9", "value": 482816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649256962, "uuid": "f3a24a6b-0016-4521-be2e-cdcedbe25901", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256962, "uuid": "c47fa122-2710-4660-8e4e-881dbfdce35a", "value": "Urgent Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d57f99cd-b5bb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649257888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257888, "uuid": "85d00091-8a9a-4991-a114-73e0d76407fe", "comment": "Malware payload (Formbook)", "value": "cd07a7385f1e41cee427b609cc6ee188", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257888, "uuid": "d8c60d3f-2be0-4b2f-980a-8a30a7f249e7", "comment": "Malware payload (Formbook)", "value": "19c504e5fc643cc7834f70444af6ebf8f949b389a7c2d2a81e7e35d8205dfbdb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257888, "uuid": "979cc803-daa7-42e4-bfc0-4598fecab5ae", "comment": "Malware payload (Formbook)", "value": "bed7499ebaac0332200426cadc89b381a68dfc22", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257888, "uuid": "e3cdb22b-8f38-4dfe-b15b-7452504f6e37", "comment": "Malware payload (Formbook)", "value": "34c753a1e2808fcc30f2add9dd05adcab784409fde4eebdd659baf29cd632bf6d593c7ca505cb3941d478a60fbb12f07", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257888, "uuid": "0d44950a-2e5c-4486-9f6b-bd02ad589741", "value": "T14F1412AC3B449D98F8FA753C37CD73886BDC6E3F48E08B5E76493848403493A9D251A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257888, "uuid": "d0fd892a-03fd-4e5d-a875-8048d6c2d83b", "value": "3072:RR0R8MGxTYoKLuU6PaB0G5N1qsMOUk7KAJzxgRgjhdxFNIlqOQULC+6:8D2kLoPa6G5N1q2RJzWRNlrDCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257888, "uuid": "4278823e-8f04-4ed1-910f-6233b0523e13", "value": 192200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257888, "uuid": "64769113-3710-4d45-ba07-a3d3a755da42", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257888, "uuid": "59d77131-da44-4ecb-87d5-1729cfa640f5", "value": "Documents.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0486d6e2-b5e8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649276865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276865, "uuid": "e0926def-8022-448e-9947-e9e8d899219a", "comment": "Malware payload (Mirai)", "value": "2cb458c98ea1b6122d937800c78b3ee6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276865, "uuid": "c1963ee9-08ee-4d49-a371-521fbb25ad15", "comment": "Malware payload (Mirai)", "value": "1adf79b2d5a2dd05d5bad013045d95d60b4fd33056aef2ae89b44b094b4ed9e4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276865, "uuid": "a8c06a95-20e1-4d7b-8b57-f655ae1ac595", "comment": "Malware payload (Mirai)", "value": "24c7d81b89c909ca98604aaea491e7c38ee894a2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276865, "uuid": "bf65e78a-5cbd-45ba-bbe3-77c4102509e2", "comment": "Malware payload (Mirai)", "value": "d6333390407b2d464fdb4441367ad66a8f8ff1c8c71dbbedfb5f2fd30edbad6ebd1fdd479a7e53cb7fd719d464bec7b4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276865, "uuid": "7188e08b-eac3-4f8a-bc65-eb51c3d58ebe", "value": "T13C634B47B58582FDD1D9D1BC52AF6532C822B97D133AB18633C0FE1B3C19E606B2E589", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276865, "uuid": "16a3af43-74b5-40c8-8a26-94ded42a3c1d", "value": "768:+Kn+DYhXHttcQcW5ONKNhBVSAOwyGA64azVjXSp9tEMNsrE8040oELWUn:o8Vt6W5ON+OTw2lkjXnIstl0oELWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649276865, "uuid": "fc3155e3-242a-4afe-a2d4-bebcce52b9f2", "value": 66816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649276865, "uuid": "88e2856c-f98c-40ba-b0a4-e69e6e1a9169", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276865, "uuid": "4d048e09-3d13-4408-a0c7-c1c08e98b34e", "value": "x86_64-20220406-2027", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cefd27af-b5c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649262602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262602, "uuid": "7359f9a0-93bc-456f-b98c-660b5a8b4c89", "comment": "Malware payload (Loki)", "value": "72b2e84c1aec86b5c955ff098d7fd8b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262602, "uuid": "cce8f872-df4b-4aaa-a13b-2f91a5c743b9", "comment": "Malware payload (Loki)", "value": "1b26f49cdc29c81ea4d8f5571349e835662bca7881608dce0d13e86798dd9ac4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262602, "uuid": "cc85288e-7f78-4a5f-8094-0b55d36ddd6f", "comment": "Malware payload (Loki)", "value": "20f9c563206eff907cfad0723988de58872bc93e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262602, "uuid": "ed40f405-7ffb-4a50-be52-a88ee72edd07", "comment": "Malware payload (Loki)", "value": "7bb702e1fd24261e4bf85475669c347b70ff8cfe9f258d7259804db9bfe1747446c6b29cd141953d6a3759f02af29549", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262602, "uuid": "83f6af64-a14b-4fa1-8cbf-23c2f220c190", "value": "T1733412A07B7CC493C6F343B21C75E6AB6F65992020A042CF57202A9D79777E2CA1F716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262602, "uuid": "9a8d3a80-e9d5-4cd6-9afe-d2d40a19ce1e", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262602, "uuid": "42199133-f5e8-424c-8ee6-d5a77f17a0b9", "value": "6144:HNeZmGsX4gDALdTQQNUofXRkvlNEH/T2UfL:HNlGsXP0+QNUoINeq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262602, "uuid": "ad024dc0-2ea8-4cd6-b56b-9bc652fea6a5", "value": 237452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262602, "uuid": "a1a7c620-74d0-426e-8dff-164ed22d9ae2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262602, "uuid": "5049bce7-95ce-4eb3-8a68-0a6545944a95", "value": "72b2e84c1aec86b5c955ff098d7fd8b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bab9906-b5e4-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649275159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275159, "uuid": "2e33493f-7761-4809-92a3-0c1593700990", "comment": "Malware payload", "value": "b2cc8de618cdc5288d423084c33c2302", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275159, "uuid": "0b8d7a44-0123-411c-b56b-6cb8d5362c9e", "comment": "Malware payload", "value": "1b3766bd744d10f1cbf2ebccc9140895c912bf52d595aab0c04a4bd269c3735a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275159, "uuid": "42c2c0f4-79aa-40a8-8908-69404a46749a", "comment": "Malware payload", "value": "4db8813b75cf2e0a1fe975ac79e8da957821f3f5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275159, "uuid": "a09fe9c2-1f06-40a6-bca9-465e397e68e4", "comment": "Malware payload", "value": "915bdf77224142a5dd48122dd771ab731841901904c09d5b956b3888bc1ff1d9080154b360eb85c02339d723ce8e2ec2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649275159, "uuid": "af50d285-e71d-4a9d-bfdc-b003361544e0", "value": "T139A1E750112C1AB17346697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649275159, "uuid": "4cbc0b35-2fd6-4e60-a2ba-bc42b75774c0", "value": "96:xRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:xRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649275159, "uuid": "b10127c6-a0ae-4f24-ac65-3b5d0d909526", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649275159, "uuid": "0fa1bb75-7111-4c3c-98da-103260e9914f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649275159, "uuid": "34aa0e6b-c2f5-41f9-b101-7944330c639e", "value": "1b3766bd744d10f1cbf2ebccc9140895c912bf52d595aab0c04a4bd269c3735a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0382e780-b5e4-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649275145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275145, "uuid": "e8ef0d18-3096-41c3-9850-b67efaea874b", "comment": "Malware payload", "value": "57c4e7e4aacc252a3e7ee581eb0b07c4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275145, "uuid": "91d7381e-8ffc-4923-9d32-e15c40f2edc3", "comment": "Malware payload", "value": "1c06b7441bae4fdb10f42afc8ac4e9a49100fb36551ce6eee583de3dfbefee54", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275145, "uuid": "2085b419-79a4-44e3-a00a-5e702c1087d3", "comment": "Malware payload", "value": "681661d8d03f0412b96ef91c71bf9fae3628a493", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275145, "uuid": "f5308140-f15d-446e-be2d-9f1c3674aaf5", "comment": "Malware payload", "value": "4e116fc7213036ea228fc8ad3f574b01fa25347a120efb8064891121c15a2419b13b7890b5d7dd4118657b7a483b0aae", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649275145, "uuid": "8482ca63-1925-4c61-924d-08995330a1c1", "value": "T1C0A1F750112C1AB07346697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649275145, "uuid": "6d7c2596-230e-485e-9fdd-627b7be53465", "value": "96:ERYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ERJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649275145, "uuid": "adc96d9a-c3ec-46a8-a454-df8c80df0ff4", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649275145, "uuid": "a97b7dc0-c0b1-4484-84a3-0abf7267ca3f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649275145, "uuid": "120d9438-05b3-4097-8be4-abbc26202929", "value": "1c06b7441bae4fdb10f42afc8ac4e9a49100fb36551ce6eee583de3dfbefee54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa039a1-b593-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649240529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649240529, "uuid": "efe126db-7b40-4b7c-aec8-8a2e08d39e17", "comment": "Malware payload (Mirai)", "value": "993aa3bc1d991ee1633a99cc0790870d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649240529, "uuid": "9f746089-7ceb-4c4a-bec2-8bdac3834b41", "comment": "Malware payload (Mirai)", "value": "1c43dafcbd2669a435d9f540048c050f93cb1099b6d6b15dfe8efb63105d4319", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649240529, "uuid": "484d8ac9-b6c7-4469-93e9-01203acb6706", "comment": "Malware payload (Mirai)", "value": "b100f4a4273405dc29b11c69dd81ee0e0816a9a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649240529, "uuid": "84e7ba2b-2d77-4c96-8d22-0bc677b62f01", "comment": "Malware payload (Mirai)", "value": "cc41534ce1552d6784347454b85272085d2f84f90dc691420a8642aa5d8d58b7966e40b488b35f014765e221e3523443", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649240529, "uuid": "783f0dfe-95c9-4e05-8b72-9c367f7e31ce", "value": "T188236B75C83A5E98C2588274A8748E391F23E954979B2FF60956C666C003ECCF36D3F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649240529, "uuid": "8b9db0c9-0697-4bf3-bfa6-cb34eaed9cd5", "value": "768:waoBpvcke8mltEXMEr5GbeNE466X32aHCCubQAo4yJ4vbCl+v1H:wawFBvMW5Nd7Hou4fvbCl+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649240529, "uuid": "3e70acdd-74ec-4e59-a030-04f2d8378c16", "value": 46284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649240529, "uuid": "68d7ba5d-0f4a-4cc3-90b4-0f9f4a7a9839", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649240529, "uuid": "c63fb183-b1b3-4e5d-9304-e19f24acd85a", "value": "993aa3bc1d991ee1633a99cc0790870d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eefb38cd-b5bb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649257931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257931, "uuid": "b2e7c120-77ac-427b-958a-1766dbb4d24d", "comment": "Malware payload (Loki)", "value": "e4444106d5e093acd6f0e6f71d88fe67", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257931, "uuid": "27e82f19-ef01-46ab-86c1-a2edd411e333", "comment": "Malware payload (Loki)", "value": "1cb5a130b9eb1307c82461762a1dafa1711f39897542848354f4a0e19ebeda4f", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257931, "uuid": "61376e9a-2a96-4650-acf2-664c874b0a70", "comment": "Malware payload (Loki)", "value": "6c43247e0142d5a067f4aefafed39c4216774e83", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257931, "uuid": "88113263-c721-4d05-93b4-f445813b905f", "comment": "Malware payload (Loki)", "value": "11a05dc899de70531c19130b52d5201afef317f5b10d425c84651751a3321ada1c29405c16b563c3ab8f9643237ea09f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257931, "uuid": "2d193801-d09c-4aae-9ebe-c5cf11877aae", "value": "T19314124CFCAD59C4F1BB32B44A0645619EEFEF04F97A2ADBC9127429D070D8C422EE59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257931, "uuid": "fca908fa-354f-4b7f-83e7-dfd85a9285c4", "value": "3072:af9CTVdeSBu3IyJKBooT1XNNAJNvml3knpDoQrd1KvlWt8rz6+inRTn/UO:YcPY/wVNZknpDoQrab6+inJn/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257931, "uuid": "06c64ddc-5811-48cd-b2aa-764bb0a79592", "value": 191432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257931, "uuid": "6f59453b-71c4-4b86-8c6a-5671cff3776a", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257931, "uuid": "cb0718f1-6df7-4c26-bdf2-e7a99d091bb9", "value": "Proforma Invoice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fcd633a-b586-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649234793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234793, "uuid": "a893ba0c-e822-429e-8e10-370fc269a875", "comment": "Malware payload", "value": "5ea60cfa1d314bbf63de784bd8cec178", "object_relation": "md5", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234793, "uuid": "64338125-9c35-4b56-bf44-dbd27ae59b53", "comment": "Malware payload", "value": "1d4a9a8f87f166dc24da7c6d721dec1565dab1856d80d06291b3ad557cd7648d", "object_relation": "sha256", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234793, "uuid": "ad7213d9-c8b1-4541-b1d5-9593cbbb50a9", "comment": "Malware payload", "value": "19ab550984af4d2f5cc2d657c387dec4b62bfd34", "object_relation": "sha1", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234793, "uuid": "87ae13b3-8f2b-44f5-90af-3224f3323a50", "comment": "Malware payload", "value": "5879826bffc11b15bd9cc0c0e7edc3cf623e83e190cc32cb56f6481171463c92d8fa97411832055dad38f15b4c510b8a", "object_relation": "sha3-384", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234793, "uuid": "3e5a551d-886b-4ebf-8ad4-0e8dd064b106", "value": "T1434423F4AE28C5D892163833B387BA5509A9D0D6ACEC062300CB87E67D7D4B7CD857D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234793, "uuid": "c15adf28-6f3b-4f7d-9fb8-309ce1892357", "value": "6144:w/JDo5ZRLwigPUmHqUFLPEyNfzMe12FdeljL/pW:w8HpgcmHqUnMe12FdypW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649234793, "uuid": "93144e0a-b1bc-42b6-b3bf-41798489ba5c", "value": 254080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649234793, "uuid": "c5b1af31-b6fa-46aa-bbf7-150546691562", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234793, "uuid": "d65e782f-2233-4915-b7c0-9d360bafff9b", "value": "124befa6-1e57-47e1-4327-184bc2ac0fed.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e08024-b545-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649206853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649206853, "uuid": "31919bda-a1b5-418f-a03c-4d4097d57341", "comment": "Malware payload", "value": "defafc938a0344b188d7273d3dd3eb48", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649206853, "uuid": "c4a0954c-1627-4b2a-ae52-255123de5a14", "comment": "Malware payload", "value": "1e54fbbaf3423c8b15b2507cb1e8c18092b0f728aa705ef8d235ac4300cd3e29", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649206853, "uuid": "ce249e88-ef2e-43e3-a879-b33df106ef6e", "comment": "Malware payload", "value": "c3cb7db97b6d85a781d3efe27829805e13a41eb7", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649206853, "uuid": "cfb230fe-6f83-43fa-aa8a-748d0ecfe2d8", "comment": "Malware payload", "value": "82c7997bf264502965ecaef4863c13c60bbc1e3cae6052a285f2a738e9290315eac3c69c9f273cb0cbd44c692929141c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649206853, "uuid": "d16387aa-de66-4da9-a51a-c61324940c13", "value": "T179F3DF617B041823DD5B8A7B50309D33B67D10E74A07322871B5D8A3B6B7ABA3F49783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649206853, "uuid": "d3d586a8-34f9-4f14-8e49-7aaade290c7a", "value": "3072:qLYdnSVQge6xh9Wkm7Y23QHe5G0Tx+vkgOX/H63jKzdguw4LTAMBkaBMqj:eQge4ykh4TItm/Ibu0Sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649206853, "uuid": "466bef61-c8ad-4ce0-88ca-d4edafe0f83e", "value": 170854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649206853, "uuid": "2d06de50-bb4c-40dd-bc96-8d1ea8a7d2fd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649206853, "uuid": "0393cf77-c44a-45b6-8fd3-a02f997be24d", "value": "loader.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "389d2ad4-b5bc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649258054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258054, "uuid": "a836e545-f4c4-4591-a5b6-8cfdded1f4b9", "comment": "Malware payload (Formbook)", "value": "e41172bf42eb085e03d6922bee0bab0f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258054, "uuid": "fd170cbf-664a-4025-af4a-651e7f583691", "comment": "Malware payload (Formbook)", "value": "1e9c905845f7ae99d48c488eb4ab418444e4ed3b4f5c5aa2600654dca9d7743c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258054, "uuid": "b90acf2c-df7a-4c10-8000-e0e036fb70a6", "comment": "Malware payload (Formbook)", "value": "71752565d52805203a61f51f0a0614149500387b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258054, "uuid": "7173d973-1779-447b-896e-0775d4c0f530", "comment": "Malware payload (Formbook)", "value": "74fa8547dd4874f6916dcc3251c255ffd252b8ed7e9352d01915a54687d43477a61c0d96a362ae612e3fe13f92086b3c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258054, "uuid": "49b6790c-2609-4284-b453-bf49e6e22601", "value": "T11B140144F22DD116D42051381F5FD6EA54B48E2A291EF13A20E4374AFF3AAE462F497E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258054, "uuid": "e617a8a4-c24e-4240-a518-1c6e2bb9891a", "value": "3072:3GL7gNXNQlqM/rWf5EY0IMGWN/LuGNTlY+HgtmXB2sUePlMiC7pGcV:WqilDrWf5ExIyxLuG71NB/UePlXC9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649258054, "uuid": "e58a693f-5535-4ba7-9505-57e5596d6d33", "value": 192136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649258054, "uuid": "cdb65dc4-3d9a-4cc6-87f2-6c28fa67897b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258054, "uuid": "d18e5ad0-46a0-4918-a909-69c452b1bed7", "value": "product listing.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c360ba39-b5b8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649256569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256569, "uuid": "446459f0-22c9-4986-96b8-c01cd3bfb854", "comment": "Malware payload", "value": "0cbf00b03f5b840912b7d9eea9fce6a7", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256569, "uuid": "84171abf-d872-49b2-af68-96d8315c1a91", "comment": "Malware payload", "value": "1ef3fba9983daf5d66479859011faccc24a8363af11cc2a1d61208be04cedd1a", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256569, "uuid": "7570911c-c048-4db7-a95f-2f82b33277b2", "comment": "Malware payload", "value": "ecdaa6a3a622df161a627c8ee8fe7395d9f9994e", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256569, "uuid": "2eb8e25b-bbf8-46bb-930c-03c4f5b32e8f", "comment": "Malware payload", "value": "e66ade7f7fd8a6be4ef3ede5da2685da28a90c23bac16228cf3400e7bd58549e9a90d6c7d196b4cc7ca03bf67919e0b9", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256569, "uuid": "3187c5e6-a131-4156-83ea-002c9cb3e352", "value": "T107411A82AB3FC6F0F95F8A78A04754E8D511E1C65D0A274A18C44362AC88FFC8F276D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256569, "uuid": "3bd2b0da-4d38-46ef-9fe5-6bcf8707f7be", "value": "48:91sdwXwKDILI1KtLjpk6Nyj/dOCUzTtn0/UfX6zCqiQj:3sdQrCIW0FOrO06zUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649256569, "uuid": "71d37448-0c13-4553-9f45-0f0522440e94", "value": 2095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649256569, "uuid": "402e8a02-afd4-457f-8f6b-2a720a0d37db", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256569, "uuid": "00210487-74e2-4a43-b058-2b47c0456cbb", "value": "dettagli122.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2052ebe1-b5bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (STRRAT)", "timestamp": 1649258443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258443, "uuid": "299b26b4-5784-43a4-bea8-808472ceaa8f", "comment": "Malware payload (STRRAT)", "value": "ce6d7b57662f93320d369e98c8f438d7", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258443, "uuid": "80f5ff01-8cbf-49be-9ee1-e6b6c7f5e894", "comment": "Malware payload (STRRAT)", "value": "1f3c82f563b57461bfa4dbe7a5ab963e72ad50c1f2e62ac312978a296bdf2ef6", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258443, "uuid": "d86a67f8-5abd-49f8-b09a-a130fc18730c", "comment": "Malware payload (STRRAT)", "value": "313b5717ab4a90cc2eafe37f0e4f031b9ba089dd", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258443, "uuid": "00add012-f0c7-45d2-9851-5c30c83e5741", "comment": "Malware payload (STRRAT)", "value": "7f4e3eab2e91b4caa53882792016faec8755b381321c02968c98557178e9eef5c51238372b8184dedc23a3374d3fc512", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258443, "uuid": "2c942e9e-46ae-43fc-bea5-8551ed56de21", "value": "T1D604F15FBD4AE4D5E2472432125CE27FB60E1194E012257F27FC08862DB6E2D0EA399E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258443, "uuid": "b0a54cbc-dbd3-4eb4-b5bf-5ad82e94aa81", "value": "3072:gDr3XWu1Uh43kxpPG38OapU/H2D1L62RUo+w5ayz4U9gitRN:OrWu1UEkbZOamP2DlvKo+0ayUcHRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649258443, "uuid": "443903f0-f20e-4326-b69e-f5b5e8cf9f08", "value": 174847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649258443, "uuid": "d74cffad-6e93-433b-a051-dbec04fd6c7d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258443, "uuid": "0d313354-206c-4344-9a19-4148c85f5903", "value": "DOC20220604MEKONG.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27bfeb29-b5e3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274777, "uuid": "e39a626a-e1ea-42d8-bb2c-331363e5de7c", "comment": "Malware payload", "value": "5b6b97b616cf0674715c298d92f93e8f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274777, "uuid": "62ff49be-bc6e-4ca1-92b0-5cee64040beb", "comment": "Malware payload", "value": "2025b2038d0eed3c350941f454454261a61871dd86ea9fbd5da675bf0bc3f7c0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274777, "uuid": "f7436985-5983-4b5a-8697-7eb19c92d6c4", "comment": "Malware payload", "value": "8448fcbf69c4648d152b1926bfb59500a316a2f2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274777, "uuid": "154af9c5-5731-40f7-b209-afa7a06d5737", "comment": "Malware payload", "value": "d6904c208b26c65a776a8e04bdf0319e03df824a0e1f646118cab56def0a4c9cc7537f14a1a1ee440bdfec5b2a4f177f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274777, "uuid": "35010eb2-2cec-4899-845b-b7a833702fc4", "value": "T1F6A1E850112C1AB17246697AD26FFA52B90EC81B097B7B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274777, "uuid": "545e8820-8bea-410a-8cec-4bf559b6824b", "value": "96:qRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:qRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274777, "uuid": "4392f3b6-5561-454a-99e6-f5ee9e5d96ac", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274777, "uuid": "756f8dad-b910-41fe-8f87-e248cc90741e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274777, "uuid": "0ef2d033-25af-4599-a4d1-bba607cac57a", "value": "2025b2038d0eed3c350941f454454261a61871dd86ea9fbd5da675bf0bc3f7c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b1169d-b5a9-11ec-8e58-42010a9c0032", "comment": "Malware payload (MimiKatz)", "timestamp": 1649250109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250109, "uuid": "e856b20a-acd5-4798-ad4b-e8b2df2e5ce4", "comment": "Malware payload (MimiKatz)", "value": "dc017b3ace102dbeab7225d4f7f79115", "object_relation": "md5", "Tag": [ { "name": "Cicada", "colour": "#47E440", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250109, "uuid": "702c54de-7109-4cc3-8836-66a0168c48e4", "comment": "Malware payload (MimiKatz)", "value": "20fc3cf1afcad9e6f19e9abebfc9daf374909801d874c3d276b913f12d6230ec", "object_relation": "sha256", "Tag": [ { "name": "Cicada", "colour": "#47E440", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250109, "uuid": "d08f52fc-0dc4-4857-af7f-39aefaa0c494", "comment": "Malware payload (MimiKatz)", "value": "82e410f7c4e9ecf44831ffb4b9b95da44c104200", "object_relation": "sha1", "Tag": [ { "name": "Cicada", "colour": "#47E440", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250109, "uuid": "9369a37d-4c80-42e7-9587-98cfd62e93a6", "comment": "Malware payload (MimiKatz)", "value": "e0ce54da01e9e77649bdda77c6257d968c13d4eb7d719df71d3299bf6d2ea2b801e8e2e939a71b41563edeb90800839c", "object_relation": "sha3-384", "Tag": [ { "name": "Cicada", "colour": "#47E440", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250109, "uuid": "b130e754-c6af-4bf6-911a-d40c0cd92499", "value": "T183447D4AB2E10CF7F86262B58FD2C655D773BCAA0271C30F12A4425B9F67A516E1E331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250109, "uuid": "a5adb899-5128-42c1-966f-e15132be2b2e", "value": "f45213bb14f19bda4ad234a0aa52dbb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250109, "uuid": "e70eaf46-df27-4d27-beca-ffb0a932766a", "value": "6144:U3I/COn7P954jTCna66ZDG2+/McimDLiOil:KI/xz7m7ZRCn6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649250109, "uuid": "e7315b62-9f4f-450f-9d10-3d1bdfd00eab", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649250109, "uuid": "a1da0ee5-f4e7-4fcc-bb59-d88a526f5b9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250109, "uuid": "80b10ae3-ffba-4be3-94bf-bace92768245", "value": "20fc3cf1afcad9e6f19e9abebfc9daf374909801d874c3d276b913f12d6230ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97898c02-b5e9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649277541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277541, "uuid": "60c5814d-9f29-4b62-a282-c0d161b47684", "comment": "Malware payload (Mirai)", "value": "b9bc8979079afbe281141e5fa5330e75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277541, "uuid": "021b10a2-a595-41c1-994f-3744a90c86ef", "comment": "Malware payload (Mirai)", "value": "21878233124786a3e21657a0dd2b4ebe6a995fe7aa29984bb7b352ae76a4e871", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277541, "uuid": "975483b6-319b-47db-a1d5-9e35be7cb790", "comment": "Malware payload (Mirai)", "value": "7333adbd9e89660415caab06d188755302cde11c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277541, "uuid": "e446824d-10b1-4f44-94c7-cedc3eb1f0f0", "comment": "Malware payload (Mirai)", "value": "b36aabefa96c0d8147aa913baf924245078921cc90e1c31cc450765c4552d7577e43c623ce8368a1913f3333dfdec9f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277541, "uuid": "811218b4-2698-4825-8e80-08f56a67a895", "value": "T15C337DA2C16DEDA8E1108A74BD254B789713E100865B3EFAD7C4C65A8047EFDF2487F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277541, "uuid": "2664f720-19ab-4b95-8848-15ece69b53a6", "value": "768:qvgRGwtamXt5vxkxbeH9+tdvmGmwGwyWfs3IClU/UOWCUoeBQCj:UKGwtXXE1PuGmwGGfs3LlU/7WwiQCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277541, "uuid": "205071c9-2b2e-4db3-84e1-1d83d65d30c9", "value": 52644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277541, "uuid": "1e8b6526-d833-4ef7-bf09-d1ec13e20f5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277541, "uuid": "5b004af3-246d-4aab-b2a7-5beed88f772d", "value": "b9bc8979079afbe281141e5fa5330e75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a13620-b5c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649262452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262452, "uuid": "1fbebaeb-3dfa-4c22-b4ab-1de8f6bb3fe0", "comment": "Malware payload (AgentTesla)", "value": "23fc161a9b7dc8dc2f0826fce27129eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262452, "uuid": "44086c4b-4362-4618-a84c-22c906585154", "comment": "Malware payload (AgentTesla)", "value": "21c447455a5cbe9c8589bb9f14a44ad9d146567a1990efef199f0741e046de6c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262452, "uuid": "8f3fb9e9-c6e9-4e52-8e88-a60508de1d4e", "comment": "Malware payload (AgentTesla)", "value": "5b9e7937ee95e8b6315d45a018e766fe999c5a27", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262452, "uuid": "433d58d1-72b8-4469-a09e-7ef7f82e393b", "comment": "Malware payload (AgentTesla)", "value": "a933d86573b0d5c115e124ddfbed15db48b8afef529636222039b6bce29a998864b20023f7228bc3f887f7406b89ee1b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262452, "uuid": "9bbbbfb4-3575-4caa-9cbf-4ae706c66777", "value": "T16A1402AC3130D636F2D1EDBA1B4296C29E4B8CB01B5769487DEA316E37F143E58B0D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262452, "uuid": "3225099f-d64b-46a7-be08-3e3ec6a58744", "value": "3072:Z95jDmb6VQVZGEfg7YMJmPjfZJpi1YiietOu+PQyGqP+:RjD62TEfgdJmPjfZ7VstQPKo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262452, "uuid": "c9e823b3-bc6d-4611-a7b5-e5de70d0bf9f", "value": 192120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262452, "uuid": "06ff200c-a520-4fa7-a1fe-46f221847f91", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262452, "uuid": "7eb6e6aa-d18e-4e59-81e3-266a3841dbc7", "value": "Swift.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f1c860-b5dc-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649272039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649272039, "uuid": "3f44ad93-78c8-4cc4-ab65-abad22a521a2", "comment": "Malware payload (AgentTesla)", "value": "117ad95874d0ccf6b07018ceaab2e89d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649272039, "uuid": "ff470327-f7c3-4558-82b1-6fa10d0be7ff", "comment": "Malware payload (AgentTesla)", "value": "22363a93cfc60354c16166d43ba99151a041696e2a77361bd34b49818dd210d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649272039, "uuid": "0f1d4a68-3c5d-4b22-b5ca-0b839e004cf9", "comment": "Malware payload (AgentTesla)", "value": "41e6fd7b6905b4f0b865f772b6eedca7f5d84db5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649272039, "uuid": "382a0984-3b5a-4745-ab1e-7643b5e3cc3a", "comment": "Malware payload (AgentTesla)", "value": "3ae61562ba805a3c2f06955d352ff6c8b221780d00161c8451ae594cb52da51c4423d3f45b347b6a9e1d70c6416814c3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649272039, "uuid": "c3d71d93-a98d-4570-9f29-80707d857195", "value": "T14535485813AB1F8ACD878A7F5650C1B147872E993E90558C8ED92F73F4B6F1A0A1E4C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649272039, "uuid": "9f2aad4f-72fc-438a-95a0-25a083def49d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649272039, "uuid": "e962259d-1733-48c1-b0b2-5b636e9313dd", "value": "12288:Ej0DEgx/s7+nGAHrlSFDnBHpO02ZpIp/7zajoWXZSBcCfRgtkgrr3aYqfELoRTFt:20vRs7KFMFDBHpZMpOujxXofKH3iT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649272039, "uuid": "e4dd1279-d647-4d52-93bb-1fe142106a12", "value": 1098240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649272039, "uuid": "aa61f7d4-a333-4abb-80fe-45abb59bb3fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649272039, "uuid": "7c8da6dd-6180-4127-8cca-9140d0b25790", "value": "Fill Beneficiary Details_pdf.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01569b54-b586-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649234769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234769, "uuid": "3747815e-09c5-4a0e-95c6-590394135660", "comment": "Malware payload", "value": "b1b2d840ddbe4e2170fd39b627c38ede", "object_relation": "md5", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234769, "uuid": "9f6dc0d5-627e-45a9-9424-4475e97e088c", "comment": "Malware payload", "value": "22facdfee7619d649d29a935bebb9bd51f73a90b9ca1e5a681e88205ef7c9d42", "object_relation": "sha256", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234769, "uuid": "854d907c-f774-41ea-b24f-bf5f8a37f84e", "comment": "Malware payload", "value": "5bf65dc35a0d730d5d062cfff2338ef704395eda", "object_relation": "sha1", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234769, "uuid": "ccfb0bd9-f1d2-479a-8e2a-9b61c8ed68d4", "comment": "Malware payload", "value": "119698bba380adbe6bcc2cde746072736f3a143ffb833ae417506c315157659ef4178ec30b3d7ddf51e01a02d446b3a7", "object_relation": "sha3-384", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234769, "uuid": "db28d78f-04b5-46d0-8285-7b2b7cfbc4aa", "value": "T17644237FB7A657D0CDE1EDDC238AC12F12BD08651CBA027F8519A8A7C6670709F09D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234769, "uuid": "a167edc0-1ec3-449b-b7e5-ea7e0f8c3a3e", "value": "6144:H4U8IxO9kmMH3B01TvIcVkMM9hgkcF+fAP4ytQaZQc:HBxxOudx0lvnVkykMosQaZQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649234769, "uuid": "1812b568-622d-4b0c-9fc0-cd355294a41e", "value": 254080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649234769, "uuid": "274dbee2-354e-4062-9c02-2e2f913f4590", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234769, "uuid": "8438373e-0fa5-4718-b7a0-47b564df2f33", "value": "312c341d-6675-4d2c-7b31-ccedae5d6d9b.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b57b7e00-b5a9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649250104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250104, "uuid": "c3b45750-0990-4bc8-bfe5-c3a4e785002e", "comment": "Malware payload", "value": "bdd548819f74096d2de4a468f987b1f3", "object_relation": "md5", "Tag": [ { "name": "Cicada", "colour": "#47E440", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250104, "uuid": "6cdb043d-fa03-4c5f-b3b1-6f0d5c96a1ed", "comment": "Malware payload", "value": "2317d3e14ab214f06ae38a729524646971e21b398eda15cc9deb8b00b231abc3", "object_relation": "sha256", "Tag": [ { "name": "Cicada", "colour": "#47E440", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250104, "uuid": "70e6c89d-e0d1-4835-8985-76b389698cf4", "comment": "Malware payload", "value": "d8b631c551845f892ebb5e7d09991f6c9d4facad", "object_relation": "sha1", "Tag": [ { "name": "Cicada", "colour": "#47E440", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250104, "uuid": "8e4fcc73-0310-4874-9888-7a1c2899f136", "comment": "Malware payload", "value": "03df84664131447fac06f288205121829d543422fc13ab1fc9533c5a4462b4952f977503572721ccf1a9c06b6505bf6a", "object_relation": "sha3-384", "Tag": [ { "name": "Cicada", "colour": "#47E440", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250104, "uuid": "a3de140f-901c-4a02-9592-3ed686f35359", "value": "T1D6A37C073BA805BEC217C238C5D34A23EBB1B44513355B8F5258CAA69F177D3AE39762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250104, "uuid": "b4df5ae0-35c6-49a4-9cb8-dee2a9daaedc", "value": "2550873a74f108f54ef426f3df09bfc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250104, "uuid": "27c51905-80ba-4a5b-8c67-76981275df96", "value": "1536:eDkuGzBdvIxCR3kl05A0yH9Gc3Kp3TLYJylu8FUkqEmNqIY5dmv7Cz:e7GzTR0q5ARhap3TsJMuc8fNrY58v7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649250104, "uuid": "a20e2eaf-e435-4792-8934-730ab7606144", "value": 101888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649250104, "uuid": "333eec52-ad0e-41d4-9b14-ff4ed1e9e3df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250104, "uuid": "2219f41b-fff8-4f74-a99c-7f0698360aff", "value": "2317d3e14ab214f06ae38a729524646971e21b398eda15cc9deb8b00b231abc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e46eb6-b5e3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274795, "uuid": "fc15b03f-2e4b-48e8-a8da-7a509698cfdc", "comment": "Malware payload", "value": "8b690939e8e01dfeb8da50ddb94f451e", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274795, "uuid": "f91f3b06-65c2-4bae-9f60-836d257be534", "comment": "Malware payload", "value": "231bdee63add7f057f97d949c82c18e4498a25158640778b3667500e7805d8c7", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274795, "uuid": "ccaa615c-c3f5-48f0-a6ac-e9a26dd1937a", "comment": "Malware payload", "value": "81b782248bfb9e501dc2320a20a5aa23373ab37f", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274795, "uuid": "1524a51d-b525-45e7-af9a-aaf223d0230f", "comment": "Malware payload", "value": "f9daa7934f067ece7b2387f94206b956b3ab64f64e4b81adc7b6ad36047ad610d9855394f0819b19cc18923cca37f162", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274795, "uuid": "5255482b-9a85-4446-a824-faabaf6e1bec", "value": "T1B0A5331169C007C9D594D9272F8CE936147BEBC63864F9E353F29EE2204EFC5E9A2874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274795, "uuid": "80e3e0db-d282-43ea-bea1-dc3b1c8cba0e", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeB:G1wwAjzIQOMK2GNKsln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274795, "uuid": "3776d9a1-cfb3-486b-8d59-834e8a884ecb", "value": 2121728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274795, "uuid": "f1e8a688-9e59-4b68-aea0-228dd48e31d9", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274795, "uuid": "098c561a-32fd-41aa-a620-7482b1b061a4", "value": "231bdee63add7f057f97d949c82c18e4498a25158640778b3667500e7805d8c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec0f930-b5c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649262682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262682, "uuid": "b21c539c-877b-4067-bf9c-928bac457521", "comment": "Malware payload (Formbook)", "value": "536fbc4f18bd12f9d50d7cfa782df5a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262682, "uuid": "219851f5-48f2-49cf-b599-e65a12687304", "comment": "Malware payload (Formbook)", "value": "232a16efaec47e6d4fc8f5318ed9d9d58198daef519f30a5d9147d38f293638c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262682, "uuid": "6f2ecc5c-8ec7-4590-8884-63734f778b47", "comment": "Malware payload (Formbook)", "value": "a2b995f1d93a78d61bf60d539d9abb7ea9e368fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262682, "uuid": "cbb3b9b3-1f62-487e-8d39-5e5d789331ae", "comment": "Malware payload (Formbook)", "value": "37173a7dc8c6ba321350f33f3155a4763a83f9dfc7d2aa83f0d48564ed0acc76409024a7d13171c268b6a5cadc84859a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262682, "uuid": "b7db58ad-ffe9-460d-8a3a-db176b8abd6a", "value": "T1F5F39F32D642C071E2B241F5F26D1B7B883E0D353355A0AAE7E11AE56EE05E5F42931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262682, "uuid": "b39723e7-e946-4a84-9edb-0d515e6f8585", "value": "3072:iSp2X23gWkg/dAMFewY+DV9kiYWc2+Wm8K3z5bf:iLgXaMFRXB9kixc5D3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262682, "uuid": "6605d1ff-311f-4743-b7a1-7ba264d44089", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262682, "uuid": "3a2c70e1-feef-4cf4-80e8-a3aa14d1771e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262682, "uuid": "5a8089b0-2917-4f42-b2ce-837eb3666570", "value": "536fbc4f18bd12f9d50d7cfa782df5a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d28b3493-b5aa-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649250582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250582, "uuid": "2c552fef-4e83-473c-b666-32751272440c", "comment": "Malware payload", "value": "8ffbf1beee419a4be32269eebd13927d", "object_relation": "md5", "Tag": [ { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250582, "uuid": "7430b532-bed8-4509-87c2-9b46f69e2694", "comment": "Malware payload", "value": "233c2f58400276a405c06b4203423e3008c1f1442f6cb9c0aada193bc3ce4b56", "object_relation": "sha256", "Tag": [ { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250582, "uuid": "baaf03ba-a776-49f5-9ff9-585ce3d7c019", "comment": "Malware payload", "value": "b6151607b51f7a512ec6398ae620d2d1c0a512f5", "object_relation": "sha1", "Tag": [ { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250582, "uuid": "2a46cfc4-2733-499c-b907-dd797882dcd8", "comment": "Malware payload", "value": "cc0c4ca2a4c3f8a285b5b7257f17352d8ef643ad020c2996af1bee928de2d886fa31d1f94750680a246dbc637e213232", "object_relation": "sha3-384", "Tag": [ { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250582, "uuid": "e6369c42-a861-49c8-8254-822ef4fd4d66", "value": "T113452333CDC127F9D6EEBB43122DBEDF83F927506CC6AC92139EC29099A5864501E25D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250582, "uuid": "fbb8435c-2565-43a8-a9c0-4b1c156f1f4d", "value": "24576:MzYBdZe6SPbPwOWD8KjVY2fkwr6Sn/Wf7iFPaXqhBbAMpYBIIoPbTI:C0e60E8AYIkhSn+jiwqNpdIII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649250582, "uuid": "c6739ebf-e09e-4ae4-aff4-901ee53128d3", "value": 1233562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649250582, "uuid": "f9f70802-a0b5-47e9-846f-82e1a0af4e71", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250582, "uuid": "d91a908d-f937-4430-8876-29140dc7fdc6", "value": "SNC-1860029492-Apr-6.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57b46072-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277864, "uuid": "ba971ae5-45c5-42a5-b0e6-39baafefa7ca", "comment": "Malware payload", "value": "d007539b81ebedbd56219fcb5efc0129", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277864, "uuid": "0e2b5be0-803b-4812-89b4-9410cd2bdeff", "comment": "Malware payload", "value": "235b0010c013148225881de553e74723fc0ead27e39233c2bc03f91c9873cfcb", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277864, "uuid": "ae2a1680-537a-4def-b3c1-946c3cc705d8", "comment": "Malware payload", "value": "4d580413d5e05b0b171e521b01f02cc9f02929d6", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277864, "uuid": "f51516d2-45c7-46cc-be7a-d14015473b45", "comment": "Malware payload", "value": "66b52095c4b06447d7e450bf316a3e5d929d67a54500122c735f96e1a982d8aad105d6b6f555d686325c41be9ab8a227", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277864, "uuid": "6a997d84-5112-4378-9c18-51a36d557eb2", "value": "T143F533109AD112C9F588C92F1B9C7536053FEFDE38B4EEE381928BF5040FE85DAA2565", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277864, "uuid": "0759b9ca-49cb-4345-8d98-87ddfe99b00c", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXGfYQvqE9c:G1wwAjzIQOMK2GNKslgus10Y1/Ui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277864, "uuid": "23fb87d1-a8a7-4f63-a6f2-88b0cde078b9", "value": 3391488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277864, "uuid": "ebd693ae-44a6-472c-bd64-da036f20fa25", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277864, "uuid": "e076985b-9ae9-46f3-8053-f1a5f0ca79dd", "value": "235b0010c013148225881de553e74723fc0ead27e39233c2bc03f91c9873cfcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a387058-b5b1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649253333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253333, "uuid": "e0ac47c2-56b0-4fc6-bf64-fa6c9a17da47", "comment": "Malware payload (Formbook)", "value": "e5ca4e9b98bb8bea3c98327827243f94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253333, "uuid": "2a5ee7d4-240a-4d30-9b7c-42f59c1754a1", "comment": "Malware payload (Formbook)", "value": "2385821f2732aafbdf3ddde31c314ddfaad694ad9261e4b40961b61a1a78cf64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253333, "uuid": "01fd4b80-b7d7-42af-ab5b-7845a615f8b5", "comment": "Malware payload (Formbook)", "value": "c236a8324cc19b40d8149f3939385a7f8339023b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253333, "uuid": "7eca5fd3-04f7-40d6-8584-8ea9f33ca0e6", "comment": "Malware payload (Formbook)", "value": "98b0d3b37dfdb6a516a832b6478a393bbc00281bae3fb489c0fc7cd8c3598d427a452b2d698f8c406980fdbe025e4e21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253333, "uuid": "9f3ecf3d-6633-4d4e-b9dd-de25c75a1087", "value": "T10CC49C72F3F86F0BD2BD4171442950597AF2E9133634C99EBD9A21DA8DE2F014720B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253333, "uuid": "cf8a9c9b-789d-4bec-b22e-c94b22db95e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253333, "uuid": "3629430b-172b-46d5-a602-003b20a06d2b", "value": "12288:LSnNHDD2+WHfsWKb5fkusS+SCDUSqGXmJuA6hzVxBV9E90Jsok+4:aNvn+DR/WLgpE90Sop4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649253333, "uuid": "3702f38a-ee6a-441d-9f66-5d390da9e2ac", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649253333, "uuid": "25e9a4e6-c84f-4897-a83d-98776b322fd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253333, "uuid": "c3a332f3-35eb-41d9-ab99-99c2e26bed36", "value": "Vjw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb59e001-b5c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649262649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262649, "uuid": "5553bbf4-ec5a-43ef-88dd-b18431e15af5", "comment": "Malware payload (Loki)", "value": "ee1c970adea422e2ffa2e8f9c1aeb34c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262649, "uuid": "7c2ffd28-b136-4349-91ae-97458ef074ec", "comment": "Malware payload (Loki)", "value": "238e4bbbb6bbf5dd9010fef402aff89296f0b8fdf0a3f66fd384c875b5fe6ac1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262649, "uuid": "2a35e740-8217-4c36-ae10-0e2834af1085", "comment": "Malware payload (Loki)", "value": "09f9a58860e2a1fabb284fe0f82bc901a381b814", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262649, "uuid": "8a124deb-2091-42e0-a980-586a271e03d2", "comment": "Malware payload (Loki)", "value": "3cc1fe675b4373a6ca784e3a04f0b0455e1c45b138effc08cc8070c7cef743ffcf73f381e0200cb9bb7115df734983b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262649, "uuid": "829fbfe1-0fe4-4e6a-bd00-3b21e116b424", "value": "T1DC34020926A4D0E3C9F30BB40D7B6777ABBAA1062471474B3B101BDE763B3869E5D721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262649, "uuid": "eb0fbd5b-50ef-46e7-be7a-3f6f5805e855", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262649, "uuid": "269c3ec9-6504-4566-ae7c-d0e17a0cca1e", "value": "3072:l1NjcVVnLpPunbuM4iU5rDqcBVuzaQe4v1Ak32G9Mh4evfBYkh4rvmpanDIOVXqy:HNeZmjS5rDKzaxk3jqiSxhgI0IOXqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262649, "uuid": "953e131b-65c6-4b3f-85d3-67efa70e3dc8", "value": 241324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262649, "uuid": "143f1309-3c85-4e4a-a170-6c9808412cd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262649, "uuid": "cd3be359-076d-412b-8bce-4c6198da7923", "value": "ee1c970adea422e2ffa2e8f9c1aeb34c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f36beb-b59f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649245511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245511, "uuid": "8337c0ad-9713-46d7-be4d-ecd8cfed39a3", "comment": "Malware payload (Formbook)", "value": "a778a140a644dc7fa4e2ae0bfe45e0e5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245511, "uuid": "dc27b6c7-b536-4c7e-b214-ee058da2857f", "comment": "Malware payload (Formbook)", "value": "23973a47f42723d89b65a45b84487832e4dd3098464e29247efde2be101bf12e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245511, "uuid": "95e594d7-0a0c-437a-b413-0726aa3ed7de", "comment": "Malware payload (Formbook)", "value": "0e8f508730e7856b9396d72b1d24082c7141257d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245511, "uuid": "bac71edc-0f3c-495f-b681-46a9723fb83f", "comment": "Malware payload (Formbook)", "value": "ac6bdaafd1e60b49294e3e7a0da18eda487b1aa8ea367cfc0eaff3fd3dc01a8e19c3cdbf67719e03baddb176a1172c6e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245511, "uuid": "b7be8b0c-741f-4abc-b650-94f4d731d30a", "value": "T1BDF1BFAD9187F22ECE686AB19734570CEE61149DF40343040F255A738C9B74F83CB9C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245511, "uuid": "cd52ee42-d706-469a-b368-e4e264304726", "value": "192:EvLWem+Rwpegge6JpV9EcbCNylctlyHtZt2:Qlm4VXbgyKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649245511, "uuid": "15097bfd-7356-4cb8-aa04-ea4b7052ad86", "value": 7478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649245511, "uuid": "9ba2901e-75d4-4694-91ad-13038088c3ad", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245511, "uuid": "7fde4170-bac5-488a-a4eb-d3a23797063d", "value": "0060422.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d74703e-b5e3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274894, "uuid": "1e8b20d5-1087-4496-b1c9-29805b50670a", "comment": "Malware payload", "value": "94552b9209e768d3a067ff64711f59ed", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274894, "uuid": "ad0dfc8a-b7db-416b-9a5c-93a33e229525", "comment": "Malware payload", "value": "23ac5c02d8c82426d36306c347c07d8ac6fdb9b5b2e4678942289890fe584d87", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274894, "uuid": "5c913626-501d-4294-875b-704998f9c5af", "comment": "Malware payload", "value": "6d0f4a2e720eaeda04cf098a634c55915efa0f31", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274894, "uuid": "74343b63-8efb-43c2-88bb-6a69ce5c995f", "comment": "Malware payload", "value": "78390d6f45e1b3c60ec7e60134fb5fa32322a7de3b67a99f4a484ae061b2c8cb52269c5a2e135336e9a666bd91ee944c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274894, "uuid": "c76f3e2a-5cf5-4754-a53d-33192030f174", "value": "T1A8A1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274894, "uuid": "c8fbf919-ee1d-4c99-8557-3aad310aa446", "value": "96:+RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:+RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274894, "uuid": "a31bf14a-d02f-414a-accd-b366a2aaa22b", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274894, "uuid": "b903dc30-095a-4a6f-b058-2358c9cabbc6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274894, "uuid": "396667c8-5888-4b85-94ad-96634206705a", "value": "23ac5c02d8c82426d36306c347c07d8ac6fdb9b5b2e4678942289890fe584d87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baabf684-b5bb-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1649257843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257843, "uuid": "41abfdd7-0a35-4962-8217-be6f0688b980", "comment": "Malware payload (AsyncRAT)", "value": "c11aee14da761b17e20a3780f5e3d5e7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257843, "uuid": "67fbc0d9-4629-4aca-9908-2e2ecc0bee35", "comment": "Malware payload (AsyncRAT)", "value": "2402e32aee88429d08f6ce90d96e242d157ebee722221f56928ed80d2b2af450", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257843, "uuid": "f34a7461-71b0-476a-af3b-a481c53e884a", "comment": "Malware payload (AsyncRAT)", "value": "7b0ddbae18ab568b89b05833fb49d98a180e644c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257843, "uuid": "f023e488-9586-4a7e-9b6f-586c22c4dd47", "comment": "Malware payload (AsyncRAT)", "value": "f19e1393eb0d48d99ca17137489b3ab921cef283e55e3726323399909e4c5d0613c8fd6d439eea23fcd064ba592aecc1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257843, "uuid": "faccd68e-7316-47d9-ade0-208e3d92eff5", "value": "T15A231A003BD8822BF2BE4F74ACF26145457AE2A37603D5492CC452DB5B13FC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257843, "uuid": "00037986-a36b-44c8-96d7-2baef7715b99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257843, "uuid": "e9fae243-15e7-4360-b56c-8230d81bc763", "value": "768:HunS5TgoqzqWU8M9rmo2qrrKjGKG6PIyzjbFgX3iVb+LtHVFBDZjx:HunS5TgNO2mKYDy3bCXSloVLdjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257843, "uuid": "919e734e-3636-4a7c-904e-e7f181ab6c89", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257843, "uuid": "b1f9e904-5c8b-48b2-99d4-b3bcd0c5d4fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257843, "uuid": "677e1f2f-e6d6-4672-92c0-dd8cf17a24e2", "value": "c11aee14da761b17e20a3780f5e3d5e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d981eed8-b5bb-11ec-8e58-42010a9c0032", "comment": "Malware payload (OskiStealer)", "timestamp": 1649257895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257895, "uuid": "43188122-e427-4852-8909-3d200722aa12", "comment": "Malware payload (OskiStealer)", "value": "2df2bb4ba1e6580fa4368f8b2cf681fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257895, "uuid": "b830d60b-d288-43aa-821f-e63cd0ac422c", "comment": "Malware payload (OskiStealer)", "value": "24135e78ecf7c7e30984c0f38d381f528c2400f4b7f4a05d5c37bdcf9365ced1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257895, "uuid": "121c7f01-99ad-45a6-b114-5c066697bba7", "comment": "Malware payload (OskiStealer)", "value": "f47e87ba69f94bf626c27bde2708fd2686df203b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257895, "uuid": "9fdfa212-ac72-4ea6-ad26-c227b2f1fee3", "comment": "Malware payload (OskiStealer)", "value": "6ae5259f3f8a541f1a6974e4024501bef55d90b25906a73ae1ba296975be68727666a35d80455d64f428c1064c33b47c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257895, "uuid": "b7b9c2d7-c35f-4113-8500-07b527bf94d6", "value": "T1C0146D30B690C035E86310BCDDEE86BEB96C7A301F5950C3A3D45A662F712F27A71667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257895, "uuid": "057055dd-169d-4d4a-995b-78602499ebd8", "value": "7bb9d345a5fec4fbbf5100d6a3ffbb8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257895, "uuid": "5381b1ec-4cb2-4cbc-bcbc-350e0129d140", "value": "3072:WfUomEuYm98dlSq7gt5q7Dx+XgS6aCEwhOfUbCalNT2pbB3fIS1Xi6FLPo3c:WfUauY68uSWCx+XA7mg2pNX1Ljo3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257895, "uuid": "5b39fb21-dd8e-4b2a-a4a8-7a85f886a772", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257895, "uuid": "26a571b3-defd-414f-81e0-291301e9bcf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257895, "uuid": "d5a1278c-b3be-4a75-b942-a5562091d0e5", "value": "2DF2BB4BA1E6580FA4368F8B2CF681FE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2be251d-b5a9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649250099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250099, "uuid": "e5105d33-425a-4587-bd52-e748c350b339", "comment": "Malware payload", "value": "ddacd8bc05515fb92abaf2a9ebec76ce", "object_relation": "md5", "Tag": [ { "name": "Cicada", "colour": "#47E440", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250099, "uuid": "7e8ac5dc-ae95-47de-8bc5-03461b765d8f", "comment": "Malware payload", "value": "2417da3adebd446b9fcb8b896adb14ea495a4d923e3655e5033f78d8e648fcc8", "object_relation": "sha256", "Tag": [ { "name": "Cicada", "colour": "#47E440", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250099, "uuid": "f9e6b830-6939-4686-913a-dd1ee371a9f2", "comment": "Malware payload", "value": "a4b9a9edcca8f3eb39ecf157c10db7553e932a54", "object_relation": "sha1", "Tag": [ { "name": "Cicada", "colour": "#47E440", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250099, "uuid": "ee17e1d2-0600-4cf0-8638-361729abda08", "comment": "Malware payload", "value": "817f47e1b7e54e5e33faf068263c2cfaa0740baf19c4c523c86af6ff329962195fb52257e50005a346a896c897b9cf09", "object_relation": "sha3-384", "Tag": [ { "name": "Cicada", "colour": "#47E440", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250099, "uuid": "f0383945-ed74-4af6-bd27-ebf3cd861589", "value": "T110C33A0B336440B7E5A78278CCA34A45E772B46B4B76934F1364436A2F237A19E3D372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250099, "uuid": "84a7c83f-7581-4a7e-a5ec-d06257ca6110", "value": "74f8ed235bee357efd039be61138d8a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250099, "uuid": "86bfb3b6-991b-4102-8d1a-dd492cd29373", "value": "1536:a2ZkIN7r0BtcqTll7ezV3CvihxTzHndtaaNiXhoMh82HQlOosDc9Dh:a2Zr7em+P0V3thxTzOaghoMNnc9Dh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649250099, "uuid": "79fe7d0a-ffdd-4d37-b574-df38fbb4d1d9", "value": 124928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649250099, "uuid": "a286ebd7-e30d-4962-a0d6-9309787b753f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250099, "uuid": "09c49a85-3ab8-4143-915e-fe228e4407c4", "value": "2417da3adebd446b9fcb8b896adb14ea495a4d923e3655e5033f78d8e648fcc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841fed2a-b589-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649236277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649236277, "uuid": "21b86492-f483-45d2-a828-14810af6a8b2", "comment": "Malware payload (Formbook)", "value": "bb2e4ce828398324428b689193c218ea", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649236277, "uuid": "5719fc07-9836-46c9-bd10-a14ce42825fe", "comment": "Malware payload (Formbook)", "value": "2446c39e537aec1f6464b1411c91561776488f5576735e39b0145c874f0d8873", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649236277, "uuid": "40eee341-5037-40d5-834b-3aaf9e2770d4", "comment": "Malware payload (Formbook)", "value": "a8d9a2db4848e18fc867cee83c3b6a6b0a3782d6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649236277, "uuid": "b781d267-a18c-4d16-b6b9-83946cd11eb7", "comment": "Malware payload (Formbook)", "value": "e2e129e72339f4175e71dc59ea5ac82c1da3b99cb5eb2eb972e78969ad8fe84df97137cce4842de4230f179441ccd45b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649236277, "uuid": "0259dae4-bb94-4f91-82c3-d6f89605af8c", "value": "T1D9A423903D688F83D68707B81A476918B84AEC6C1B5ED38F42F931A711717FDED01B69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649236277, "uuid": "96bbedde-2464-4580-be7a-09f957e7c78f", "value": "12288:vU06KC6hzx7rXcANlz2h3M2oSQa0AbxRJbjkS:sODL77LN972T7lDbIS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649236277, "uuid": "fcae9e3b-2913-4c38-a21e-841e3b5ffc08", "value": 469832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649236277, "uuid": "8b9ea1c3-9d43-4765-8af9-861aa00ee8b5", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649236277, "uuid": "7e15c5cb-4a65-4c5d-b265-103931d22a6c", "value": "AC new order 04.04.2022.XLS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2da906f-b563-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649220061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649220061, "uuid": "2c560ded-8b0c-4820-ba8a-80cfb3bd2fb4", "comment": "Malware payload (RedLineStealer)", "value": "b8a24edd09e88d98a7b5d15864a6defe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649220061, "uuid": "6b7e27ad-4e05-4a34-93c5-8f544b462b75", "comment": "Malware payload (RedLineStealer)", "value": "24b88485432cd46d73457a9dfb7e4713ded195a1a5f420824c078d5f97376581", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649220061, "uuid": "850f31f5-d2c2-4213-ac61-e0b5d9393262", "comment": "Malware payload (RedLineStealer)", "value": "f3d25c837afe9def1e2085cb89597f1fa9d6a447", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649220061, "uuid": "533600fe-464b-434f-b3c0-6d7203a52f43", "comment": "Malware payload (RedLineStealer)", "value": "84ad6e4d5c0683cbab048ead0204f39761ea80e133ba1c6c895906c2e4ca7d536ba6b003db29419bb126344122015e42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649220061, "uuid": "ba13499f-5d21-4939-98b3-6fc3047d0c91", "value": "T1C494F1C672929471C0527E316426CBF0257F7C71E6709A47F7B42B2E2E703D0AAB2B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649220061, "uuid": "e7fbd3e5-8c52-42c7-8ee3-8e2ef37a192f", "value": "c573cb6c93cba3d870a0445c3d1cb654", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649220061, "uuid": "c50f5023-b80c-4175-952b-b71bf4181658", "value": "6144:zWETvb3st7oZtCtrwL6tn3kISQaOTIbjOjgi146IlwqhS0Q7ITsq7iga:zWETvbRZUnEN6gVQ79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649220061, "uuid": "adb4c265-ea98-42a9-8e6b-755083ebd354", "value": 419840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649220061, "uuid": "0597039c-8953-4b49-8bfe-e293475ca912", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649220061, "uuid": "86f474c7-38df-424e-b5ee-16fa7a563bdb", "value": "b8a24edd09e88d98a7b5d15864a6defe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d2073fc-b59f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649245580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245580, "uuid": "68a3c979-607d-4547-bb20-717b97ef4020", "comment": "Malware payload (AgentTesla)", "value": "6ee0c8e45ffbd04e1effbef061f01b2d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245580, "uuid": "bb81a37c-86d6-42b2-957b-900b4a18526d", "comment": "Malware payload (AgentTesla)", "value": "24f55e34af7010e53d6a0995e548eda8eb3adfc74de7ad01234d54ca2faffe97", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245580, "uuid": "b6893805-846f-4594-b34d-11e2f01a7830", "comment": "Malware payload (AgentTesla)", "value": "a75837469515d99570c913d9d69a7446f0d1ee1a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245580, "uuid": "af213f8e-075d-4845-8f26-f3b57b65d440", "comment": "Malware payload (AgentTesla)", "value": "e43c0088803c3e22e1106d558ca60604907c4e288b6c3970e10d9571ee619b712fab99e0758c2d0f778245f1e575b5e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245580, "uuid": "fe3e240a-3299-430c-8f71-ca288897f333", "value": "T191D4AD72F3F86F4BD6BE51714038501979F5D9133224C89EBE9A21DA8DE2F424720B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245580, "uuid": "dfb06d1f-5c9f-479f-90e7-3ad50c5d14d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245580, "uuid": "b139091a-b000-4155-96d0-691526aa6877", "value": "12288:BqHFTSXW2CDeMWyHlf97wcSD6aG/So9OcNZ5ZSpcRMYkVFqoM:sF9kXuak9kp7Yj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649245580, "uuid": "74209eff-cbf2-4c06-958d-4946b97b6c3c", "value": 601088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649245580, "uuid": "2f61541a-2cd4-4286-9974-b7df68a5e6c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245580, "uuid": "1d8b415e-f53c-4e79-9e6d-4a5b302700c9", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae40db2f-b5b3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649254386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649254386, "uuid": "20e0b533-a3a2-4296-868c-4460d438d80c", "comment": "Malware payload (Formbook)", "value": "ee5ea5837b69cde2ffa64e63296ac32e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649254386, "uuid": "3ad4e01d-1256-454e-89e9-0904fcf5ce0c", "comment": "Malware payload (Formbook)", "value": "25c9de9dfbbf115f5809dbbf9e246bebfa8b1925e99f070fa6233ad62ee22b9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649254386, "uuid": "6901f9dc-ead2-4dfa-b762-a0a5ad4b752e", "comment": "Malware payload (Formbook)", "value": "470e086ac8d4076225c34b1db7b8fa300078fc75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649254386, "uuid": "d24ed90a-5647-4083-9fed-dcca1b983d54", "comment": "Malware payload (Formbook)", "value": "ff3f2e17670fa14cf8ccef44272d8eb2382caef510cdf4604191ad681d167154fc8858e1db5bf3199d3438f54c4dc299", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649254386, "uuid": "e750824f-e9be-400a-a46e-77bd9ff0019e", "value": "T144341211B3E8C877E5E51B329ABD626A2DF715222AE0670F1B404B6D3D51B42D60F733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649254386, "uuid": "0fa1ee97-84d4-4fe1-a893-01f15540bc49", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649254386, "uuid": "7589c339-a19f-4033-9bc0-ff5bcfae67e6", "value": "6144:HNeZminVlavLbwgxjih9eo1AbJeFlZCP7IACr3vtwU2:HNlinV4DFxjih9eo20lkPfCr/twU2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649254386, "uuid": "c685d5d4-0064-42d7-bbdb-41186416e549", "value": 248681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649254386, "uuid": "fc7c23bf-01e8-494a-87d9-d63c58a2675b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649254386, "uuid": "529fda0e-2039-4708-b04c-3f75741b5085", "value": "facturer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a71e0f1-b5a2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1649246944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246944, "uuid": "7fb68baa-193e-4e07-87b0-0ff28efe8207", "comment": "Malware payload (Stop)", "value": "6160e83e331e9dacfc8bdeadae156595", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246944, "uuid": "37eb542d-3cc3-4b19-bb45-245444b9507f", "comment": "Malware payload (Stop)", "value": "26732fab7a1410e958a80a6e776504f3f850cd8ce133ab8aab515af8bcea547e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246944, "uuid": "cd1119a9-8530-4c9d-a7b8-5fb64a0b07cf", "comment": "Malware payload (Stop)", "value": "4715aebacbcd4465261bd27b41bdc047098775ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246944, "uuid": "e69c9fcb-c937-4e82-9dc6-38add058c7c8", "comment": "Malware payload (Stop)", "value": "0f2a2eb23ddae3a9966166a1f4bc24f894f9500bca9c105a500023cef8e18fd7c55a8b2ae6deb4176ffd04ac4437e9bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246944, "uuid": "6915c325-bb27-4fa1-b370-8df0cc031cb9", "value": "T10A050240ABA0D03DE2F311F879B5D3A8652E7D615B3064CF23D566DA2231AE0EDB531B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246944, "uuid": "2ccb4fa3-e568-4432-91a1-2e4dd5fe0d6d", "value": "d79bc79af6a4b9fec8512e1b410ce947", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246944, "uuid": "a6fc2e2d-be05-4f46-a220-41920fd49c8d", "value": "12288:lDj8z5Vz1oX3QjWQjZZakEhp/b9GXoWtgmu6Senm/CKwkJQrZKZN9schPaB79wZk:VOVRAoaDXbIthuSm/Wki8N9scUEZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246944, "uuid": "9aa2b8cb-c054-4836-a7bc-85cd0cd1c54c", "value": 827392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246944, "uuid": "c988df33-0d2e-4f81-b2fe-fe781f909f12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246944, "uuid": "077b6046-1970-48cd-8f7c-6e76d60495f6", "value": "26732fab7a1410e958a80a6e776504f3f850cd8ce133ab8aab515af8bcea547e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68fb9b31-b5e3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274886, "uuid": "982531a9-7408-44ef-b86f-273e706560ad", "comment": "Malware payload", "value": "ff5b3ca67e509e5cb0aaaa68935ce6c9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274886, "uuid": "6dcf2f2d-83dc-425d-8a65-afabae95f711", "comment": "Malware payload", "value": "26a9bd272a2ae894d9ac2f10aad91cf51752098ab7795464ae210bd337829753", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274886, "uuid": "32ccea71-acae-4350-b1c0-8ebe203b6acf", "comment": "Malware payload", "value": "85b23e1843757f4fe1ebe3e7e45f88e0a3e0b8fd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274886, "uuid": "292d93d7-8040-495a-89ad-2fbc2c61ce41", "comment": "Malware payload", "value": "5fa78b28a309260bd2e54db1feb6f4c474bf405a74b5b09167cc1b4bb995f13d2684d99c9b806c9b94bd7d78fe890f6b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274886, "uuid": "14958ec3-068e-4142-9904-7c2277c51936", "value": "T1F8A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274886, "uuid": "43d4dde3-e7b6-4aa0-941e-de3be6882349", "value": "96:KRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:KRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274886, "uuid": "15afecd3-6f3b-42fe-8c80-e6716c4dbcb2", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274886, "uuid": "d4fe8b5c-e398-4fc3-a5b8-d3ea9c2779f3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274886, "uuid": "25e79663-0e50-4bf6-b244-4895f128ba27", "value": "26a9bd272a2ae894d9ac2f10aad91cf51752098ab7795464ae210bd337829753", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab1b1aa-b5e3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274755, "uuid": "e0e9f546-f9d4-4466-835e-a10b1fcf3af9", "comment": "Malware payload", "value": "e9719bc1022f1cfee47b82d56c3459a9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274755, "uuid": "5bd36f07-d4fc-41de-aa04-fa2e14337034", "comment": "Malware payload", "value": "2759f514dea823b28c8319d3985ee488e70d0f66778d67e8b1484c4f75f1b299", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274755, "uuid": "3e7e208a-3974-4cd8-94be-743955971a7e", "comment": "Malware payload", "value": "36d861018d909430e7617b5c80fdf16fa0ec7cb6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274755, "uuid": "06a06440-a926-45fb-870c-419afe07672b", "comment": "Malware payload", "value": "617f598bc323350e7d7ba60f618b53e604ba4cc0f553712e9f532b6bf22cc88b48b56a81a1441ac69928fc51043b8c56", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274755, "uuid": "2de1fbf9-b68b-415a-bfcd-22d356678670", "value": "T1A2A1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274755, "uuid": "3bfda4cc-1353-4770-bd6d-c062b2fe5ee9", "value": "96:jRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:jRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274755, "uuid": "af3f0c85-95a8-49f6-a909-759b4d2d5bc3", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274755, "uuid": "bfa93f1d-e53a-4058-8bc5-bf735122667c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274755, "uuid": "ced09e0f-65e6-4c56-abab-e7b1ac4edd6d", "value": "2759f514dea823b28c8319d3985ee488e70d0f66778d67e8b1484c4f75f1b299", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abcb6c0a-b56d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649224317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224317, "uuid": "e3c34b29-4e6d-45bd-9159-f82b92a47468", "comment": "Malware payload (Heodo)", "value": "1dec36bbe3c1985d7501314d4e450574", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224317, "uuid": "4a9c5cd2-e196-4f91-b9ba-7c18f02cdf24", "comment": "Malware payload (Heodo)", "value": "27aeca32e6f41ecd651b6f4552310e78a2251183eb18df7c13779ce02154deb6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224317, "uuid": "0ba7d04b-df29-4c2f-b073-755827d9216c", "comment": "Malware payload (Heodo)", "value": "57e3dd72b82aa790f0bdcf771f5df4a9da61d763", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224317, "uuid": "5492df53-0ede-4eeb-9379-adb0adb78f58", "comment": "Malware payload (Heodo)", "value": "471313d21f9393b0449815673b0db5091843de85b0f0ff6051943fb3e5fdc2aafa04c7b0a31a2915ca6fc73126d34242", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224317, "uuid": "22980f57-0e47-4e17-a8ec-7c810980b4b0", "value": "T1BBD49C073491C07AD2EF12708E46AFAEA7F9BA108F715AC3BB804B1D4E759DB9736114", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224317, "uuid": "a66c7df1-e3af-42b8-8a7f-e87b0f3ef08b", "value": "078cf8e17700d87242408b8588acd2dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224317, "uuid": "5fd18752-6770-4c5e-809f-2838e1ea4997", "value": "6144:y7k2Lgb63B3IjZbdup5yEqWQUM6xWtgD1MHqVsYNwKb2azO8DFyhN:y7pLgbqIjZbwqHUM6AySrYj2azO8BON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649224317, "uuid": "176e9424-3f99-44b5-92a4-70794f319633", "value": 609046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649224317, "uuid": "8ab8616e-0140-4d52-ac45-de517929879b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224317, "uuid": "6dc1c066-776b-4655-8b0a-bd77a31f6c71", "value": "emotet_exe_e5_27aeca32e6f41ecd651b6f4552310e78a2251183eb18df7c13779ce02154deb6_2022-04-06__055153.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dce91dc-b5a2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1649246923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246923, "uuid": "9e558b22-cdda-4aeb-98f8-b261a35a9d0b", "comment": "Malware payload (Stop)", "value": "f883e173cf2d69e250223f96e50ce8ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246923, "uuid": "ff3cb861-1a1b-451a-a335-2df9f2fc3df2", "comment": "Malware payload (Stop)", "value": "27ecb95e187582157ad96d7731f49aac2799482d731171b61d25f1ef105a80d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246923, "uuid": "51e34331-6cd6-42db-8863-67540a7f98e4", "comment": "Malware payload (Stop)", "value": "4e8d3409df88d57718928fe5f8a374194bddfa3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246923, "uuid": "82531ce6-998c-44eb-aefe-50af883796af", "comment": "Malware payload (Stop)", "value": "36f1329899abc0e978eb6af3e05695258c4db4551cf9c72cca015fab0e9e513505150f8d68b98f323483450c3581a156", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246923, "uuid": "55635bbf-0cc5-46e7-944f-8bf2fd8f60f9", "value": "T1690512D53283F433C1643D32A5168AB1447B3C62E57C6917FF78672E2AA13F0A9B6706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246923, "uuid": "caa0e295-ef04-45eb-b757-7902683d84ac", "value": "3e1371bce2a7dabfc48c6aff7cfba706", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246923, "uuid": "350592e6-cf8a-4f75-a2e2-4a87191ccbae", "value": "12288:2HCRLAHZP4hOjhkNcSyiBPngshNG5DSjhtjAc4xSFIZPVcO2Of1MrewNAcH8Q79J:2HTHJ4hQdnaI5DSrAljVcO2OVkAhaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246923, "uuid": "4bbfa4c9-6fd2-4f43-bbac-ff06e5304275", "value": 846336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246923, "uuid": "a787f33d-d2de-44ee-b87c-6fd6adadcaae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246923, "uuid": "e3c3c54d-0655-42fe-b3bd-cb8fefa8baac", "value": "27ecb95e187582157ad96d7731f49aac2799482d731171b61d25f1ef105a80d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9c16622-b5b3-11ec-8e58-42010a9c0032", "comment": "Malware payload (IcedID)", "timestamp": 1649254433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649254433, "uuid": "df1187a2-2d2e-4bfa-81fc-116c686cbe8e", "comment": "Malware payload (IcedID)", "value": "afcc9432a35bcd5fb2cb4d003e88d812", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649254433, "uuid": "61210b5e-3533-42a4-bc7f-0c0f5a94baea", "comment": "Malware payload (IcedID)", "value": "283bd00e86dca8c2a389445ce8b695cf5545655bb99b8798e1c70f7a199b1ae3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649254433, "uuid": "707fb97e-c404-4457-a090-ed5069f67b90", "comment": "Malware payload (IcedID)", "value": "5e9d2898b4f4172efa0cff2e1aba62eb990cd3a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649254433, "uuid": "810d99c6-858e-48a4-a81d-47b91066fc02", "comment": "Malware payload (IcedID)", "value": "2ee11d33ab00e21e464a2a305630c15d215adc5f9065f676e9b2fbb10e23dd2ee0c254b67a30e40f6a516bd443cebe37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649254433, "uuid": "84e7b5fa-bbce-4d09-9f58-07084b47c96e", "value": "T1FCC5F957FAB250E1D4FAC2399252233BBA7175A9433097C39741961B0F22BF4AD3D788", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649254433, "uuid": "b577e188-4929-46f8-a03f-a60f26771863", "value": "05e4ef8ba47d6d3b41a3cd7e41013f55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649254433, "uuid": "cb647784-96be-4802-805b-431254ef4520", "value": "49152:jaV2I/iz18uEu7TAJRxbZc5OAzoJPy8ro:jafizmuEuHqbe5kc8ro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649254433, "uuid": "96fcf6e7-7410-4949-950c-0880ee953681", "value": 2641920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649254433, "uuid": "922d4e63-f406-4204-b933-215074e8ec73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649254433, "uuid": "18d6a74f-1220-4e1a-b385-dec9645da7ad", "value": "PayPall_Gift10$.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e83457-b5c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1649260063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260063, "uuid": "1b9c84be-5dc1-4099-a2a2-3596a3377211", "comment": "Malware payload (Quakbot)", "value": "b4675efb7af833494f30356b6d8e6578", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "TA571", "colour": "#E157F1", "exportable": true, "hide_tag": false }, { "name": "tzr01", "colour": "#8ED4F7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260063, "uuid": "b67fec07-316e-432a-8726-98819fbf8190", "comment": "Malware payload (Quakbot)", "value": "284947350f2b5ba8d274ce35fe7d4046bd5d60075a598b1f080ed415dfd9e322", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "TA571", "colour": "#E157F1", "exportable": true, "hide_tag": false }, { "name": "tzr01", "colour": "#8ED4F7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260063, "uuid": "5ee66f60-d790-491b-b7b6-0730f0fab042", "comment": "Malware payload (Quakbot)", "value": "4e73c869b53cb25ee01b5b2465f127916da513c1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "TA571", "colour": "#E157F1", "exportable": true, "hide_tag": false }, { "name": "tzr01", "colour": "#8ED4F7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260063, "uuid": "11c3dc11-e5ac-4d4b-98d3-1905ec8deb9b", "comment": "Malware payload (Quakbot)", "value": "2c40a723211d9ace19aa7f56219cb334cbb2f01e0d0d4f5db5a4e2ac77e1bf035b86c0d3ca5f0240086aaffb4234b2d2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "TA571", "colour": "#E157F1", "exportable": true, "hide_tag": false }, { "name": "tzr01", "colour": "#8ED4F7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260063, "uuid": "c24a2d22-4f18-4dd1-afc4-e14fe39f8a56", "value": "T1CA05AE71A2D294FFC1723678AC2A61909C35BE902D25CC8CB7DD1F5F4E3A682272525F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260063, "uuid": "9c64306a-d1da-4f1a-be45-b116a6dc9ba8", "value": "49475e98a322cf931bef4088d7fe32a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260063, "uuid": "2f2b5afa-db6e-4b32-a896-6715a9b3a27e", "value": "12288:74Z52dj02g1PG9kBQLCyU1jHItQOhcrga114QFdy4unYkAi5QVhP3v82xidH7iKd:Urj9RTyltQOhygaFdyHYkANb82xili", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649260063, "uuid": "538c98b2-abe7-47b6-9c99-4d6187b1e825", "value": 865280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649260063, "uuid": "31fae432-6337-4108-8ae8-642960276ae2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260063, "uuid": "ea89bbd4-6ed4-4017-b667-6061bbefd935", "value": "Glitter.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf5248fd-b5b9-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649257019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257019, "uuid": "eb25c53b-d6c5-4726-b051-f41d76e1e407", "comment": "Malware payload (SnakeKeylogger)", "value": "c41aea5bda8c5ad31bdf2e64cd27ff8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257019, "uuid": "4f69c304-8b01-4465-ad40-4e390a6d2da5", "comment": "Malware payload (SnakeKeylogger)", "value": "284c7dd976635486cf74de6ad9f0d7fd86ceee9f3d10e0260e2e918749e89de3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257019, "uuid": "4b075961-cc0f-4b15-be62-214a257e5b5b", "comment": "Malware payload (SnakeKeylogger)", "value": "b32fa0c072bab1524be3144bfddbc89317ed6d8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257019, "uuid": "4e16c45a-f0f1-4e07-821d-e6cac2330a1c", "comment": "Malware payload (SnakeKeylogger)", "value": "16ed28bb274610953ca84ed8f88981e51f11ee1b33b290411a024bb9e22cba0f2dcf027fc1851c1fb8c799af0f972cd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257019, "uuid": "b74937d9-9962-418b-a523-e0ccf38348e0", "value": "T1DDA4F11BB7847FA7D03D67B65171502003F9F9AB2A21D36F2DC011E8E766F452B09AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257019, "uuid": "533756a5-b4f5-4315-8373-6de01753b419", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257019, "uuid": "01c32aa0-7f27-4756-9bae-353b8dff5af7", "value": "6144:qovB5rgn99nEZS3bUmSoiDnQtUcs99EKjryo0aVJchfoWUC8Qr+1vF+nyBTgwLrN:qovB5wDEZfmwcAygurawWq8NtP/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257019, "uuid": "d06149d5-4428-4f27-a8c9-888343a34390", "value": 471552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257019, "uuid": "b6e9fd90-cba1-4933-97a2-0cad75acbc57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257019, "uuid": "cc14e852-5e3e-453c-922b-a36b1ce7db7f", "value": "proforma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "506dc672-b544-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649206555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649206555, "uuid": "c14110f9-4fea-498d-99a3-58fdd57963b8", "comment": "Malware payload (Heodo)", "value": "4fa78c660b3d8f6ef6e7b73b4d2ba5c1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649206555, "uuid": "54c0aa27-f6dd-4cc6-b633-905315bd8625", "comment": "Malware payload (Heodo)", "value": "2890bc99f14bf1d0134fb6b415441d39eebe3fee33c0438472ac1d5d02b40ac6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649206555, "uuid": "32e47681-6573-44f4-8ff9-bcc5952d26ba", "comment": "Malware payload (Heodo)", "value": "abc37e0d88ecf2c4801add3d3ddef00797e1c799", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649206555, "uuid": "f265f944-5eb1-44e7-a503-5438a760cc99", "comment": "Malware payload (Heodo)", "value": "e69d3688cf063ac9f891d5ab484164f14dea24ffe00f0c6996d9cff83cc6e1d98c08a79db88d16ca0fc7dcf229c23330", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649206555, "uuid": "dfc83b78-2486-45ec-b95d-e1a10648d73f", "value": "T10FA4173073A2AD35C3E7627B8FDE82E509E79D604B6245BB72BD652949374C30F70928", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649206555, "uuid": "405f533e-6930-4c8f-8207-cc3d0d82c263", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649206555, "uuid": "5808b1e1-7f74-463c-a28e-703bc51dc76d", "value": "6144:J1lq+vh81z8sN7k83Fv3S5SBB0rYYhVbGm4fyWhA20BrCJqJICX6+H4ki7b5pIdf:J1U8sNY8/z0rYebzwdoCoGEAbcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649206555, "uuid": "d4672d8e-c14a-464b-9382-9e6a384f47a8", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649206555, "uuid": "38c2bc88-9fc6-46c5-a517-829421f069de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649206555, "uuid": "cfef07f5-a295-4d74-9311-3ea5a857f5cc", "value": "emotet_exe_e5_2890bc99f14bf1d0134fb6b415441d39eebe3fee33c0438472ac1d5d02b40ac6_2022-04-06__005549.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae76b51-b5c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649259723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649259723, "uuid": "02188dd4-05b6-45b1-9104-e1a86f4cc1f9", "comment": "Malware payload (Heodo)", "value": "156d6b4376b85539cca729db8bf03e0d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649259723, "uuid": "1892cda6-a35a-48be-8494-9ea6da7b2e8a", "comment": "Malware payload (Heodo)", "value": "28f88fb0b5702bcf2a3ddb6a799f65a526497a6a011e77ebda2fbe52d247984d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649259723, "uuid": "c53ab18f-0b0d-4588-851e-3ea9330c14d4", "comment": "Malware payload (Heodo)", "value": "673fb8a63d71d159546790af91b5075f5146f5f4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649259723, "uuid": "f04ab222-ec1c-42f3-854c-16e8acc1bc65", "comment": "Malware payload (Heodo)", "value": "e227e24b951db68785e924cb5f50ca036fb0216dc94a78bf0d1c8c1abbd42b191a7a3d261a52a4ff5d9e1b582d12419d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649259723, "uuid": "b4f479d1-626e-40cc-8e81-ee128c92ae97", "value": "T15684AE2176D1C07BD9DF02322A16C36963F6F5B08DF5C647FFD51B0DAE321428A29299", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649259723, "uuid": "30a105d0-200b-4aa3-a668-094299252cbe", "value": "196752bd65f33bc6f5dd0426f39259ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649259723, "uuid": "2de5736b-0f7b-44b8-8670-11c9bcb1579d", "value": "6144:buZlJOFmzvtg1Eyid5GX5BVhthqnhdDpV+WWT8JKyTpoOvy2X:bGptged525pthqnhB+RUKyTpoOvHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649259723, "uuid": "7e913420-3e0a-495e-82fd-fd6f4c1c75a2", "value": 390421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649259723, "uuid": "80b8f772-0bfe-4a04-9ff3-867b025db01a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649259723, "uuid": "ff50d5ae-aa62-42bf-8d66-7ce88f6c1d0c", "value": "emotet_exe_e5_28f88fb0b5702bcf2a3ddb6a799f65a526497a6a011e77ebda2fbe52d247984d_2022-04-06__154158.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d55f4c88-b5c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1649260035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260035, "uuid": "36b495a8-3351-4761-b9d5-2137fbe5ba22", "comment": "Malware payload (RemcosRAT)", "value": "794752544167e655d37eb4525e046ffe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260035, "uuid": "6d84cc7b-2fa3-4c28-938f-23fee763a0ce", "comment": "Malware payload (RemcosRAT)", "value": "2a5084f190559b5e7be436f6b91952453727da22d83fd50a1f5dad8800082eaf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260035, "uuid": "d1aee311-3b8b-4686-a6d2-6ac7130b7e54", "comment": "Malware payload (RemcosRAT)", "value": "3c999818c33d962e3ef51672c48c213fc5551c9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260035, "uuid": "5990a30a-bfdb-4469-8cbf-90b3952967a8", "comment": "Malware payload (RemcosRAT)", "value": "95dadf3314a6c7661b7c56e624a2ee540b349d7c48ca194068a1419bb3023244e90f6143475f8d7a9d42310960e6f0f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260035, "uuid": "32673f88-5b64-470c-8d99-269780e88857", "value": "T109753B5DA3524885FED09774F8BB3BB61760857A8C8B5713A3751A3AE82F3F91E40702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260035, "uuid": "715da2c9-3c63-47b9-9d79-9734758938be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260035, "uuid": "059b325d-1a0e-4a15-a41a-33a2b33f0738", "value": "24576:sFbFkSQxX7MhisTQZJVWvZ82DCuIXqU+I3SCEuNCwQhZm7WprXDYFo:s7rQxrs/TQZJAh8y2ybLBDEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649260035, "uuid": "998a24d9-5bad-4b04-9048-5eb3e567e65b", "value": 1694208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649260035, "uuid": "19c81693-5833-4284-a4e1-871578fdaf99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260035, "uuid": "1956245a-df7e-4ce9-94d7-384c5c6c3587", "value": "794752544167e655d37eb4525e046ffe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5baf0a75-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277870, "uuid": "c43fc5be-33ba-4a86-b7e3-86da66e1db82", "comment": "Malware payload", "value": "9c2a5db173ed8faa0c122741758fee88", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277870, "uuid": "f74a58a7-2748-4d1e-a6e6-3135e5594aa0", "comment": "Malware payload", "value": "2aa4f60ba225ed288aeb4afa05de9ddfe34450307894112a91868d4443b73388", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277870, "uuid": "86bf700b-bf02-4694-accb-36cbc9fd2094", "comment": "Malware payload", "value": "546a9b503bb5fcf5710e10549117cee5818084af", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277870, "uuid": "c083cfdc-dfc3-4fea-bb0c-b421003b09fb", "comment": "Malware payload", "value": "03f4d585046e51a7d0921c1a808013585a43ccd28510b97cc73532f47dd97e5747e765f5bae740214cc7506e79a0b26e", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277870, "uuid": "e5bc111c-1b3e-431a-8749-71718e8883b7", "value": "T10106330C229EF8FDB85A066C3B268EF0C5E452F1DD4225F24A791544093E5BE4BDFA63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277870, "uuid": "1796ca2d-6001-4078-963b-c765bc2a4022", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKSAFu:0XSxVJG2fLAqFOfT9sMYNM29SAFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277870, "uuid": "23b7cee4-9c6f-433b-846e-3c11e47ff8ff", "value": 3952640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277870, "uuid": "91bc4270-e4b2-483c-820b-b2f6c012638e", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277870, "uuid": "edd0b0c4-d6b7-40a5-9414-f78253753a47", "value": "2aa4f60ba225ed288aeb4afa05de9ddfe34450307894112a91868d4443b73388", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "565ab3c2-b59b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649243931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649243931, "uuid": "b3c00ee0-c957-4adf-a780-5b8a0c497864", "comment": "Malware payload (AgentTesla)", "value": "959ff857ab2e33a7aaeff52b04407754", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649243931, "uuid": "c92143b6-5306-4912-944e-b13fc834dfc4", "comment": "Malware payload (AgentTesla)", "value": "2b13ffd79b8635bffb44b417c53e0ef02073ff301aca187ae53a911b074c8f09", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649243931, "uuid": "507f81ac-e384-4c11-9d2b-c54903b8f7df", "comment": "Malware payload (AgentTesla)", "value": "2f5dd7cc43cd3ceb73b06d8dea162f83fed416a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649243931, "uuid": "b2ee1465-8b2b-4385-b3d6-1f2b7b325125", "comment": "Malware payload (AgentTesla)", "value": "a512244c6b60d7682e43b2a3b16a408f9469a37def6458c19b3e11555f550818c6d9a63082ba898fbabc5e177e791d95", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649243931, "uuid": "05e2d49d-92fa-4030-99b9-2440d41d012a", "value": "T183233D0923BC5622C268557DCDEF51540375EAA72A12E60FBD84FE6D3AF2BB26501F02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649243931, "uuid": "ca547a92-dc6b-47ef-aac5-4a526457e016", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649243931, "uuid": "35bd85be-ebb8-4ae1-a439-c906b98c6f7d", "value": "768:ZU/A+cVIPFXwJuQjyBHNMAj/AQBcPo+QsbREhw55xZT6:y/9xtXk5jyBtfvBn+QsbyhGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649243931, "uuid": "a17f20d9-8e1f-494b-83db-2fd6eb19d45c", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649243931, "uuid": "ba2ea182-1441-47d2-b8de-4b246cdbb821", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649243931, "uuid": "6306aa29-d2a7-48a6-badd-148efe04acea", "value": "PO-8365882.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d666ff-b5c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1649262325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262325, "uuid": "0d332f7f-bcf1-4c53-a80b-f5bbfed2c438", "comment": "Malware payload (RemcosRAT)", "value": "bde471ad8ab1d01d5b8051fc75a1ae6f", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262325, "uuid": "0d340e4e-1669-4034-a399-1a911e32f8da", "comment": "Malware payload (RemcosRAT)", "value": "2b4f835074c6087f722082a81793f1ef6c2e04e8bb98a2deff6eadaa886aa597", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262325, "uuid": "45c8a5d1-0ad6-4fe1-9143-89bc3c6a0dba", "comment": "Malware payload (RemcosRAT)", "value": "b6d06a6e6f408ec904be87c08da42881465e64a2", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262325, "uuid": "844fa1d8-4277-4257-8010-e4a9e59114d4", "comment": "Malware payload (RemcosRAT)", "value": "a8024bf272aa8fbbd296c7e4dff4f961355b11de5f369e2c0712db71af7b56b8a13075824ee39b73ec1da2461c3de5c5", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262325, "uuid": "dfef0c43-a000-4554-8847-2d42054892bd", "value": "T105F4E0D8FF94EE84D11B45F8C89ED9448276B806AB47EF5670C62B7964B139CCCC06E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262325, "uuid": "fe9c77ab-2794-4f05-8feb-10f8832b1580", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262325, "uuid": "24f65b88-33c5-4484-a2f2-6fb2346bcf13", "value": "12288:guKgSdEhGZAI121fZM1eRCo5sWWasukvYoUoAaYgIuWueQb4:hKgSdEhfem+sNtPkvYoUoAJgIui7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262325, "uuid": "15c8fbf1-db3e-4174-81d4-6970cbfecf04", "value": 774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262325, "uuid": "ced304aa-f9e3-4f21-88aa-c4e6f3912e43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262325, "uuid": "6f01038b-6222-4fe4-b4ed-3c80d9d980a8", "value": "DHL_119060 Receipt Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c088b62-b590-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1649239270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649239270, "uuid": "623cf2fe-7739-4125-9a41-a907904a6e6b", "comment": "Malware payload (RemcosRAT)", "value": "f008f314fb06757924ecb6ed34368d40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649239270, "uuid": "bec163ac-b6c4-4121-8815-376dfbc0b1df", "comment": "Malware payload (RemcosRAT)", "value": "2b6007edf779f7c0ff4650d0d300ef859bad7a61ee76185ccb21a9f86be317bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649239270, "uuid": "e81e601f-38fb-4721-a2c4-f7e29fab8009", "comment": "Malware payload (RemcosRAT)", "value": "93e86c7799617aa52b5c060623637d57b46010f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649239270, "uuid": "1a0d94e9-459e-4694-9720-3af293d6d88b", "comment": "Malware payload (RemcosRAT)", "value": "af35efcb54256d187cdad1f86ff4fb3a3f3ba096fb3aa218cb929aa0e8ffba1c828b5ebb7d4c1af64b58b6a16778caf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649239270, "uuid": "6fa99a55-b559-47d0-82c1-07dc4f4e7299", "value": "T165D4F13CE3D54F92E2AF5FBAD49E310C1639DD00919BE74AD84C3BB854F13B1A442666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649239270, "uuid": "6b5483f6-d066-4a7b-910e-6ac247c75e15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649239270, "uuid": "fcefab4e-d7e1-4f50-8ac7-4c7efdb5bb80", "value": "12288:D4VSh03wRBKbLKpWM8acsEeoQH20F+t+HoQBA8rK1hmlRz:8oHcSEpQW0F+t+IPoah6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649239270, "uuid": "f0ee301d-4b94-4397-a2c8-89a3c7f68fda", "value": 631808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649239270, "uuid": "c72dbd46-5cae-4b35-9482-a886a72e16d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649239270, "uuid": "7d5fdeb5-709c-497b-8470-faedb53767b9", "value": "DHL_119060 Receipt Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c12ea7-b5a7-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649249344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649249344, "uuid": "51cab37a-682a-4876-9d97-e2e5c1324a81", "comment": "Malware payload", "value": "6532ee9b95c5ca2506adb5c474bf724a", "object_relation": "md5", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649249344, "uuid": "761839e2-60b0-4727-aef3-490ea16f0855", "comment": "Malware payload", "value": "2c19916368dca98871b52ab5766b7105cb71d98b251ff65479579d1e497b4b15", "object_relation": "sha256", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649249344, "uuid": "f7d262c3-1787-47af-8952-bc29ee1e2944", "comment": "Malware payload", "value": "2bfd109e4e48a7dbc8d2616112398dffb943ebc7", "object_relation": "sha1", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649249344, "uuid": "d6977a5e-88ce-49bb-9850-d00554332707", "comment": "Malware payload", "value": "99728c64022309405a9db04159694a23912e5ab1338a7ce9a1d40e0817a04955b7170f7d097b18195c26993544fd3864", "object_relation": "sha3-384", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649249344, "uuid": "6817bfc2-0181-4982-a6de-ea6b8c118908", "value": "T129C354E9649B94CE6602A85E85067E037C5E83FD7767C3A163743CFD35E6C00429BACA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649249344, "uuid": "3c76bd95-4757-4b6f-9324-e894ef72c18d", "value": "96:L2I6+d/vPf4Gq2I6+d/vPf4L2I6+d/vPf4T:KI6+dXTI6+dXTI6+dXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649249344, "uuid": "df83aecd-7296-4bb8-a512-c24423e0341d", "value": 119941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649249344, "uuid": "f628fac7-f022-4ac7-b1e9-667ebefcc534", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649249344, "uuid": "119ff6be-c8f4-48b3-a35d-f4a9e74cedb3", "value": "comprobante_transferencia.pdf.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e79d05b-b5b0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649252937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252937, "uuid": "74884b32-8df4-41ee-b45c-8b93e764868e", "comment": "Malware payload", "value": "35dd8d1e214d01217bd91ae6225e1b11", "object_relation": "md5", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252937, "uuid": "59c49efe-b610-4294-b17b-eaf5fe36e9e6", "comment": "Malware payload", "value": "2c3fff514a88763d55819b60212cc4f7753dd7434c6816d35e49df02f525e90c", "object_relation": "sha256", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252937, "uuid": "d798bb42-7f23-48c5-b620-d6e13ed7411d", "comment": "Malware payload", "value": "926d4bba76eb1498d384e75bb866acd98272353a", "object_relation": "sha1", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252937, "uuid": "637199f0-0ebf-4d28-88fe-c74fcee97dce", "comment": "Malware payload", "value": "54df8c9610833da00e6c030ff57d998d9d959b94e40041ecb1d13154bbdc3555da597a9346ff78f657eacc2abb647218", "object_relation": "sha3-384", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252937, "uuid": "c69e121e-665c-4a4b-80b2-e5e345d5b907", "value": "T1D41523DA857D6AC70C405B7EF2D582A83FA8FFD4A21C07164A31A8D5762B9D436C23D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252937, "uuid": "86f8ac6c-3eca-4422-86c2-bafe07a8c2e7", "value": "24576:RLxQwEi1ZYwisXf1NhzKpfta02e0l2XtajUEtVDnvT:R9N1ZLisP1NxulaRe0l2ojUEXnvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649252937, "uuid": "1b5bb52a-c0df-4331-a9ff-4a705cd0159a", "value": 898576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649252937, "uuid": "2fd00662-e3b6-486a-af0d-d205b63c369f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252937, "uuid": "0206892a-ce0c-4222-9781-0ceb0746fb20", "value": "WWA", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e94185e-b5a2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1649246898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246898, "uuid": "06bf8ef8-168e-4186-a6f5-2e3278559710", "comment": "Malware payload (Stop)", "value": "49f462a896510dfc37a9ac4567b3a994", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246898, "uuid": "ef90acff-eaac-4d1d-a0fe-292c737ce766", "comment": "Malware payload (Stop)", "value": "2c412f6d77eb570bb74f1c52c08fb7cfe33d14a99179a1815d6702ae076b099c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246898, "uuid": "8851cbd5-ed3a-42a8-b772-b42ed0c15285", "comment": "Malware payload (Stop)", "value": "3a5fcb3bf24ffff6c03938621108f03ffeada0fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246898, "uuid": "59a7d04c-a803-4944-9eb3-f3f5dc397a5d", "comment": "Malware payload (Stop)", "value": "9b48f5661452050b32813eb7bececc4b5be3acaa7080898b875ba0108f1300c4d2265fb2ddce90cc6a31cd39473a0398", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246898, "uuid": "c427b0a2-3b23-4bb7-863e-70f819af9246", "value": "T1C1F40224B790C035F4B31AF45DBA93A8BA3E7DA05B3581C792D506EE5634AE4EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246898, "uuid": "51f67af9-6c85-40fa-a102-1ee517171bc1", "value": "09b7cb9e514ec032fb567c3b682f1a2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246898, "uuid": "1c5daa35-ccfe-4210-9d37-19f98cc0f244", "value": "12288:hLd2vhbTFYZiOiPj3G5J5MAUiKkYVPio0SiN0JBNeYjzWDuYuT56VRfax1G:hBcReiPQ5M7dPv0f0vNeYjzW5eCA1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246898, "uuid": "621cb447-1bd9-4ae2-a9fc-36cec2b2ac23", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246898, "uuid": "8f6633be-8619-414b-bb68-2dbb30b8c2a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246898, "uuid": "9fd344f7-6348-4093-9958-18905f31793e", "value": "2c412f6d77eb570bb74f1c52c08fb7cfe33d14a99179a1815d6702ae076b099c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec0eaa08-b5e3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649275106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275106, "uuid": "16d37167-6f72-466f-8797-3f08dad21ace", "comment": "Malware payload", "value": "23e15cbfceedfb217445563f9b37f675", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275106, "uuid": "7eea2005-0d53-4e73-b1c8-60d17b67abff", "comment": "Malware payload", "value": "2c50564f7710d3c1963da5a93ec09c77fb7e49b59df7df29cd558b5e989c3f2e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275106, "uuid": "1f0f2c3f-f208-4ff2-a50d-b5dab7e228b9", "comment": "Malware payload", "value": "e3f65ce1220756b015ff3a4039a3323868c19ab5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275106, "uuid": "693edb22-c105-43d5-8639-669df27e8d2f", "comment": "Malware payload", "value": "fe0c3fd467acbc5c2ec2f46311c429180c2555133f9f0dcedca4b57e7c9d2c7ec82a6c1ea7beae0f8b5fe13e12f58e88", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649275106, "uuid": "9db51da7-9498-4958-bc20-a5066becd11d", "value": "T1E6416ED036B375703C7B54BB17AB1C2EB1C1A4206CD9BD85AAE5F4F5498ED01A2C81FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649275106, "uuid": "25214b23-6fe8-46e4-9bc1-a07d7714c031", "value": "24:Ij8nTy8nTddCU8nTry8nT68nToL08nTtQV8nTEc8nTV8nTW8nTx8nTw/8nTY8nTy:Mk+OH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649275106, "uuid": "bbe314e7-a5e8-4f07-9337-e73f72432012", "value": 2273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649275106, "uuid": "7b9d2d0f-f060-446d-a8d0-773e835de774", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649275106, "uuid": "aeb5d358-1768-4d25-8fd8-7b799f7d587f", "value": "2c50564f7710d3c1963da5a93ec09c77fb7e49b59df7df29cd558b5e989c3f2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f748cc7e-b5aa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1649250643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250643, "uuid": "342f64d0-89a1-4fc0-a009-faf98f2d6f96", "comment": "Malware payload (Quakbot)", "value": "d586a82d0083540a98b3285f95c1d94e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250643, "uuid": "828853ee-54bf-4152-ae48-ee10abcf7794", "comment": "Malware payload (Quakbot)", "value": "2c6697caf6ced04d06b0926d982c210a8cd300449b1b2423427a337486813316", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250643, "uuid": "811e27aa-94d2-44c6-9aa9-b71e2b6cf995", "comment": "Malware payload (Quakbot)", "value": "40f1462b7a5394b59fb595bf5b44a94862f54f63", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250643, "uuid": "e13d8e66-be53-4ca7-849b-81c9c7efac44", "comment": "Malware payload (Quakbot)", "value": "084c996b25583b533bb688461140f25a471f88e7acc8e10ae4d72f5e065a4cd8515171f7c4f3f8281458833b9ff3d62c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250643, "uuid": "7c7db294-9ad6-41d3-afcb-d11b736f00bb", "value": "T15D65AFBC75046CDAE66F06BBDD96ACDD13B6263299C794CD807577C309A3372EE02805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250643, "uuid": "db699b4e-e15f-4fe8-b9e9-b221afc97237", "value": "1538717eb64bec210d6f84c7331143bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250643, "uuid": "ca38e103-ccab-4c1e-8a44-1df6b185abff", "value": "24576:873YrrLEaF0tTHMjuX5PmnKUz3NL3BAYJWDJnh+idFsv3YgPmHFWcD:8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649250643, "uuid": "6e6ed608-2b4f-480f-885d-ed34d24dccf2", "value": 1427464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649250643, "uuid": "dacb9cb7-86f4-4ac8-8baa-496344548962", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250643, "uuid": "e38bdf72-9f15-475f-8e8d-9ad2742c83c6", "value": "7790983516.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e5988d4-b5bb-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649257742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257742, "uuid": "fc034b4c-7ec6-4197-83fc-5bde604f8ae8", "comment": "Malware payload (RedLineStealer)", "value": "144e725adb7d6d3a8aa114f2ca7de7b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257742, "uuid": "283fa676-623b-4441-9998-d35649c6afb3", "comment": "Malware payload (RedLineStealer)", "value": "2d1433592d71be8e2c3b7094792089085ced66d41605d555a846bcb69f396991", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257742, "uuid": "27bd337c-4a36-4281-8d16-6cf56838f9b6", "comment": "Malware payload (RedLineStealer)", "value": "b6f68a474ce327563b9caa78f7a1850fdb197163", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257742, "uuid": "6527c6ac-373c-4cac-8ec3-14e717427534", "comment": "Malware payload (RedLineStealer)", "value": "d27a09868e040995fb28c9328731d10001cc86cb830b9760d0aad6d05c17d202c7de93fc205337336df8e34a5a9b9b84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257742, "uuid": "678cdcdb-bbd3-4cb1-886e-f7eba4ff3f87", "value": "T107E4127E36B2D471C8A2263184768FA05A7EBD729564424737AC3B2E7E702C017B476F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257742, "uuid": "9a812cb0-7689-4014-b3a4-e026129ac5ed", "value": "e79fd692ca56a6bfe6bee63e61f991ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257742, "uuid": "469fe5c9-9a93-4166-931f-1ecc2d945bbe", "value": "12288:XjzYDFFIHW6s7BGsGfj8H8PkJfR3yu1IVycTL+WA+vx2M:X3UFQPs7l4jMpt91IVB+F9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257742, "uuid": "bba12f1a-b8c3-4656-9339-476e3180a6d9", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257742, "uuid": "3b9706fe-adb0-4e49-b080-1422a2d52c99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257742, "uuid": "135c0cb3-2e09-47d4-b8db-15bf9bfe768e", "value": "144e725adb7d6d3a8aa114f2ca7de7b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c86fb0-b5b9-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649257033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257033, "uuid": "86716b6e-04c9-481c-af5a-cc8a38553d96", "comment": "Malware payload (SnakeKeylogger)", "value": "d0b4b4da62a7c9b7f899d33439da31f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TT Payment", "colour": "#B3D400", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257033, "uuid": "6bc08bc4-8df6-483d-80af-b20000a8452e", "comment": "Malware payload (SnakeKeylogger)", "value": "2d43a6c2aa42bcd09072c48e5e7529c81e826467dc6710e0ea8819bd86ac668c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TT Payment", "colour": "#B3D400", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257033, "uuid": "17377ef5-839d-4e43-9602-d823cd309ff1", "comment": "Malware payload (SnakeKeylogger)", "value": "91d7aca2ea006797ad33490b7c49172908fcc549", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TT Payment", "colour": "#B3D400", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257033, "uuid": "62167530-0526-4d53-bf7f-663618a98be1", "comment": "Malware payload (SnakeKeylogger)", "value": "f47f8d60cca23c882a2d6529f0a219b0192fdbe4fdfa6906e8a301f837a4002750e308126db2eac4e7690018876f963b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TT Payment", "colour": "#B3D400", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257033, "uuid": "a536a041-8709-4c26-ae0e-76e8cf087fce", "value": "T10285E030F6BE5948C9B64B7019365FD1277ABE667A04C76D3648220D8D326238B21BF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257033, "uuid": "b32ef97d-052c-475b-aa15-9802bcac4007", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257033, "uuid": "e11125c7-9a5a-46cb-80df-c9a5095d3ef1", "value": "49152:MYzjrZ9W1Z5HTQo/3qdWcreELhho8dSPm:8r5HU5BBLhhofP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257033, "uuid": "e7172731-c283-4e72-a291-74ec409f3fc4", "value": 1821184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257033, "uuid": "92352fa9-430b-4840-bed8-5744ddf0e62e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257033, "uuid": "79137ac1-e258-4ca4-9fe5-58466932061e", "value": "TT Payment", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f81039f7-b5bc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649258376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258376, "uuid": "41c85319-6a43-46ec-b7e3-7dc282f68719", "comment": "Malware payload (Formbook)", "value": "6bb4136b2b9aaed8ba260896c435a630", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258376, "uuid": "0bf5ca5c-adc6-4cfd-8f82-af4847c38120", "comment": "Malware payload (Formbook)", "value": "2d9035fccfa410259c75bb54edc9c95c2d736e6bdf87832fc2062dcd89286b39", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258376, "uuid": "0ea46f5f-4262-47c9-a06f-71772f8d9ec2", "comment": "Malware payload (Formbook)", "value": "62f31c794aa8593762e9ce4905bf66e117259c08", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258376, "uuid": "46b4abd6-1d42-46d0-8289-c61b50037d76", "comment": "Malware payload (Formbook)", "value": "779dcac3ab04962ad79a943bfa96ca6e66eed0426ce83fac76fa837c2328d83cbd20d5f48499e76fbd1a45980a6ad226", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258376, "uuid": "5cc0a420-b256-42de-801b-e00e85e44e6e", "value": "T182C48D57F7C7FAB0E6BE827A86B1851C527774920260A78F674072896D23392493DF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258376, "uuid": "85ea839d-3678-4dd6-a319-781e31e059b7", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258376, "uuid": "47b76a0a-d7dc-434c-9706-b146a2866c6f", "value": "12288:Vn/zDvGHAykHSzLW/4+8bzbBSreMdEGgFK/UqW:ZzbGHAzHAjX1OcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649258376, "uuid": "36d1ae6b-f1a5-455b-800c-fbc374601526", "value": 566784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649258376, "uuid": "bc4f7a0d-202e-49c4-a2e5-dc298048d55c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258376, "uuid": "ba46f704-f38c-4fc1-81a0-fa571c3e8652", "value": "PO.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f88e0154-b5c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649262671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262671, "uuid": "bb82c968-c354-458b-af42-eb5661711f61", "comment": "Malware payload (Formbook)", "value": "8652c7f072217bfa38b44bf99ec6863d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262671, "uuid": "28cc82b7-fde8-4ce7-aa09-bb8fbc6677e5", "comment": "Malware payload (Formbook)", "value": "2da2fdf211a236802b620aa7827632c2454aded6c99b200fbd737c104c573bdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262671, "uuid": "89821a40-3e09-46fe-9ae2-d5d736c717ad", "comment": "Malware payload (Formbook)", "value": "c30c96a1b94375aa8f9d4c9c3d130ceaed41ff62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262671, "uuid": "c7cc7938-4b0d-4ae5-9149-763a644edb2c", "comment": "Malware payload (Formbook)", "value": "a67328c9e6ba0d6c33cf8fff025a96ffdf28d396b4d9e2689a44fa2c087a64b4bfbb13ee24498c41ec4724e4a0d9d171", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262671, "uuid": "e52c09e3-465a-4fdc-bfb8-4e5e7c96b6d3", "value": "T19324122161AAC4B3F8F20B72097957769BF9BD3615B0830B03349E5BBD311C1AD5E7A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262671, "uuid": "d582da2c-8bc5-4e2f-8e37-a038adec899b", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262671, "uuid": "026d253f-95d1-441c-89ad-04dc82e7e007", "value": "6144:HNeZmXeDeJcmgMb4C3ttLoktbkokvOtYfelgpI1aqZPolrZvOYCS41:HNluqcm9kCboktFtYf7yQqQFOXl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262671, "uuid": "a93ee204-3933-41b0-8656-70fe0b2e96a9", "value": 227202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262671, "uuid": "4af60cfb-37cf-46a2-b86a-f5e6b6950072", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262671, "uuid": "0c8f4997-6afb-467d-b7cc-806d0c1537fc", "value": "8652c7f072217bfa38b44bf99ec6863d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "412741c5-b5a2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1649246902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246902, "uuid": "6a69d56a-ccba-41db-86cb-9411e15a2668", "comment": "Malware payload (Stop)", "value": "ccf3966488383d086d88f79be164116a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246902, "uuid": "07856739-729d-46df-9fc0-9a4faf75ea45", "comment": "Malware payload (Stop)", "value": "2df12e8c0ae250b75fe5ea773ddf13835c9b8a34d10714246ccb4266e97ba2be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246902, "uuid": "d6b7e26d-9d97-4d32-aa1a-699794d199de", "comment": "Malware payload (Stop)", "value": "b7762e01560ab0a008eef8efbbd249e6877f71f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246902, "uuid": "47a0f1df-d0b9-484c-b049-3dcf750dd7e8", "comment": "Malware payload (Stop)", "value": "6d32ea8341227f3559ad09c9cec9b65101ed77488b3d8edbdca8a3951e0689a94614450489426a142d1f2f8df3f1e85c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246902, "uuid": "ff44cf6b-e1cb-4a9e-adba-7d9c990090d5", "value": "T17AF40210ABA0D035F5B716F04A7A93A9A92EBDA0673490CB22D516FF4734BE4EC70357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246902, "uuid": "30b88d32-f1aa-4b97-80d8-c598520d082a", "value": "18434dd795f0f66c344397d1af5ed120", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246902, "uuid": "4f72c5be-aed4-4144-92ea-8da99a0634fa", "value": "12288:Z7nYRvX8oXIwSJhCv8dVEguz60wkmCxUa52lH3EFmKeAaP5xu+kany9X/QcJnOYB:ZDiJIsv8PcUG2lHxKeAahxFkNX7cqdv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246902, "uuid": "9158320e-1c28-4b47-8d4f-85b662e76c17", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246902, "uuid": "0479f07c-f6a8-4c63-93b7-193a3ec8dc09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246902, "uuid": "86f75119-e1e4-402c-be47-5edac14dc8be", "value": "2df12e8c0ae250b75fe5ea773ddf13835c9b8a34d10714246ccb4266e97ba2be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed806b7-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277875, "uuid": "42403f8c-06c6-499c-8a99-b4dc496de37f", "comment": "Malware payload", "value": "4f4450dda21c6a132ad2fc9622dce543", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277875, "uuid": "40e35a58-c75c-4616-94f1-39b6ea815c36", "comment": "Malware payload", "value": "2df79021148e598a41d7928f72dc0239684aa65a5b974ef3f7f81874a88c2fff", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277875, "uuid": "959bc54d-1047-444e-b4d4-81bd6fa8ddf2", "comment": "Malware payload", "value": "3ecb40d82154aaf9deb672373c2ce23bd81fd8a3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277875, "uuid": "df2ab722-e18c-44b1-b858-55e83702e85d", "comment": "Malware payload", "value": "0484922157be2b6acaefe10b5f239db60776e0422e618a1f280d2d85a9dcf8f1fb13f7cc95f97886536184bde4a0a25a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277875, "uuid": "4ba98fbd-1acc-4526-b41a-c073e161b39d", "value": "T1FCA1E850112C1AB17346697AD26FFA52B90EC81B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277875, "uuid": "d8b7d92b-d0f9-4b91-83bc-250094981c50", "value": "96:3RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:3RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277875, "uuid": "42d3d618-4baf-4dbe-a7ac-af5165d69e18", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277875, "uuid": "0806696a-9860-4e73-a130-f6e72d1c3398", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277875, "uuid": "a3d3229a-e5f8-45ea-9631-8d7341b44ce8", "value": "2df79021148e598a41d7928f72dc0239684aa65a5b974ef3f7f81874a88c2fff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bb81935-b5a6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649248638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649248638, "uuid": "bb14a9aa-1456-4845-b2c7-49aae2179409", "comment": "Malware payload (Formbook)", "value": "a6b5d0d19b6452312bfbc607c4044e08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649248638, "uuid": "5f756ba5-b9a5-43dd-8d75-255d7b0c288f", "comment": "Malware payload (Formbook)", "value": "2e32ef5b88f29ad1fd62fbad78a8bec21f032003eeddc46144936259ed66a4a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649248638, "uuid": "ee034976-f6c6-49c7-9494-6e63aa10ebe1", "comment": "Malware payload (Formbook)", "value": "25a6e3f839c4e8a698ff59d96278c4ebccb0209c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649248638, "uuid": "a69157cb-cd3d-48bb-be1c-22672e1bdc01", "comment": "Malware payload (Formbook)", "value": "ac8295a837abfca3eaac008562e628261f2426db1ce2521806995e9d57f3a87fb5f670a52d058d7f53bd39879637d364", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649248638, "uuid": "c7958d68-c2e4-42bc-b625-2550e1ba4bd4", "value": "T1B33412556B34C897F6F307361F3A6F3B95E1ED2510224A8BB35076AC3178352D62AF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649248638, "uuid": "4546ad07-bd1d-480f-97d9-ff6110d0f600", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649248638, "uuid": "c6eba6c3-6161-445a-81d7-b19e7c1673ac", "value": "6144:HNeZm9gEh+4oQFbaO+qfIgksHhpDr3RdckZbF90DQ:HNlhtlbaOZfIgDhp/RVZbFO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649248638, "uuid": "d25620e2-5fef-45cf-adec-c8cfd36d5c73", "value": 245856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649248638, "uuid": "4682a44f-0cbb-4095-8d48-895f43af153c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649248638, "uuid": "ff3ceab3-d283-429f-9b34-4fdaac8f79ff", "value": "ib file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bcb3290-b586-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649234921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234921, "uuid": "da11327a-816d-4f7f-a72c-af6d3d349469", "comment": "Malware payload", "value": "53a4ff8130235837af8ee2a714d93928", "object_relation": "md5", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234921, "uuid": "14150e0f-4671-478f-b4d9-6cf675712f28", "comment": "Malware payload", "value": "2e9f27f5567cd7209654bbb8f75ba44d65a02a4c76b7cb84606ec038c950f3cc", "object_relation": "sha256", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234921, "uuid": "39d9e3cd-ee6c-4c8c-bfc7-2854392d0a7a", "comment": "Malware payload", "value": "999500a0d879c12fbb7507d6c89d3d742bc6837b", "object_relation": "sha1", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234921, "uuid": "2604dfee-6fe9-4331-872e-5e75e046d44e", "comment": "Malware payload", "value": "969a6a15bcaf42a627397fc4c97f95652531e6687aa1109505e0ceaa5dbc9b496c6bc89d18b4c38cc080d444588bf39b", "object_relation": "sha3-384", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234921, "uuid": "52bdb0c8-1953-4af7-9ff6-d38a264bff24", "value": "T102442209CBBE4AFD3E16600136EBBAFE9575B311D02520DE709AD352926B4C6C134F9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234921, "uuid": "ef1f5c72-a9de-4755-92d5-310487be7eea", "value": "6144:kkPjcj9t419/v23VI+aztzkbmW/kxql77ciCLBlkcF2+mQUz:k8j+74zEUztzmweYJLwcFlxUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649234921, "uuid": "04aeec7e-6f52-46ca-a29c-1e90c9107674", "value": 254395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649234921, "uuid": "55e56003-b994-41bb-b823-326d70a61779", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234921, "uuid": "99addc89-44f8-44ea-95b2-f548038f3f32", "value": "6553afd4-4d30-4c5a-724e-03f71864df9f.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8693b92-b5bb-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649257893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257893, "uuid": "3b7dfacb-c731-40f0-b593-735c7ba68b33", "comment": "Malware payload (AgentTesla)", "value": "f3a65b10af187d2793ea1348af0ac8d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257893, "uuid": "8154f252-9292-40cd-95c9-10ad27341857", "comment": "Malware payload (AgentTesla)", "value": "2f06f15a06726188e393509345859dfc74e825193648258c33481a3cb08c324b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257893, "uuid": "81bb6830-6e95-4766-bccf-114668089704", "comment": "Malware payload (AgentTesla)", "value": "e36312fd8ccb18e922786b9f31c7b4aeb4992ce0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257893, "uuid": "89058608-5358-4652-8cb9-acc6807e650f", "comment": "Malware payload (AgentTesla)", "value": "3561c42e5359554092733be78532954a581ef69dfc0cd53a22ef08eb18612f97bfbe961b216b6873ab37fcccdccb6166", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257893, "uuid": "e9da45d1-b95e-4a4a-8aa0-fd455a677eab", "value": "T145140242BE35E35DE2626FB3554E986B96A7DE820381C801BDA535CC38B4F5BCF4B025", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257893, "uuid": "0fe0006f-9b13-4cf9-8728-ac4c25b9b05a", "value": "3072:i2bmNYE5t5yjMh7qb0WaCB8M93fDQsccFHF3sMfKTM1VYZJurdzEcyIVHfE+IWqC:5cYba/WaCjfDQsccb5+edzE4VHfE+IWb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257893, "uuid": "9b529e33-1a86-444a-8758-e0b1c6791d78", "value": 192440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257893, "uuid": "069c274b-bfa4-480f-b682-d4dc7d7fa846", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257893, "uuid": "18efe8a7-5e8e-46d8-b936-fb61d7a74a7b", "value": "SWIFT#67890654Y7.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870371a5-b5af-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1649252603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252603, "uuid": "faee5a81-6d0f-4c5b-bc54-fa2538961c72", "comment": "Malware payload (AveMariaRAT)", "value": "68f468b7a54498bcaf3445f5d10cb630", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252603, "uuid": "f5d3109a-14b7-40a3-9a5c-fdc005942f6e", "comment": "Malware payload (AveMariaRAT)", "value": "2fb31ea793a7e33dd8579f6489edb55cc865e4a81567e069efe540f7dfa29155", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252603, "uuid": "4dda2c14-c56a-47f4-9a2f-33db09fa0711", "comment": "Malware payload (AveMariaRAT)", "value": "d5f43b6f70949b4e614cf8e71ea682016d7ee5f4", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252603, "uuid": "4b35341d-cfcc-405a-b899-711e8a1cc10c", "comment": "Malware payload (AveMariaRAT)", "value": "c7bf5ca7582923ef92d972cf3f49637276327bde1a33e622df54d7278b7abc01a70c201c107125128e1a8dcd859fd625", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252603, "uuid": "3a2e1354-ffd9-4901-af24-f772c60c0c2b", "value": "T11784231A119C55FF0A65CF4C51CE824AF9E1A293F960A62FA9F4C91C0748A8DDC67F0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252603, "uuid": "c711b80a-0120-4041-88c4-77abbd4ed2f5", "value": "6144:DPQ/ANWjbF2N5SgmbouyGpLrfXcS95WOB4qbGyi6DX/Fk0xO1hQYjNiJy:DPxuPpXfMS94OB4q/gZhP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649252603, "uuid": "11232f2c-6b05-432d-a7b6-3c39aa4cef33", "value": 406249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649252603, "uuid": "b4974f4c-fc5f-478b-bf76-d9b3d0f875e7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252603, "uuid": "0c2cd682-f01c-4af1-b551-253a0ad4db39", "value": "New Order#IRQ2107799.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382fe6a5-b59b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649243880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649243880, "uuid": "caa3b131-2a3c-4336-9e7e-6ff9a4051fb1", "comment": "Malware payload (SnakeKeylogger)", "value": "edff5689ef30f49ae41a69293be177d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649243880, "uuid": "97813413-84bb-49c7-b6f8-903f3cec11cc", "comment": "Malware payload (SnakeKeylogger)", "value": "304e463a3f7c278033c59aae476ce6788ced9a10ef1e5a32b0ed5a227a745c9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649243880, "uuid": "993bf5ce-f015-4b23-bed0-d721adc8a63a", "comment": "Malware payload (SnakeKeylogger)", "value": "4ef55d8624b36c4277f9ec728698a73b606ca28f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649243880, "uuid": "0dbe3796-bde5-4145-937e-18eeb913c887", "comment": "Malware payload (SnakeKeylogger)", "value": "2c8d9dd971d82f72fe588199cd1459b8c6783864e0f395276c64a789380c45dc59769ab41382d8a9f65ae198fce9ba66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649243880, "uuid": "895311ca-67b6-470f-8966-34da1bf0ffdb", "value": "T12AA4128633680322CCBE9BF7E43A514007B2A92B7E61E798C9D675DB19673109E50FC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649243880, "uuid": "d8a871a8-0ee6-4ee2-aeb0-6c1293fea275", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649243880, "uuid": "4aba648c-bf25-4cc8-9169-08e2f4101453", "value": "6144:jZPckjIvBeHTjXKQvfR1ZQyXpvMmd0nXzTrXLaJPKaaw8GU0cfmvFLZt:jZPScFZA4pdkjTrbQP98YemtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649243880, "uuid": "d1ab02d1-166c-48ea-b03e-81e8fe041ae4", "value": 457728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649243880, "uuid": "d14a0736-b428-4c9e-935a-cf9fa42036ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649243880, "uuid": "98b1dece-12ad-4641-8b31-406922b2f5d1", "value": "NEW ORDER PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4deb07d-b5bb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649257914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257914, "uuid": "04c01997-110c-4245-9190-b4af679e6d03", "comment": "Malware payload (Loki)", "value": "2390667e55db017811aacc2ffecfee5c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257914, "uuid": "416e5ee5-53f4-4d29-b1f8-fc31399ec865", "comment": "Malware payload (Loki)", "value": "3066c630de019bd9ffe7e63f4a1d9ce20070c95c761d1d52c4a0c739d66a588c", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257914, "uuid": "7baa5e26-f9b8-4205-a115-411f4d67916b", "comment": "Malware payload (Loki)", "value": "39ef7233512979c5b2b61f4dea787ea058266866", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257914, "uuid": "0f57ea04-3017-4a19-a02a-33ef126639c1", "comment": "Malware payload (Loki)", "value": "86e0678d3aa16640a184b199cd3276cd237dee865679aadae6f59d55a079d873bd2e5c4faedb25c3d6db53a171902e26", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257914, "uuid": "ead4772e-a47b-4983-a5c1-93a6a1efa466", "value": "T15E141217F6D48E44D5E686353E689AA518A3FF8416064EA7207FBB0E0F363907831FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257914, "uuid": "50d7fd0d-0d15-4631-bf3a-c1f2ada0c9ad", "value": "3072:4IAxevvMH16BbQvBKUfTF/GuRYEcMjLtaEBDykjDx2sPvi7K3YTAPgtxus8vq:yeAcEvBn1RzcMjLEEBykPx2s98AP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257914, "uuid": "418cab0d-9401-49fa-aca8-4f82c5a351f5", "value": 192184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257914, "uuid": "e0f61bb4-b853-4c2b-8628-e55ded21a3ce", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257914, "uuid": "ff91b4a1-a303-4f0b-977a-b7efcaad80b1", "value": "updated_order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e43792-b5e8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649276869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276869, "uuid": "ef413197-ad0e-468c-9163-4a1bc50ac31d", "comment": "Malware payload (Mirai)", "value": "4ab50e82b7223042211edbe043dd0b3d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276869, "uuid": "af3b73a7-5b33-4962-a85c-593cc5ab7c31", "comment": "Malware payload (Mirai)", "value": "30dd848690616824890e734c8b64b612f6f56333ea7bf437ccc3eeabbc0486e9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276869, "uuid": "da96edd9-45fa-48b7-abcc-dc5483f7faf8", "comment": "Malware payload (Mirai)", "value": "c563a358625ae865d5286e718ae2e90209849eed", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276869, "uuid": "e8c9ff63-8cfc-4e15-8b54-4a815338adbf", "comment": "Malware payload (Mirai)", "value": "bf698ea1189e22d80062cc3d316b88905badd46a4467ac1436c18a30d5e7a5056d0420327b7b3d2c2c108622a57bdc97", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276869, "uuid": "3885c32a-31c7-4fe1-836a-bd3f1a3bff04", "value": "T191132A4AFCE18A6AC6C017B6BA1F518E3321A3D8C1DF320BDD185F2476C661E4E3B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276869, "uuid": "99c019eb-8cf7-43f4-84f9-3c3db7235edb", "value": "768:S9Hh5FLnQ3uqtC7mn9Rjw/pfLh3aiJIScZHqaPX48hk47oWjgK8BNs8Uhl:ojnQhmAaJLh3alSCKyX4/4+KD8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649276869, "uuid": "ba970b1f-c570-47ce-ab29-3efe7039b114", "value": 42580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649276869, "uuid": "9c367838-b8b7-4000-a0f5-ff2b56f1480f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276869, "uuid": "931d437d-0492-4fc4-b9bf-be1ded3dc2f0", "value": "arm5-20220406-2027", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87bf63e2-b59f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1649245732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245732, "uuid": "52aee62d-e7f1-4eee-8561-aebff16de8ff", "comment": "Malware payload (Smoke Loader)", "value": "9cfd667b14429510528ca3fd8d9d63c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245732, "uuid": "e3baf635-2e20-4715-b87c-f9b8a58ada0f", "comment": "Malware payload (Smoke Loader)", "value": "313c8bb887567806112d0755963632c1b6f66d9479965efae7ce39cd4738bc1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245732, "uuid": "c5c75a34-ed4d-4d29-9faa-8ce50ce4e7e9", "comment": "Malware payload (Smoke Loader)", "value": "1d6317cbc35278aa0c08765feed67092666d62dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245732, "uuid": "9e60cc8f-170a-45fc-8d0d-eb6ec47ef282", "comment": "Malware payload (Smoke Loader)", "value": "599cb9b58fe512f66ca0e557a994f1d82594ba60f054d49dc73c84331057f8ca9e78d0be7c5f36a0aeebe06c1c062d81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245732, "uuid": "3ff208ee-8d75-4b99-8f8a-102744841ef4", "value": "T1E254ADD176928471C4523E30A866CBA1267F3831DF34550BF3BCAB2F2E713D096A2766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245732, "uuid": "dbc55a52-4269-42af-9e05-537257f3f675", "value": "5cbd107a7eb6202007731da5377c40ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245732, "uuid": "6de123fa-e3c0-4437-bf8d-7ead6471ba91", "value": "3072:fJXzbWpj+OdxYfJUCW8wGoXXDE0KtVggjcGkNIVqIpsxkgaBChUNp:lU+KYBUDVXXw0y7ITsqdiga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649245732, "uuid": "9c47db79-236e-4935-b062-53886ddc0ce6", "value": 289280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649245732, "uuid": "5c47d998-440e-4c0b-8acd-3bc3d795256a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245732, "uuid": "69196b6c-63c8-4e28-886a-e682cf5b9bb3", "value": "9cfd667b14429510528ca3fd8d9d63c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427fb9c1-b5bc-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649258071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258071, "uuid": "a421f218-c615-410e-8acd-aabe4444a458", "comment": "Malware payload (AgentTesla)", "value": "6b25267530a88e00d0d1e975d8d7c6d4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258071, "uuid": "ba3a586c-12e6-497e-b5dc-efa1994f744e", "comment": "Malware payload (AgentTesla)", "value": "315247d387408124f3bdc174ddfd58beb03d5822fa06b7cdba394a3435e5a3dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258071, "uuid": "181e6191-b9f9-45d9-8f5f-98c63f57e0d9", "comment": "Malware payload (AgentTesla)", "value": "2accbe3354697f9ddeaefe30a728c353af062f0e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258071, "uuid": "9f54c2c9-39a8-4ca6-99bc-77f4ae9583f3", "comment": "Malware payload (AgentTesla)", "value": "94b0e83107d6291149b3ff3f354f03821d15d14985bdb3585caaf7fb1406ab7a85427b666eae5e62d307c68c9471c9fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258071, "uuid": "aaf4dc49-c178-4de7-b150-7c7a1a55959b", "value": "T1401402D7B9560682FBB3AC758A6E136201BDEE621805A253231D7FF746350B00DA3F97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258071, "uuid": "bc7b768c-d240-4035-a64e-0ac2e41a9af7", "value": "3072:2DUta9f5W3LPTGLMW8V96H0lsxuEDXEIrq51eIL8p7aVYJCaWt2j+XVDoZA9VITL:/2f5W3GLsje0S/rxrq7eIL8p2VYkr2jd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649258071, "uuid": "d40b660b-2860-4635-a0d2-a17d6e83ef05", "value": 192264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649258071, "uuid": "9efd9f63-5957-48de-9767-de2c1aa619a2", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258071, "uuid": "4c58ce82-126f-448f-beba-75fb9466254a", "value": "FACTURA DE PAGO.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "126dd2f0-b578-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649228785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649228785, "uuid": "b39ca293-13e4-41e3-8022-3040195a4e59", "comment": "Malware payload (Heodo)", "value": "f880ba80b2045cb9286a09d58538ba4e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649228785, "uuid": "e0bae97f-5fbb-4e3f-b83b-8e389464746e", "comment": "Malware payload (Heodo)", "value": "31fea333fe9b8e78240192198bc019245a01b3df6703babd1792cf161dfbd7ae", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649228785, "uuid": "71c225b4-3435-491f-b971-40b13f59b361", "comment": "Malware payload (Heodo)", "value": "e8a31f1fe42f4cf128c178c598df528322624ece", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649228785, "uuid": "a1473c34-06fe-407e-b77d-97845de96a85", "comment": "Malware payload (Heodo)", "value": "1374f5ead26dbf35da5a3c861b51bd7ec5f64a963744359496112d84a2c9b38b1a205d392cd0de8d620a7daad324bc44", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649228785, "uuid": "7281d565-4f05-4798-8a3e-de54da2cd932", "value": "T129A4AD12B3D1C075C5EE11341A2A271567FEBD204BF5D6CBABA0FE4EAD32AC18935316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649228785, "uuid": "c8c5afb1-d210-4ce8-a961-f65e755bd791", "value": "0e8a17377c9b4601e7a0971e33ed66d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649228785, "uuid": "80e090af-bf3a-4a9d-b309-6beeccb385f0", "value": "12288:6caLILOJcC7Mx3NFvV89orVD2dotpdLR:6caLIqJcxF9trVD2kpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649228785, "uuid": "ddcb9ee2-9c0d-40c8-b233-dc025d00dc92", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649228785, "uuid": "a489db1a-737b-4809-a960-145694322f29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649228785, "uuid": "d32052ec-3431-4cb6-a092-250330458077", "value": "emotet_exe_e5_31fea333fe9b8e78240192198bc019245a01b3df6703babd1792cf161dfbd7ae_2022-04-06__070620.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa1ef0d-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649277877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277877, "uuid": "1a9d4b90-4a3e-4a9d-8b99-384f71e5007c", "comment": "Malware payload (Mirai)", "value": "213ba6a403ef1b63d264c192256eafa7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277877, "uuid": "002cd19d-ec43-4b1a-a8dc-9fb5edb21552", "comment": "Malware payload (Mirai)", "value": "3265a86747ac9b14f9f11f7f3824170c6e5bcec4561a8bec8ac9e993234cff3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277877, "uuid": "9a8e6712-0380-44f6-ab85-10fb97ab7672", "comment": "Malware payload (Mirai)", "value": "4b9f5665274cd56d329185710700fdca478f4022", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277877, "uuid": "fd199a7a-57bb-41d3-bdb2-e21a6a348306", "comment": "Malware payload (Mirai)", "value": "788dbceccbe7cc19495bf070624a76dec719f55cd1a8212a491d6a89cac2a0fa88ab8c4920e1c6a825dfaf6aaa2ef6bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277877, "uuid": "7161ec10-dd7e-4845-80b1-3e40676004fe", "value": "T1A7244137F11249A6C05A0CF122AE7F536C1382FB96A271C3FAA50AB4BF7544B2975DC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277877, "uuid": "5f489392-aaa4-499c-8285-04795bf9360d", "value": "3072:vQgpfDPf+5KRQhsoYPWTjK1cr9mrmudGLE2lgp:I+PfNyMwjWcZmrmudGLE2lgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277877, "uuid": "f04ae907-31dd-49ac-bab9-08300a1a1417", "value": 226225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277877, "uuid": "56f92590-9613-4d15-833b-001fcd8b2719", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277877, "uuid": "6c848844-0a45-4618-abc8-d3743d371bef", "value": "3265a86747ac9b14f9f11f7f3824170c6e5bcec4561a8bec8ac9e993234cff3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "920480a9-b5b5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649255198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649255198, "uuid": "5c016850-2e73-4ed7-bc02-e027f1915987", "comment": "Malware payload", "value": "acc93f208ba08a0bb41bb9eb817a593d", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649255198, "uuid": "f2a00456-9795-4356-8845-43fd50d1b40e", "comment": "Malware payload", "value": "3299c43eb07892d1e63c69ddaad7bcc848c3b685830d6cc384ce4919408090e9", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649255198, "uuid": "9e2afbc2-ea4f-4653-9378-120c82ab60b7", "comment": "Malware payload", "value": "df86c410a4eef150f59a428d48968bba209e3c54", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649255198, "uuid": "661ac36c-54d0-4767-a515-70b568676048", "comment": "Malware payload", "value": "758a23052fedb46ae1fd38572f34696633fd706d1716803b96da34be3013d27d8654f677ebb7fe6f55b8f4f99d7374ec", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649255198, "uuid": "7e5d60cb-efc0-4cf8-826c-aad38b0cb459", "value": "T1AB43F1A9D485AD34D3B55B38721656E3BFDC80E2C11DE40D28BA37E99CC36C207A8D5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649255198, "uuid": "c61e6e01-f379-4d55-baab-c1fc8a0d13f8", "value": "1536:p6ASbSfgeMGfdYQI5csfzuaI3VY/RVBBoMG0lkBb09TwjGa+Q3:4QfVMGfDWqzMlMjHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649255198, "uuid": "de424b2c-127b-4abd-b1a3-775f02077f8e", "value": 57099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649255198, "uuid": "3aa5cbf5-c863-49f0-9882-3e258fd3a594", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649255198, "uuid": "69f08e1c-1d12-4608-9399-34256c1eb039", "value": "calc.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1dbb74f-b5e6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649276297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276297, "uuid": "7c90128b-6cb5-4016-b240-85eba016f1a5", "comment": "Malware payload (Mirai)", "value": "f231d6c8e20a64f515f41f023b2aeeee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276297, "uuid": "854b14f8-0a75-475c-a9c1-559cfc44ff6f", "comment": "Malware payload (Mirai)", "value": "32bca09832ea8fd31557f8a48bad4e352bbb52537877fa9ce96f2a83bb5f0bc8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276297, "uuid": "e7eaa867-399a-4c52-94f6-92b84b6b8147", "comment": "Malware payload (Mirai)", "value": "0b8afb40289bd1dc3aef2b1d16a357443bba3953", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276297, "uuid": "27b7d3c0-013e-460c-b23c-0e5b4eccf0e4", "comment": "Malware payload (Mirai)", "value": "4a4ec28414dfa7c327751c754033166fac8cfa089a303ef0dc27c11a9a0f88f2267b572fbb37a05f9492e5ae730f290c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276297, "uuid": "1e0c21c6-1a4c-42f9-b735-e164cd04137a", "value": "T1ACB2C02252620D71C7F01CB9D1BA8242B33706A410E6727B26F4E619F6C1AC9F3F5B96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276297, "uuid": "134464fc-c314-491b-9aa5-c574cdac8e18", "value": "384:2ojgb0BiJWBVrnm3VPUnaKxnotLzghOXntIbO6cFokoWsknj2Pc4ehymdGUop5h/:2Lb0BtVMPUb5odztdIbcdol0jxs3UozV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649276297, "uuid": "13cc68e4-2fe4-4309-815d-7a31faaf1dde", "value": 23476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649276297, "uuid": "225c3972-9172-4210-9a1f-039e54533a7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276297, "uuid": "d0051b3c-b4db-4584-90d2-5c4f9311dafc", "value": "f231d6c8e20a64f515f41f023b2aeeee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77969d60-b603-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649288654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649288654, "uuid": "fe8bda57-07b0-4348-955a-2fa5ecf64162", "comment": "Malware payload", "value": "34ff5b4557aa66c7e4b0dc21657cdc4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649288654, "uuid": "a8dd6cdd-ddf5-4c8a-a647-8f2edfa16f61", "comment": "Malware payload", "value": "32c5e5f424698791373a921e782e4e42a6838a68aac00d4584c16df428990e19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649288654, "uuid": "30121a75-f341-4436-925c-4e52b549e64b", "comment": "Malware payload", "value": "72cf36b6acc8f2c4460776493aed7f01c038301d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649288654, "uuid": "f52a5e80-b661-46ce-afc5-177abde6662d", "comment": "Malware payload", "value": "ea3c252f498206b89473a7ff6c5f062af628ce95130e0e44ddd96ff5ce6229b83db3c619b26567fc3c7da213a6924d31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649288654, "uuid": "ba8a160a-7cf3-48c7-bb62-4f179a257dff", "value": "T1CB64BF97936485A1E21846799823C8B51D3D7F319B03762B93E5BEDF3EB0207361932E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649288654, "uuid": "2de41025-7b4a-45fc-b33a-81c6bcc1f264", "value": "68d4adafbb6caa48c74a78ed79f6352f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649288654, "uuid": "233741f2-c5a6-4cd5-804b-5363585934a5", "value": "6144:cmEdSunAqHdroKcykhPBbiMV5xzr2fXlgwQ3qeN:c4ujKyUp+gOD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649288654, "uuid": "a6579597-8751-43fd-85c4-618c9f57b654", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649288654, "uuid": "22326c66-c3e9-4281-853f-f44f9fc2d858", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649288654, "uuid": "a2548009-8fdb-4438-aebb-308894bd3ffd", "value": "32c5e5f424698791373a921e782e4e42a6838a68aac00d4584c16df428990e19.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8417778d-b5a9-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649250021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250021, "uuid": "9d3314fb-65ef-462f-8274-e8d8ecd7e71a", "comment": "Malware payload (SnakeKeylogger)", "value": "dd2c21e695541d5d89745f8f10e120ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250021, "uuid": "5e7e290d-27b0-4173-a9ed-0cd9e693caac", "comment": "Malware payload (SnakeKeylogger)", "value": "34f69231e3f2f39a007e2ad3ddeef43e65667555040bdd5245e354e7c772a345", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250021, "uuid": "00764af6-1b53-43ae-8a3e-033f33679e6a", "comment": "Malware payload (SnakeKeylogger)", "value": "abf5b8bf039385337f8a1ca393e005d6ce2072c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250021, "uuid": "a8d14916-7542-406b-bdc6-d06b96fc5868", "comment": "Malware payload (SnakeKeylogger)", "value": "591aa5549c7b40cc0066f3d50506ba7ef5f57870e2a2a9cc1dc1b3069a4772d709ff2ec063ee79e8aacad4d7e91f271d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250021, "uuid": "2af9eb1d-9835-4dcf-921d-c7acb946b79b", "value": "T16794124C97BB9D50EAEF47B45020504233328117AE03E5BA8FED81A27BA679E05337F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250021, "uuid": "3cee52b6-3026-41a0-b7eb-b7d4712b6e95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250021, "uuid": "6c4ff5d4-67eb-4348-81ab-e54fe85953a8", "value": "12288:X0m2RASH46kyeKlECjQc6HFOC8KfynZNLj:EmhODmqnZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649250021, "uuid": "7a1cd88e-b248-4902-b61f-53cc2aed0fe2", "value": 419328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649250021, "uuid": "6a883dab-3081-4a64-8601-516a96046f2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250021, "uuid": "ce10684a-a020-4822-9102-0fdf3e5f6222", "value": "PROFORMA INVOICE WXBW-22040301 for Sharanj Engineering & Industrial Supplies Pte Ltd..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a52899-b5b0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649252870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252870, "uuid": "db3ad98e-2692-40c9-8260-ec8db95a2803", "comment": "Malware payload", "value": "ae81c364c98f3fc7a72075bdcf756a08", "object_relation": "md5", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252870, "uuid": "7457e849-7a8a-444e-8047-1ad174827144", "comment": "Malware payload", "value": "35718a7b5eeaf1ab2f5a6e59ee0be2246e95780797c80b62533760a823d9b0f6", "object_relation": "sha256", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252870, "uuid": "274f03ae-656c-47e9-b600-ae21779e6fed", "comment": "Malware payload", "value": "ba3266f82ef0bdfd5da1edd5bc8ddfa77d0f6a22", "object_relation": "sha1", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252870, "uuid": "e57e9232-4da2-431a-8986-2452eee7953d", "comment": "Malware payload", "value": "35190a3a4f2226ab45c02994a029431b79e9a95c8353b38caa52f9e68c848f89d89efcdf057a8603186f9dc82fd617f5", "object_relation": "sha3-384", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252870, "uuid": "f15ed3de-27c1-4c54-88b0-3779fb3297a8", "value": "T1BF661135F45536A1FC4DC0B805B00DE403E56DB5126B67C8227272AFE2ABF7CAB64939", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252870, "uuid": "e15d6e80-7d9b-4a53-8580-9dac52e3d31f", "value": "196608:QXjsTXTtMm8P0REycqw0IBT0byPHeqHNc:QYDT+kmwOWqHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649252870, "uuid": "d13f5ed0-bd45-43a0-82d4-37920fbbef88", "value": 6638338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649252870, "uuid": "2ed9e21a-4674-4f58-9beb-591b7b8fc418", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252870, "uuid": "203d7a79-a72e-432b-a3c3-2834d9269b13", "value": "FFsGz1ertr.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3daca72-b5b9-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649256973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256973, "uuid": "aacac672-5522-4fa3-b061-5236c9b9f611", "comment": "Malware payload (SnakeKeylogger)", "value": "72abc2cf0bda20a4e2da5040c460f22f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256973, "uuid": "11642398-2b22-48d0-9d5d-075d47a0fe53", "comment": "Malware payload (SnakeKeylogger)", "value": "35edc5ef499d3d36611769047630195bb59883cd9feb7c36c7988d59d0087ba5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256973, "uuid": "f637cc74-180e-40bc-9834-692c177c8fd6", "comment": "Malware payload (SnakeKeylogger)", "value": "9a6095c3787b4c5ef6d58eaa192f89a12e328b30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256973, "uuid": "b89c4e77-f689-4693-ba38-351d0d485af0", "comment": "Malware payload (SnakeKeylogger)", "value": "dcf5d84c68904cfed71b299b8f4dfc0bd614de932d8d7e1ea24d3c7759068c616371f13ae1e527a74a8e7ee6a2c3776a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256973, "uuid": "25ced91a-8896-414e-8489-5695ff4bbd8f", "value": "T132132A27F7947E77DA6E02734CB382050325EF969812D77FA6CC522A2E6334406F6631", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256973, "uuid": "f8c3853f-89c5-4ac2-a38e-ef74da6b334d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256973, "uuid": "a6e313f3-e3dc-4247-8979-e3936ec1f0c5", "value": "192:4jkuYKa9vpSpEgiLOnedzWYMz+bbL0ZgmSQgPVuYzkf92YoRX6tO8:7NqEgEOedyYpbUZ1EVbk92YU6tO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649256973, "uuid": "434d5e03-fbd4-4995-9292-43040bed1877", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649256973, "uuid": "9c6c96bf-5cc3-4b64-9dc7-adab6ce6c205", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256973, "uuid": "b6268ac5-006b-4fa6-ab8e-279ca84fda7d", "value": "file781066032010img.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7021db-b5c5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649261844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261844, "uuid": "a7aa2dc1-c4b8-47d3-8505-4431948c478e", "comment": "Malware payload", "value": "2c6c7e600627559c972d46e8698dbbd2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261844, "uuid": "52bedbf1-f66c-49db-a805-b2bc515f11e4", "comment": "Malware payload", "value": "362a068807ae71157b599502502eae7a488854b64780f1874db8327040b4251a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261844, "uuid": "83638826-ad08-4d25-b2f0-97a6122d1368", "comment": "Malware payload", "value": "9b518358db621354b700163b9c17d80d19883a2c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261844, "uuid": "48ea84e3-c7b1-4037-9f24-23c6ea918e57", "comment": "Malware payload", "value": "61855aa7eb11b6c7406b5adbd359b380bb60616ccc3fe4c22e70a70875b1b6ef192c1623af09318df32e7126bc1779f8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261844, "uuid": "66b9c62e-6b1c-4a9c-8067-03ce43a12c75", "value": "T1DA94E894B352A538C4DB3CF839099296629D5CBC37C971F67BBE41AD6B74DB0233120A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261844, "uuid": "e158b404-c30f-42d6-ad5b-28daa64e30d3", "value": "463401f61c44b0d918f1e23374db995b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261844, "uuid": "0216e87d-6ebc-4e63-9f35-d8f5b5c9f692", "value": "6144:CdM3bZVML7K0f+5zhHHq9xT+cVXuP1kbD2gqKRGq9roIt7y:C2Y7Kg+5zhHHq9xT+oDWIGUcIte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649261844, "uuid": "9dae6d1f-2eec-47bc-b09b-1e2ffd9903f0", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649261844, "uuid": "c3d358a1-2d2f-4e8e-9e82-37beff4d9f5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261844, "uuid": "94e98910-3f89-4d13-91a8-d01e8060faf4", "value": "emotet_exe_e5_362a068807ae71157b599502502eae7a488854b64780f1874db8327040b4251a_2022-04-06__161720.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60961474-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277878, "uuid": "d65f59ac-38b2-45d8-8bb6-a0a93d7b1ae5", "comment": "Malware payload", "value": "14874501156f46762d88e408ea8ee2b9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277878, "uuid": "5e52c749-8ff1-4480-99e8-d46edab2b806", "comment": "Malware payload", "value": "3660b9f166c20304f2829438bd2d2e4157ee5de4957047de5bae570d6bc13516", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277878, "uuid": "805d1359-2559-4959-b4bc-eb30fad196fc", "comment": "Malware payload", "value": "71d0d4e4b82022d886a5bbc088cb5e8034950062", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277878, "uuid": "d2fa8f3d-c93d-49e9-80c9-4508e83edf56", "comment": "Malware payload", "value": "3dc0fc4970738ac611cec4fce945104611f04f67755eac775620bb4a703a0c7464ce9e5639141ae40979666c0cf04921", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277878, "uuid": "384ec58e-9656-4bd2-af7d-ad2331a1370e", "value": "T19C210DDA22E6057B2DA1EAA7326D840E35D0E09B6CD79F5829EC78FB40CDD14644E7C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277878, "uuid": "f2c21e37-ab85-4c3a-9baa-9ba2ab74cc45", "value": "12:q0FC230FC21aCU84jBo0FC2vfX0FC2ZCRQX0FC2Q7y7H7clo0FC2jX0FC2w6x4OW:vC7aCUd9JxsnCRQsemLAlJOQLoNIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277878, "uuid": "44e3f03a-71eb-4370-b00e-e8e8ded66c18", "value": 1160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277878, "uuid": "67c5a9df-2050-4e1d-a60d-3589ed5ab22c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277878, "uuid": "331b7bbc-8877-480b-80ce-9fb9e99d10c5", "value": "3660b9f166c20304f2829438bd2d2e4157ee5de4957047de5bae570d6bc13516", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f2ee3b0-b562-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649219438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649219438, "uuid": "70fd2a96-c00b-44c0-bdbf-306d6f7d83c2", "comment": "Malware payload (SnakeKeylogger)", "value": "4ab038516b31109e810919d346740a38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649219438, "uuid": "2a9c0163-0711-4db5-8e5f-5d5ee7475c60", "comment": "Malware payload (SnakeKeylogger)", "value": "3664ee381fec01c8ec57930ea0d3b77705376b023969e2b02aabdd8b043790df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649219438, "uuid": "4e5d229e-4047-4191-9b4b-1d34aef2299f", "comment": "Malware payload (SnakeKeylogger)", "value": "ea45c514f016273ebb0ce9b6839eb5785ac139ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649219438, "uuid": "e3b89861-8150-405c-a7df-1e29210c17e5", "comment": "Malware payload (SnakeKeylogger)", "value": "c5cbe4a57fdfd41e18993ddb4538bab90be1550ea82d727a5d76be6c51999531dae2d7117d42fd901b703df5c99ddcbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649219438, "uuid": "94802d67-d7c4-4296-8278-1350ae3fcf36", "value": "T1FCC41830F6BA5608D9B64B701C3A5BD1177ABE2A7A04C76D3659320D8D326338B11BF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649219438, "uuid": "d1212fc1-fdaa-4005-aa35-cd3c8f2e218b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649219438, "uuid": "150513de-a89a-4abb-8af8-f57967964896", "value": "12288:kl5DCmYz/YPxZvB1faCT4hQp2lRB0Z61:aCmYz/YTledy41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649219438, "uuid": "3566bed5-08da-4b27-ac12-5d9296335c2e", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649219438, "uuid": "716b49cc-c24a-4822-bc6b-6f41d171fc92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649219438, "uuid": "8b83fdf2-82cb-41e0-9879-8051b92e4a27", "value": "SecuriteInfo.com.Trojan.Inject4.6572.24617.1513", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d2bd4d-b593-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649240355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649240355, "uuid": "920b3cb9-f15e-4ea6-a1ec-65c36533de6e", "comment": "Malware payload (AgentTesla)", "value": "fd8d29f22a7defb7054ee5d78aff7636", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649240355, "uuid": "950d1f76-dddb-4966-8618-bd801d4b5f42", "comment": "Malware payload (AgentTesla)", "value": "36d41fa222ccc75d632601168bd851e74eb3713eb221ea6a1ef5db2b3f586081", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649240355, "uuid": "30d7bf2d-a603-4aa3-b2ac-6c3c94839d6e", "comment": "Malware payload (AgentTesla)", "value": "19c171a1fb826719e7a3c8ce628fb4abfa74244e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649240355, "uuid": "1a0a18f1-5358-4fe7-8468-278b14836055", "comment": "Malware payload (AgentTesla)", "value": "e1c4c0ee41ae5ebfe07a4fc0612be046dd3a67790daf7089c8e215d3ceb552de986e25be7b17a08fec9fd9c01a7a9fc2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649240355, "uuid": "965fa5fa-5907-44f6-b603-df52119d6529", "value": "T16F34F782E9006674EE68AB346E33CD3507127D7DAD78942D24E97D4B3FBBAD36025423", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649240355, "uuid": "573c5bf1-5431-4be8-baa0-eaf040a77f2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649240355, "uuid": "62165f02-8900-4f33-bb7f-9b0c28ce673f", "value": "6144:xE08tYL/Z8EWrdm4Vz0RpppppppppppppppppppppppppppppI:xnWrdm4Vz0RppppppppppppppppppppG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649240355, "uuid": "b2ac8c27-9d11-4dc2-9e1b-e9d7ed2d9943", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649240355, "uuid": "63921f08-29ec-466c-904b-7dc899fd1b28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649240355, "uuid": "5a95b4b3-6af1-4e92-aac0-096147ec036e", "value": "PURCHASE_ORDER-FHQN45WCM9T.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e077d7f0-b599-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649243304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649243304, "uuid": "3c463212-0e57-4810-acdd-4f8ca6a74e52", "comment": "Malware payload (AgentTesla)", "value": "fef67e1eff3bac65c3a868f6af97882e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649243304, "uuid": "2c49f0e0-a1b2-48fb-9a2f-27b2a15485ef", "comment": "Malware payload (AgentTesla)", "value": "36dfb87d0ffe4556d9bc08eaa799676c15939d2ded7c879688022305232c4ef5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649243304, "uuid": "49f5354e-a81f-45fd-b4c2-0ede265fe03f", "comment": "Malware payload (AgentTesla)", "value": "d2e49c94cabf9dee39103b92952129dccb22b970", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649243304, "uuid": "256a7165-a1ee-4ebf-9bdf-7005a6df83bb", "comment": "Malware payload (AgentTesla)", "value": "abb06abb9b8f5821c1576f5d58e0a6caa7b96e68264ecd0aeece5ed84afe5c7577bbcd82c1038e4c461de8b43180fada", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649243304, "uuid": "94db4b3e-6f88-4354-81c4-7f06a6419b31", "value": "T1A873DFC0BB80D5B2D56802B1E6B7DBF093229F28E42A8F1F24D07D2F7E517429E57661", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649243304, "uuid": "2961a2b7-0ecb-44d6-9b14-e33c47697d02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649243304, "uuid": "774cc3ba-4f3a-4eb5-8e66-0c26322044af", "value": "1536:uj8B+TbjXlvAPBGLX6cMxkWFUzaR5IyS2eNXeLap:uj6wbjXy5GLX6cELQaIVv0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649243304, "uuid": "930b6e64-ee78-41c0-b26e-a16790fc99d7", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649243304, "uuid": "b7c260ba-67e7-4c41-a1fb-5d925af4f294", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649243304, "uuid": "fe4c5655-85ba-4ad8-b262-5694e8416320", "value": "Paymentcopy-pdf___________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb69816-b5ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1649257367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257367, "uuid": "c3374939-7440-4109-bad1-309c2cfbb6c1", "comment": "Malware payload (AveMariaRAT)", "value": "d6be19d7c601e8259fcae55ea59a83d7", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257367, "uuid": "f210c8e6-6bb7-4e8c-8029-bd7d2602d8e2", "comment": "Malware payload (AveMariaRAT)", "value": "3725297fa3480b3c6095e3ca8b71affeae4221feabdde796a180798a8f12a06a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257367, "uuid": "18874fcc-1b26-4f09-96d1-e78ef79a978b", "comment": "Malware payload (AveMariaRAT)", "value": "e4dc0dcc4028477811a1ea9a05bc5a2a18c4413b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257367, "uuid": "e8515dcb-e5a9-4aba-9197-134d0665c317", "comment": "Malware payload (AveMariaRAT)", "value": "1a534b5958a2a6069b9829fae1ae6d45fba3f04e5111cb1354f46469eb911a1c1788129fe2fa304249e7f1b3845dd73b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257367, "uuid": "65884530-0642-4bac-a7c1-e7bc90b29ce7", "value": "T1B5A40294B6ABDE13C5AD5AB260D3240183F09F13E4A2D78F6BCC559F5B123E51982BC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257367, "uuid": "93293598-d379-4b0b-9d56-de2f6dd77adc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257367, "uuid": "7940f710-ed60-4f9d-98e8-02a906874ed0", "value": "6144:ieVREjV3UMRE0iH7lzntKa98xb5kxsHhUAaj9+sbHuLAzohChsMjmmGMt9jK1LZt:0Be9xntZ1AkkyOQoA5jbGMtE1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257367, "uuid": "7bff4d33-6d05-479f-854f-0809c102a30e", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257367, "uuid": "7c20002a-31fe-430d-8391-a3403c1e61a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257367, "uuid": "bc1c0e3e-437a-4033-8f27-7bae0d9430b3", "value": "INVOICE_.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452377f7-b5c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649262370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262370, "uuid": "db462bdf-8157-437c-b604-02281cf6ca16", "comment": "Malware payload (AgentTesla)", "value": "320be5ddfc49c98207d6c7a4a964d455", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262370, "uuid": "7e4ca394-ba40-4f14-bf43-0eb88b7abfc6", "comment": "Malware payload (AgentTesla)", "value": "382135bcf652dc5942c64451a0620ff16677a384c4b8388299898934206eaa93", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262370, "uuid": "82d67cdb-26e8-44fe-8404-b44202bdfdff", "comment": "Malware payload (AgentTesla)", "value": "ead326e46f7e6c80fc9891b16d9e5d4f9c96632f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262370, "uuid": "1ac78c72-dc7d-40cf-99c6-f4ab4b955b00", "comment": "Malware payload (AgentTesla)", "value": "f037a23d4d8c0a443365af076c11e7e2b2cc97f7789e9b0983246c7a846c6a22161fe41279136592257f3edc1aa8f197", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262370, "uuid": "82f0b532-6a2a-4c5a-a7de-aea4cffd4f41", "value": "T1BEC4124963E42306C87E67F7F87A56550BB2292B7562EB684DE160EF0A17B10D603FC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262370, "uuid": "45aba255-eab1-42bc-891e-2697008fa811", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262370, "uuid": "292830ed-0e1d-42e5-80f4-67226c88b328", "value": "12288:y2QSQ9gZly3WCaZnh1nGC8b+n/F/VCR2M1Kn7NF:mSQ0lyJaV7l/n/FFXn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262370, "uuid": "03dab2a4-f06b-41f6-9511-ed9b3b0f59ca", "value": 546816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262370, "uuid": "bb9e30a9-796d-4a0f-a5b7-e3179b35cca7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262370, "uuid": "891a72ca-0145-4ac8-b0bf-616c71418d8a", "value": "AWB DHL 7214306201 Shipment Notification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc631e62-b5a0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649246277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246277, "uuid": "50ca38fa-57fe-4284-b309-4d4b7a3cddcd", "comment": "Malware payload (AgentTesla)", "value": "9dd484904012643171effa7f089dd28c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246277, "uuid": "e7193382-3ecb-455c-941b-87c38643a0d7", "comment": "Malware payload (AgentTesla)", "value": "383fff675790452026d76d5459c6679d0f0c07d4cac361273e6ff82d5caedd5c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246277, "uuid": "36c5524c-46aa-4448-9d9e-c338eca77b4e", "comment": "Malware payload (AgentTesla)", "value": "d60f7b7a31d0693a9e617e4d0213ff92565d8bf5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246277, "uuid": "e2e8f141-223b-4e49-9aa6-a33f47d333b2", "comment": "Malware payload (AgentTesla)", "value": "deeed7e73690157f56db97fca1d9a993c3290b5d35200f2119f2d0fcc23062d6fe30a8c9a062f5502b909917a11daa85", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246277, "uuid": "b5b888f8-597a-40a9-848b-f51abcf2d456", "value": "T1A0C41296A32BDD16D52C6A73E4E2241183705F03D16AEB4A7BCE81EF0B533991943BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246277, "uuid": "267cf45b-5135-484f-b495-7ed17109a69f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246277, "uuid": "a427c180-6604-48ed-9cd6-fba032bc5c7d", "value": "12288:fMCIZi4le70PzEWEjbdOAv76vCz7MHMRuRlfNeGzwZ6QwWF:sZhlLzEWOEAv7+agsIfNeGzq6lW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246277, "uuid": "3f15b16a-4b26-49d6-8b4e-1305816553d3", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246277, "uuid": "3f56534a-149f-4c2a-b4dd-44894e917c31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246277, "uuid": "c18a16b7-da4d-412a-8732-2343cae8d7fc", "value": "Signed PI April xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2145721-b5e2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649274606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274606, "uuid": "fa69d7e4-8a09-4b35-ba65-ee912fc7534a", "comment": "Malware payload (Mirai)", "value": "ac06eb744a8c5eb48599413e7bc05bec", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274606, "uuid": "78b12235-4c9c-4cdb-897d-fe43681a8fae", "comment": "Malware payload (Mirai)", "value": "3858d042b74ee145c25a70285ad9eba85ed0b40a05b1ccf77b86681ac10770bd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274606, "uuid": "224f7de5-f23c-4eea-89dc-ea7d54a292f1", "comment": "Malware payload (Mirai)", "value": "dfc792cf5567f60cab5b59c435177e8e11036e36", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274606, "uuid": "57edacac-3f83-4308-9e65-cc2980dd238e", "comment": "Malware payload (Mirai)", "value": "71e9828f08bd31f32de7d8f09aa200a335722410bf6b19191a8137ac7f8651270fa09141bd79a04e7251b32bdd25532f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274606, "uuid": "9ca2603c-e3ed-4cad-9da3-5d8c2b0725f9", "value": "T13AD2E12034AB8B61F59122754B799F99BA714F79C5FA63F09C805073CEC210B7079A8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274606, "uuid": "cbc80673-b5c6-423f-8ea5-d18f8775ceee", "value": "768:4YxM8iWr1rN7qpbPincsI6MS11FE2M0As3Uozk:4YO8trN7q9P7gMGFE2Mazk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274606, "uuid": "5636bf1f-6a25-46ef-bff3-050619f9083f", "value": 30448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274606, "uuid": "ea4485aa-c530-4f97-99c3-829d220e16cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274606, "uuid": "f235cf1f-71a1-4394-a1dc-bc6e34724e56", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0237d5fe-b5e8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649276861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276861, "uuid": "7a28c65e-ea67-4e3b-a8ff-d2522f43d9fc", "comment": "Malware payload (Mirai)", "value": "304da33281889df2a84e9705c09533a6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276861, "uuid": "4cb65914-9ab3-42ae-8634-c6be3b6686a1", "comment": "Malware payload (Mirai)", "value": "38af05bf2c7beea9c4070cf1ad224cb686c304ccdcffca9f17022f75749c6372", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276861, "uuid": "07c2a54e-75bd-453b-80e4-05d0fc84b325", "comment": "Malware payload (Mirai)", "value": "cac30ec893bb6aef19a12a7672fce8c79c9585f9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276861, "uuid": "ce066533-3fe2-4815-921e-4d9b653139d8", "comment": "Malware payload (Mirai)", "value": "2b2c66f82944d54503822b46a4ef402f549aab10b207bd8f93dd9f947d5212f48d9ee85d60131d7433cb17e73337dc3c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276861, "uuid": "bafc6a4c-5d73-42f1-947a-186498d9abd9", "value": "T1BE83B30ABFA14FFBE89FDD334AED1705259C541A22A93B757974C428F24A24F09E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276861, "uuid": "95c35a37-ad54-4a81-94ee-ce8622f47fc9", "value": "1536:ChEDUAXnrmFbHCXMoumRafa4CrQre3s0PzZE0yM/lU:CuDUAXnrmFz7mUfaHPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649276861, "uuid": "d5854bfe-f448-409c-aaab-65a9a371b356", "value": 84028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649276861, "uuid": "08164989-bdac-43d3-988d-c3db2cd32f31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276861, "uuid": "4033caa1-3b17-4bd7-b2b9-28ba40eb6ab2", "value": "mipsel-20220406-2027", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ccb7970-b5af-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649252398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252398, "uuid": "f1989f43-9be9-4c28-95d7-d69235418352", "comment": "Malware payload (AgentTesla)", "value": "39756ad552dfac6470e4d21eac3080d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252398, "uuid": "9bc19e86-e30e-40dc-9c13-67ac2ddf6a97", "comment": "Malware payload (AgentTesla)", "value": "3926f5fc4ed1def46a7062278b5d6645c66d1b81123029c5d6086ac153bc1252", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252398, "uuid": "4c4107f3-93c3-4327-abba-b2917df301e7", "comment": "Malware payload (AgentTesla)", "value": "0f8c24896044179b73115b6bdf2c581d7e6dc85d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252398, "uuid": "a23485b5-a29c-4c36-8700-c203387084c6", "comment": "Malware payload (AgentTesla)", "value": "9c20495d9f2a3f049356f671031f032fc53150ad9acd885145ec3a5b2b481de1d8afbb4b015e9bb762b9cb4388d15835", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252398, "uuid": "a592cb8a-1e6a-4835-af3e-16459252059b", "value": "T10794F009664CC85BE3E479392FA1C6F08B91AC5E991C8A5737F47F8F38FD2876609211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252398, "uuid": "a8c7a4a3-92e6-4e85-ba79-c9435efae7d5", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252398, "uuid": "fbb49ed0-f9a4-4f77-a1d5-f9ca82f1813c", "value": "6144:2NeZQQWbjB3nELUGVNyzJSu+Gpibs+WbHYkpmQEfwOSx2zzoUd:2NcYjB3yWzJ8pWb4FQEfwOZztd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649252398, "uuid": "ceb6f9a6-6255-4b76-a7e5-f19785a23cec", "value": 436417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649252398, "uuid": "15c27122-a665-463a-af43-b628ee9bfd76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252398, "uuid": "72bfd86a-76b2-4d69-b293-630ae6c99b2e", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc08b32-b56a-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1649222816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222816, "uuid": "e998602e-7a5c-41b6-9960-3bc7be60a924", "comment": "Malware payload (SilentBuilder)", "value": "0d4663777273b64b35aaab895a378f0a", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222816, "uuid": "3226557b-9b4d-4e62-ac73-c4bf72cda633", "comment": "Malware payload (SilentBuilder)", "value": "396b3021587fcbf09e3f5ded6c9922f91564ea6b9bea65ff30ce0d7f1c9bfdb6", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222816, "uuid": "4353e5dd-d854-4dad-abf7-e770a7d40af0", "comment": "Malware payload (SilentBuilder)", "value": "6a9220cf81e552226f1dc278cb075112652a44a0", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222816, "uuid": "71a5f6fe-f52a-409c-88a0-3ba05d2c1e66", "comment": "Malware payload (SilentBuilder)", "value": "8380b19f10303ec477f9197657a328199fedaacd62b689b40a418b6148813860213834794c2c7ad2ac1fc95988b4fd0a", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222816, "uuid": "fd8ec6e1-ae28-4a8e-a5b0-6335d824c4d3", "value": "T1E9B39D4BB669D459E923477988EB475A7327FC341F9A47836354F3292FB8CE05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222816, "uuid": "4b6ac3eb-d3dc-4abc-bacf-14148627a1f3", "value": "3072:jsKpbdrHYrMue8q7QPX+5xtekEdi8/dg+tgSmsCpH/KZuAZGsMp:YKpbdrHYrMue8q7QPX+5xtFEdi8/dgwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649222816, "uuid": "e228aa1b-63c9-468a-97b4-1f71e8aaf674", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649222816, "uuid": "d6488806-010c-4661-b2d9-0b9d4a68cbc9", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222816, "uuid": "b75b1031-319c-4b2e-9640-c98794895fd8", "value": "0d4663777273b64b35aaab895a378f0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c72137-b5e8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649276862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276862, "uuid": "d3bcfb55-fff7-415d-8171-30bf3ff53525", "comment": "Malware payload (Mirai)", "value": "26e1b3271458d1935dd01a84fab6d8bd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276862, "uuid": "f7d611cb-4be0-4f88-a948-db88d6d85a35", "comment": "Malware payload (Mirai)", "value": "399b46f1322710243fee2eb34c4d752d1bf23c2079e59380e1d249470673d7b2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276862, "uuid": "a68ab0e7-f674-4f97-9853-0628bb4e8a48", "comment": "Malware payload (Mirai)", "value": "bd6a7f2cdde08d158823fc4a13657257667c4098", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276862, "uuid": "5d6dbecf-cde4-4a5a-9ebc-87331e3d33fa", "comment": "Malware payload (Mirai)", "value": "46a1239c98cbcd1106e3900ad98e2047c27426457910e47d02a2540a2d0ead97e2317e3a1248223f3fb8527742e1c388", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276862, "uuid": "3afa6424-6359-4b08-bc3e-c6d90d79c213", "value": "T13083950D3E318FBEFB9C82394BB74A21A65823E627F1D5C4D15CE9051E7038A741BB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276862, "uuid": "8e58764d-c13b-4e2f-8da6-21677c4ac35c", "value": "1536:0Y18HQ7QMF987jb+jbXVjb0nHcCi5PvzGk2CHtubAiWyOOPMKfofELUa:XqHQ7PyDQ5PvzGLdbAiWyOOP9gA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649276862, "uuid": "2841d202-6281-4aea-b854-89f926af164e", "value": 81420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649276862, "uuid": "b81f1037-a928-4b16-a923-6763b074cd19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276862, "uuid": "b4f57cf0-a192-4c6c-a8e5-1c0a534373c8", "value": "mips-20220406-2027", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ff705c7-b5a8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649249450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649249450, "uuid": "b6e07881-7a11-45f9-8784-04e14888ffae", "comment": "Malware payload (Formbook)", "value": "1ec32fc69f981f88c987e1648e45e934", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649249450, "uuid": "847ad920-d177-49a6-a144-a2ba3080ef00", "comment": "Malware payload (Formbook)", "value": "39c14a3d9b118c4c06f7c1f9319617d81edbc6ab56276884738040d7becb3717", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649249450, "uuid": "95902423-cb58-4c7f-a7b3-3c4018f50ece", "comment": "Malware payload (Formbook)", "value": "2e52ce30df90e3fa4c048ba2d31a9a3357369aaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649249450, "uuid": "b15e764f-b0df-48b1-abcd-00f686905d74", "comment": "Malware payload (Formbook)", "value": "caf9e350b8983c67a2caf4768f570af5660a2f7cdeb57fea7342db48c258caf6b220a9175ba5b6abf387e7e7b24c37ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649249450, "uuid": "235402bb-bffd-4a27-bbd4-70eaad332055", "value": "T1CC34126777D1C5A3E59392324C3A6BB32F6B65212014C26F6B301A8DBE175C29D1DFB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649249450, "uuid": "d7d92633-8b10-4c1a-8608-1b8b50a5cc9d", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649249450, "uuid": "6b0bdf8e-87f1-4420-bf4d-bc67c94b95d6", "value": "6144:HNeZmbL9ay7NV2c6PDj7R4yic+5sSWxgWCVW:HNlbLPV2c6bOyieSWxgDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649249450, "uuid": "79928801-57c5-4058-b587-f4f7637d9d0c", "value": 247920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649249450, "uuid": "241b7e5c-dbf3-465b-bf4a-f3de7a7ef954", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649249450, "uuid": "36d85c88-5c9c-4263-ad11-758cea99358f", "value": "lacy cpt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "504b311e-b5e3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274845, "uuid": "163f7a83-85da-4a0d-9a28-b8a56269092f", "comment": "Malware payload", "value": "a562f7c9ccd1e3a1c3a409a5c5e49085", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274845, "uuid": "a831379f-88af-4b70-8123-732fab04dff1", "comment": "Malware payload", "value": "39c71698a8848c67e99714cd8da2e9e2d699930c536629b6fab989576b3c9ea4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274845, "uuid": "9ca4fdc0-5702-4355-903f-336d4a141a05", "comment": "Malware payload", "value": "0fa9298e855e000529f73148e7794f54c7fc22f8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274845, "uuid": "f5bff281-d20d-4624-9532-9d20429451b4", "comment": "Malware payload", "value": "0d3e6674c37d667c7ecc64fb27d2dd6d6442ccdba1b80559209fe395c77854e42b69ede5d394fa0db5aca92299995b9f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274845, "uuid": "a59e1194-3040-40da-b9fb-ab11301bda2a", "value": "T13E619ACB036223303CD1D97F77FE071A7650E4A951D9BA09E9E8AED5C24CD093385A87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274845, "uuid": "a4a07d8d-a72b-4fc9-9ed8-d79faa238298", "value": "48:MnisymOkKHn3F/g/q/lFnFSFraQGKvFkmRFAKFFnFSF7B+FGgrFsO93pFZnsFPt9:MisymOkKH3N82lmLvfFGCfLpU+iR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274845, "uuid": "2d3d11a2-fa9a-476e-8c9e-f28ea5794725", "value": 3265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274845, "uuid": "8d6899da-0e30-4bac-86d7-5db91eacab81", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274845, "uuid": "33ac5c6e-84ff-490b-a65d-20eb87eb3051", "value": "39c71698a8848c67e99714cd8da2e9e2d699930c536629b6fab989576b3c9ea4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea2cb241-b5c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649262218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262218, "uuid": "58849f36-11a6-409f-b6bf-6a34b4b3dbb6", "comment": "Malware payload (AgentTesla)", "value": "d3bb1654bed2c322cec3593a04d436bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262218, "uuid": "e2f50a21-0080-4d14-8a49-baac12b0b74f", "comment": "Malware payload (AgentTesla)", "value": "3a0400b7c20cf3f0db485161878f1328648681417b23226cd88a3e122faab345", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262218, "uuid": "3deb23f6-7094-4070-868b-688d48f820aa", "comment": "Malware payload (AgentTesla)", "value": "ebd0f4ed03ff91a15b2cc9df1f2f53c82e3621fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262218, "uuid": "ae62ead1-6613-4d5b-a8be-2048d5acc4a0", "comment": "Malware payload (AgentTesla)", "value": "eae9807e27ef5c84e121ee9b830b172ae37d688234da76e1341873f63fdcccf776b136227ce0e875f2d35738782ca902", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262218, "uuid": "84bb02f3-a642-4843-8473-0657549c3ab1", "value": "T1F1C41224A3ABE905CA6D97B7C8E659800370E913F4A2D74F2BED415E53133E64E42BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262218, "uuid": "653f345a-c9e4-4d81-9cea-4a8b768ec3e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262218, "uuid": "e1e5dfe2-d469-4f29-955c-62b5fa32b7aa", "value": "12288:/o1UE9a8/T0QlsnrTmnFr0yboo7Lc/pEXiPYA2Pq:uZau02imFr0yboo72TPYA2P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262218, "uuid": "39a705c1-7b53-4e9b-a172-1acbed49e8f1", "value": 559616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262218, "uuid": "853baeaf-bdf0-44fb-a2f8-65a32a03eac5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262218, "uuid": "96834024-e76c-4a78-b315-61e81bcfedc1", "value": "ye \u0130\u015fyeri Ekstres_ Garanti BBVA POS Esktre Bilgilendirme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b1bddb7-b5c8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649263213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649263213, "uuid": "a324182c-479a-4685-83e2-ec64b626f78d", "comment": "Malware payload", "value": "dce19521a9244e07348ad6d9594d0e82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649263213, "uuid": "7ae56d9b-ecf5-4fb3-96f8-edc40bee3d86", "comment": "Malware payload", "value": "3b14b04160d49bdd074d3d571992ed5333b8292a3c0f8f58988c606bd91408f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649263213, "uuid": "1079d08b-87d9-4c93-94ad-2960ec77a7db", "comment": "Malware payload", "value": "0afa324ff68a5e398c1c7d2b1c86ad2c8cc1c9aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649263213, "uuid": "e79f23aa-17aa-4a71-bda8-875730549033", "comment": "Malware payload", "value": "85a87c85036f864e6734c545e324eff4a3391f0d87388e2e008e0cb0ebbd626f5898715d6428f98f07190f63fcfe9342", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649263213, "uuid": "b0573cf4-7943-4a0a-b3d3-93b0f89b3f0e", "value": "T154A2106C7BD9FA3DE57ECB339351021086336A8F9265C70D4B9E1C822E3E5690689F61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649263213, "uuid": "9e98aa9b-9437-49ea-8799-a29399f80e0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649263213, "uuid": "591fda8e-4752-4c71-bde6-f532f1af0b41", "value": "384:7fGDq/aQWkYFX7MEC6UVfvLGZkvLYt5Pw:jGO/0kV6QfievLYt5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649263213, "uuid": "92af5ca5-c795-44aa-b1ee-9146345f4152", "value": 21504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649263213, "uuid": "763e3590-fbf1-47ae-a983-cafdfbffd605", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649263213, "uuid": "628667e6-8a41-4b41-ae16-4ed9278eb81e", "value": "dce19521a9244e07348ad6d9594d0e82.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce624535-b5de-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649272909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649272909, "uuid": "f115eac5-f9b7-47c6-a43f-53e3b70070b5", "comment": "Malware payload", "value": "1a72533d45c878cf4f35323e57c00887", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649272909, "uuid": "a1e73dc7-b1e4-47ad-861e-98647570dc2a", "comment": "Malware payload", "value": "3be675ec356a3be326ebd0438462c608e99e0b1a56518d35c963d4e69f875f7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649272909, "uuid": "fff56186-75b5-4787-af0e-a09a823c381f", "comment": "Malware payload", "value": "06c6baf7412f64a0c63aede7325e16636d34ff06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649272909, "uuid": "1118336f-1d33-4ebc-81d3-dbd3ccc8f0f0", "comment": "Malware payload", "value": "2c3a63abd57a233f684734163d0a702f8f4a3f13cab49d803c716c968cac942799d49f494214f50eda233150ab08f1ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649272909, "uuid": "4933c1e1-75f2-4902-878f-b9894f2f3776", "value": "T1A3941293E9919C36C220A9FC2C6FBAE1AA2E30323C5551737EA44E5F94373D14D2C667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649272909, "uuid": "147d7379-1231-4d85-aef6-691d53e3fd6b", "value": "56b44d0343443ba312038763109ced57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649272909, "uuid": "72bbb220-fdb3-47fe-8f0d-73634d96451e", "value": "12288:ZGS1TlXeRBg0wHjFuSkRnHknDN30i0tLQXV+O:ZlpiwhuSkREnDGbi+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649272909, "uuid": "5b6eefd7-a4c3-4ab8-9351-e4513f18d52d", "value": 432880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649272909, "uuid": "167bbc25-d549-45e4-b214-e75c63bb9a63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649272909, "uuid": "63566e8e-fda8-456d-a92e-b9540e288e53", "value": "Payment receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d29c3d9a-b5c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649262608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262608, "uuid": "c09b8865-9a00-496c-ab99-22e9ab06dce9", "comment": "Malware payload (Loki)", "value": "2919fee1a0bf6eb2564babfa22384477", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262608, "uuid": "fbbc2647-72a0-4c9d-a7c8-682e14706ec7", "comment": "Malware payload (Loki)", "value": "3c0280d0c3917d7163fb805b31bc729ffa63eea0fa04c8df4ff5dabd5842217b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262608, "uuid": "5a2c2332-f38c-4c23-9c7c-c0a24ddf2feb", "comment": "Malware payload (Loki)", "value": "9bf446aad5461c3cbf6f2a0c47b4155178beccb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262608, "uuid": "afe15187-a1b5-47ad-8107-01346fc00335", "comment": "Malware payload (Loki)", "value": "25fc69c5daf905ebe4823f2d179f866c08aece465fee6337396e3a42acd366cb28d2ce7fd5a0ffd19f7906ace8427218", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262608, "uuid": "857f5539-9f9e-4e2a-ac14-49e14abf6414", "value": "T15864BEC27292D471C0532D30A862CBB1657B7832EB74543BF778AB2F2E703D19AA1756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262608, "uuid": "66e84e20-e53f-441e-91ad-b692d7dcfdbb", "value": "84464e125c276a9ead62be3c5a8b92f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262608, "uuid": "e3fe84d6-d36f-4496-a199-3fd0c97077c8", "value": "3072:YJXDSgmNRpLZVj8kzBn5620H63O2EkSclrhLLwX2KE0KPVggjcGkNIVqI7sxkga8:gDoH78+p5pM63BXYHE0Q7ITsq7iga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262608, "uuid": "ec0a61df-661b-4935-ab30-cd11688bd84d", "value": 311808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262608, "uuid": "3471200b-0203-455d-a73b-c6ba72bd620c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262608, "uuid": "4a81c189-0ef2-4eec-b12e-4c3b59354357", "value": "2919fee1a0bf6eb2564babfa22384477.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63210e4d-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277883, "uuid": "094a231f-7f1c-4d39-95f7-53a22eca4af9", "comment": "Malware payload", "value": "240d4b912ed69e9b08c6b683bdea66ae", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277883, "uuid": "fe0a2eef-249c-4892-a0ee-108c066477db", "comment": "Malware payload", "value": "3c0a0e1939c2e26ab0d5d288891619caf8caa49d123850a4e00f76f96e9d5543", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277883, "uuid": "aebd7d91-34a3-48a4-b1f7-b1def719bf50", "comment": "Malware payload", "value": "7cc29429d2f564e7b84e8040a69e0f15fd0621ef", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277883, "uuid": "3becbe86-f6c1-4b8b-a2a8-72e7aba5622b", "comment": "Malware payload", "value": "bd11c2ad2c1b23c9d025eb97cf12537b7396cf5acfaf9b497fdf9978a07bc555cb4ae7a54a51d7efe9e148257aa6b3da", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277883, "uuid": "a763504a-2b64-4e81-afdc-c0e30cb752e4", "value": "T16411D31E37D1FCFC7967BA50471EC428E540D79B907B6BA27A5B49EE7890484922C43C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277883, "uuid": "1091b94c-ef8a-4456-aec3-872051cd79fb", "value": "24:eWnSlPPPmBePxSJo3ys4Iad9YYIBYI8u0aNP1FzqoA5:eQgnuBeUJo3y+adCYQYyP1FGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277883, "uuid": "486e11ad-ae08-423c-8b5f-aca189d7502c", "value": 1094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277883, "uuid": "37b2210c-4d94-4e50-a280-92df7a8f6435", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277883, "uuid": "fc88c15b-1d9f-42f1-9e8f-59f9bf34aec5", "value": "3c0a0e1939c2e26ab0d5d288891619caf8caa49d123850a4e00f76f96e9d5543", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d382aec0-b5b9-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649257026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257026, "uuid": "9789a00b-ffd7-45cd-ab0f-73a8d81cf1a4", "comment": "Malware payload (SnakeKeylogger)", "value": "e477c5a72a40c51d59fe10b474ab2df6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257026, "uuid": "f9da797d-8513-476d-88e9-09e8932d98a4", "comment": "Malware payload (SnakeKeylogger)", "value": "3ce3bf75aef18fb7f79473315f7d742e9f5993df1959ffdf35d922fc1e2556f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257026, "uuid": "bebced75-fcc0-4830-a076-4f8126a26a79", "comment": "Malware payload (SnakeKeylogger)", "value": "373a711cebec92c76dec9b0d9f78f7970d368171", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257026, "uuid": "0e9a5075-5b26-49f2-9d75-c374fbe5ed16", "comment": "Malware payload (SnakeKeylogger)", "value": "529395d6a617441a6e73a9f849cd6ab7feb63922515bc47ceb51a1e546f33da916322ecc6b25a16d3e95a6d23e3b7484", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257026, "uuid": "faf3b1eb-e9f9-4639-bf86-ef1319a7f74f", "value": "T1EF74DFC1D5004B95D87257F0C4B90B02E7B13EBE896CD65A78B53EB2B4AB3832477987", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257026, "uuid": "94625f37-f5aa-4dfe-8ebe-8ed15d55fc20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257026, "uuid": "01526558-9eea-4d9f-b6d8-732de02709b7", "value": "6144:G3gd1MYICxnVpvBGlCGOyRoc6vsF8Lh3UPpK3wHEVdJSsj:0YPxPvBGbKc6vskwpS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257026, "uuid": "b1755935-ccd0-435a-bedc-5d5f63204554", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257026, "uuid": "3834f125-19fa-47d2-853c-89f997439a85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257026, "uuid": "d723102a-7029-42a9-95fa-3150962a4a2b", "value": "SEP021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40dcdb38-b5c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649262363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262363, "uuid": "bdeb3172-24f0-4283-a954-09c24ccba64b", "comment": "Malware payload (AgentTesla)", "value": "e7e28f228bc7b8070480370ff6c2735d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262363, "uuid": "97ae099d-2468-4506-a79d-ca5c04e1b02f", "comment": "Malware payload (AgentTesla)", "value": "3d30b8f3eafc45075239885078ffb4e28faeeccec7e5b94c9680b159ed4c989f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262363, "uuid": "80d7b86a-5702-471a-b70a-5a75cc4b6c8d", "comment": "Malware payload (AgentTesla)", "value": "ef9593c8be42265edd5a1916fb9779434bff1458", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262363, "uuid": "8e5aa30f-c8f7-4639-b1c5-c41ff4a2a393", "comment": "Malware payload (AgentTesla)", "value": "5facba3a25025ca7b1fa8a87cd34cec1bda6bb0835b4f52da4093f1be3a458aa8f3496c0162c0b442b9664ce4560c8f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262363, "uuid": "9d7838b6-d41c-4f31-bbed-a544fd5520b2", "value": "T111C4120133E86325E8FD6BF6A87A21410BF1793F2870E788C9E670EB2956744D542F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262363, "uuid": "0aff514d-092c-462e-bd65-4633e0b41fb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262363, "uuid": "063fe6e8-7693-45e3-a058-84d1f0773f0c", "value": "12288:IUKaXHGZsB+BQHIJIHaJ9BXw5HZIul2lIlvF:owmqW7ae9BgtZZ0Av", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262363, "uuid": "0bf71e1c-710c-496f-8973-f8f83894e0e2", "value": 543744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262363, "uuid": "84428af1-4fcd-425e-a3c2-d245ad37a251", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262363, "uuid": "2bb71d9c-89ae-49a0-961e-0029d26978ae", "value": "Re AWB DHL 7214306201 Shipment Notification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "639a0afa-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277883, "uuid": "bda041c8-009b-4e11-a243-54b5b3aef129", "comment": "Malware payload", "value": "40adf85a384b5022cef7f6c53e4e6575", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277883, "uuid": "1dd4dd14-5bac-4c2f-b05f-c395eec60fb4", "comment": "Malware payload", "value": "3dc1093b5ce5d6f5970b16b90a6f3e32778e46c6f612d2ec9a4610bbf3ad6bc7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277883, "uuid": "a998baf3-c1d7-4c8c-8711-4619b4fdf1c2", "comment": "Malware payload", "value": "3568c3afc5df4e487450178c1e8cca102fd6d55c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277883, "uuid": "35d4bb8c-cb40-45a4-92b8-9e6cff4b8c73", "comment": "Malware payload", "value": "830bc8991f4ddf426818459d8606bfafa96924a54d0ab54947443bdc5834182f805e034e50972b24f688d76ae5ed7e01", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277883, "uuid": "9ed3ac77-41ac-4bde-8387-da7cbaa7c894", "value": "T1EFA1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277883, "uuid": "be247984-2562-4c48-bf38-e537a0152c7d", "value": "96:VRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:VRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277883, "uuid": "dd4252a2-1054-434b-8392-a8519261a9e5", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277883, "uuid": "e9a3b5b4-60bf-4a45-8f5d-0bcc24b8f5b8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277883, "uuid": "0477e7cd-1f1c-4314-ae82-bfd5959403f0", "value": "3dc1093b5ce5d6f5970b16b90a6f3e32778e46c6f612d2ec9a4610bbf3ad6bc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a0bde9-b567-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1649221755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221755, "uuid": "bdf6573d-cd60-41e2-8a5c-c8ba8c0f6c25", "comment": "Malware payload (SilentBuilder)", "value": "6718ca22a0133a878823b1913fb92a75", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221755, "uuid": "a0d2152a-d882-431d-b0af-33bf733bd607", "comment": "Malware payload (SilentBuilder)", "value": "3dfade5e040d2f5d1168d570946b5e98f165811e25525cef510bde63900377d8", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221755, "uuid": "f96ea8b8-c47b-4091-918a-23e410ca9ff8", "comment": "Malware payload (SilentBuilder)", "value": "c245c1946fcf4c5d51ec863ed109ac5b0caeeea7", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221755, "uuid": "939df57f-f806-4760-aa11-9b608f438dc2", "comment": "Malware payload (SilentBuilder)", "value": "bbf5a7b200afdcd916c13f9d179d71f7967308f6a579a1ab59995af515eeb84696353065afffb77e0ba6ac82e1da4924", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221755, "uuid": "696c1f74-724e-4fd7-b607-a9a7895935ea", "value": "T1CEB39E4BB669D459F92647794CEB475A7327FC341F9A47832354F3292FB8CA05A0320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221755, "uuid": "a22958b0-94b2-4a1a-b0af-a03e3c5e2f41", "value": "3072:6sKpbdrHYrMue8q7QPX+5xtekEdi8/dg3tgSmsCpH/KZuAZGsMC:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649221755, "uuid": "6455ef45-c33f-483e-9d0d-f79225c16140", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649221755, "uuid": "d1b6f02f-e4b5-4c0d-ac32-f325b7bec358", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221755, "uuid": "f87609ec-e4c3-4cc9-90a8-bf28f41ff752", "value": "stats.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6414e57e-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277884, "uuid": "6baa8f89-b9a6-4de1-a0ff-958e8fcd8494", "comment": "Malware payload", "value": "50dcd65af3798ba33ba2d6a6527e4ec2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277884, "uuid": "7e945d02-c90b-47f8-ac3f-b78516b303d0", "comment": "Malware payload", "value": "3e12e64fdbd68113f6b0269dc9bfb56a1b56fb20dad2d6ef8aef8752e304aed5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277884, "uuid": "ca8c127f-f612-4d3d-bc55-123323c25845", "comment": "Malware payload", "value": "3eacddce46b6da428db80e9fb94b30b97ee61f32", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277884, "uuid": "ecdad3c6-44e7-4852-9187-c79fe04607ea", "comment": "Malware payload", "value": "90e54bac975f359d24b21858fa14048a899450ce22c7df2088ceab62d6e35ae71cb2df261ccc838d7fc5ea5f26896520", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277884, "uuid": "5a855d75-5ef5-428e-a481-8fc9336dc19d", "value": "T154A1E750112C1AB17346697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277884, "uuid": "9ca1959c-dd7d-4f0c-803f-62e35c21ddec", "value": "96:rRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:rRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277884, "uuid": "c675bcdd-6b48-4a29-867e-ec79701092ee", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277884, "uuid": "c7659f89-6310-473c-a45e-d40ea1755f55", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277884, "uuid": "40667beb-598a-46a6-8018-b7b0f129c143", "value": "3e12e64fdbd68113f6b0269dc9bfb56a1b56fb20dad2d6ef8aef8752e304aed5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e7e1b4-b603-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649288683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649288683, "uuid": "59ca5ee7-5f79-49d2-8e8d-433c3ab62b60", "comment": "Malware payload", "value": "0f6b2776766080bf5c3753f8b36c6a5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649288683, "uuid": "9a486300-6a5f-4ade-b0c0-b01ff4797be0", "comment": "Malware payload", "value": "3e4828a46b84a5cc0e095cc017e79a512f5f7deeefe39ddf073e527be66fcf56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649288683, "uuid": "66410c0b-1a3e-4d75-adf9-e524208bf2ee", "comment": "Malware payload", "value": "32b2cea02e762eb2d31bdffaed10592724bbc22f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649288683, "uuid": "2d0ffe2c-c2f0-4a67-b4f8-8ac613dfbfc6", "comment": "Malware payload", "value": "2a7ae3e840991e5a8dceaee0df742235c7d059772b582900b25b379e7e34af38822af0343b5d9b5f51bbfd3377615352", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649288683, "uuid": "66a9477a-8504-452e-9dc8-7243828e0941", "value": "T1FF64BF57A3648561E30446B9A813C9B5193D7F359B02762BA3E0BECF3EB0247366532F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649288683, "uuid": "3806821e-f655-4d62-bb14-862330b821f4", "value": "9fd5cb5334ece8ebdfe4a1c7a3eaab7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649288683, "uuid": "dc54afb6-5323-4c1b-a507-99d90c84512a", "value": "6144:ymEdSunAqHdroKcykhPBbiMV5xzr2fX/vSuT6N:y4ujKyUp+gOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649288683, "uuid": "8e229c3f-3b09-48fa-ba59-63752f80929c", "value": 323584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649288683, "uuid": "fae56268-6766-495a-ba74-78da6a5c724c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649288683, "uuid": "cdfbb4db-dee4-4cfa-b7cb-d5f811941315", "value": "3e4828a46b84a5cc0e095cc017e79a512f5f7deeefe39ddf073e527be66fcf56.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dadd1f6-b5b6-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1649255486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649255486, "uuid": "fac17712-1114-428b-a508-0d57b1ac2425", "comment": "Malware payload (NanoCore)", "value": "de94fcf49fd1cbb4a76aea3fe27a9994", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649255486, "uuid": "bd33eeb6-7aae-4294-ba2d-adb181c5f18a", "comment": "Malware payload (NanoCore)", "value": "3e9e04ae27988abffc50ee2cfad53435ccf72284d50e6efea6c5f0ef541abff3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649255486, "uuid": "337f6daf-1f2d-4e09-88b9-2673050b20b7", "comment": "Malware payload (NanoCore)", "value": "f484b892a8e3e7c84e09fbe2ef241330f016a54d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649255486, "uuid": "d2ba1f9a-c80b-4d12-b3ec-310dabd92088", "comment": "Malware payload (NanoCore)", "value": "7c9fdfdeedb52f1736a3772c543a79b6bc6e85ad6b954daf08c614f69981d88692162cf27a18c7854f5c47a3e4105948", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649255486, "uuid": "e5053c9c-43ea-4a97-8e5a-f5da91b85ff1", "value": "T140B412126BB45529D2BD073E94B2014013B4A7B7A526E70CEED6308855DE31EE7B0FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649255486, "uuid": "1fcab77c-c185-4074-9c39-211cd168fc58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649255486, "uuid": "e960d495-96eb-4296-bc70-ddf21ed16775", "value": "12288:k2zZ+Ky1OSNsx1wqqlO7fosP8tcJjFTmrBEvIzmJ:kEZQ1OQsx8gfovtmhK2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649255486, "uuid": "eb066c31-4e18-48b3-a4d3-fe636080c73a", "value": 522752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649255486, "uuid": "99505633-efe5-44dd-894a-ed59f5dd0dcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649255486, "uuid": "36bff0e5-b66c-4c21-be2c-cb56fbe85c22", "value": "de94fcf49fd1cbb4a76aea3fe27a9994.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25490882-b5c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649262317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262317, "uuid": "5d21c345-7b60-449e-955b-71bc64c82a71", "comment": "Malware payload (Formbook)", "value": "62ecfb9fa0df35b3125e3517b4df207f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262317, "uuid": "bd4bbbc2-0b35-4bde-bd03-5b88c1f031ee", "comment": "Malware payload (Formbook)", "value": "3ea19f45dd5b9c5ed0e6f371d7e92afda076c69e6a43eafc3c83337819eee56a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262317, "uuid": "dcf19177-d7ee-4728-b410-0182d83abd6c", "comment": "Malware payload (Formbook)", "value": "cdb853936402310ee5ac874b752cbc442065a4f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262317, "uuid": "653304f6-690d-47dd-a0e6-dbab75446f08", "comment": "Malware payload (Formbook)", "value": "8d4f6d68ba7c1310d3a207bf3cc90a320515d317fdef138416b2a5ccface905a94fa7bd7a9216b0ecbb8a3c8566d3a15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262317, "uuid": "16d9f29c-8ce3-4e91-8af6-529739164ffc", "value": "T1BBA412426BD81335DAFEA7FA643B61C047B0665F3662F2888DD1A4EF1912344C682FD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262317, "uuid": "baf39b5f-9df9-4bca-9f5c-0a5438680c4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262317, "uuid": "4aa9552c-5cd4-46bc-8b83-c1ca1bf10a70", "value": "12288:n+scq9bxqGQ9125vjnEtuWwofmhFaQAkkomlfm/j0RGfF:dcq5xqrk5vjEtbldQA5rmrjf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262317, "uuid": "98df1a98-ca30-45ec-b054-ad7b76c666c1", "value": 492544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262317, "uuid": "0414d92e-65ea-41ef-9f23-43fc8aa10b1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262317, "uuid": "f241b39b-b03e-420f-a6f2-9aa788a377e7", "value": "PART SHIPMENT- FEDEX - Cargo Arrival Notification Import Track No 270962529096 MR V fKUMAR.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a5c542-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277885, "uuid": "6be8cee7-71fa-4b01-abce-fd067acbd84e", "comment": "Malware payload", "value": "1d3d98bfc9247a2a5aebc9c266f695e1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277885, "uuid": "e6fd0906-8124-484d-9344-c3ba6c185919", "comment": "Malware payload", "value": "3faf1f0d0cead6713a550ae21dbaa957acfd8f53c242a794b0930b7bca3cd6ad", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277885, "uuid": "ca00cf42-d5de-485c-8d3e-a4bdc5f64cbd", "comment": "Malware payload", "value": "1a6d2845a61f179fbb7a695bea8f414acfd3c8ec", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277885, "uuid": "8431e54d-39ca-42f6-8929-a988bdc02f9b", "comment": "Malware payload", "value": "f8c34d37c56e315299bf28c168c7ab1a5d9c1f42cdd6934bf63dea32fa34500e75db5c06c96845cdf61f07fa8bbff717", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277885, "uuid": "59d987d6-a051-4726-aad2-c12d63d35427", "value": "T15F8114B821214B35EAA7C99275B57E4576C1F4E7D8D5BE0043AC28A94C8EF8CDC4A783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277885, "uuid": "7549441d-cbbb-460e-9ce9-51988c29821a", "value": "48:v7nSn2C6j7nRnRCKe7njInjoCl87nWnyCw7nnnbCN7nan+Cs7nBnhC37nNn1CL76:vJ7enVMte8DovzEo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277885, "uuid": "1cff8a93-a3d7-492a-a46e-b8b83d1605d3", "value": 3990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277885, "uuid": "d1db9cf9-4724-4e30-a493-3b6cfd2c6080", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277885, "uuid": "cd220eae-5505-4c19-b645-0af3029c9936", "value": "3faf1f0d0cead6713a550ae21dbaa957acfd8f53c242a794b0930b7bca3cd6ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c8c6aa4-b5c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649262383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262383, "uuid": "24dccf3d-4691-4ce9-98b4-aa8086431495", "comment": "Malware payload (AgentTesla)", "value": "4403e2e74c38c24f3b62962a92762401", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262383, "uuid": "f06894f6-56a4-466e-a876-00b4ac3cc709", "comment": "Malware payload (AgentTesla)", "value": "3fd9cf5b8d97aabc341fcedab701756f812ea9f25141fe4d195a301a4490e8dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262383, "uuid": "9ddccd1e-38e6-4896-8ad2-a951c42ae98c", "comment": "Malware payload (AgentTesla)", "value": "55973153edd0d0300a8fc5d381fe70c01a81982d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262383, "uuid": "5ce72cec-0be2-4a5a-a525-61bfeb44c528", "comment": "Malware payload (AgentTesla)", "value": "e4c9945ef335c9d596f219a400c44dbcbcdcf94154aac8dd67a9c1a284a6c3776ca38033b09251f0f66aa1b6d42e1c29", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262383, "uuid": "a106df7f-5703-4aeb-aa0e-faa704864f6a", "value": "T1D6C4011173639D12F6D428369BA6814D8329FE022F12F65BB40D3FFAB52339B646179C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262383, "uuid": "b7b6310a-27a6-4294-b090-d5256a480e1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262383, "uuid": "20fb2c67-708d-49a3-8c60-4dee9c2e7c73", "value": "12288:T0wI0Y9Ml9KZQW/hZQXyb1X9Ehl430yRlNlHbur:At08MB6hGxf4kyRlK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262383, "uuid": "96675f8f-7e5f-4250-9023-65ab8de6f2c2", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262383, "uuid": "3dde2ead-bdbd-4ea6-bebb-f86262bf9c6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262383, "uuid": "92b822f4-af9d-412a-8444-2f5713f33024", "value": "New DHL Delivery Report.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be4df38e-b5e6-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649276318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276318, "uuid": "26c4e2f4-9b48-453a-8db9-633e116e0e71", "comment": "Malware payload (AgentTesla)", "value": "e729ed6133045b2a6bc29c98d5535b9f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276318, "uuid": "b63a3e9d-b62d-4132-b06e-efb568cf5461", "comment": "Malware payload (AgentTesla)", "value": "4020476633780b89b1732b79ab3e94217f6f90fbd5770890ea35f764b5ebd78c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276318, "uuid": "34203bb5-5a30-4412-b12b-96ce23685421", "comment": "Malware payload (AgentTesla)", "value": "357ddbaf569c287fb659e09a410fb6c50b90bd5d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276318, "uuid": "a8344ea9-66be-426e-becc-73beead932ff", "comment": "Malware payload (AgentTesla)", "value": "3ff5547f781f87e1a6edffd64630ced533cb7315670f4ab79b912b8a554135af80a36f93ab903793f19494efe34d56b3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276318, "uuid": "8b07b03e-1e2f-47bd-913b-4e3123034561", "value": "T183C41254BB7BDD12C96D66B3A0D2460603B0DB03E5A5DB8E2FDE11EE4A133D21A427D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276318, "uuid": "f90635ce-1c6f-49cf-a9ba-d3a59d8f7743", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276318, "uuid": "564110c4-8cee-4e4e-b42d-cfc40e462dee", "value": "12288:buwNoSVqwmAXYSettoVp4veMxCtO3eAXqbHltF:biSVqRAISGm0Nsvlt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649276318, "uuid": "7cf717f1-c39d-483e-a83d-537b58140b94", "value": 553984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649276318, "uuid": "538c578d-f034-47e9-9cd1-d24388becc27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276318, "uuid": "c43dd276-c8ed-4aeb-ad5a-b79861802b25", "value": "documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88738d71-b5c7-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649262913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262913, "uuid": "63be62df-718b-40a8-80aa-93ca48221c95", "comment": "Malware payload (AgentTesla)", "value": "11981cc4b7a6a7dd2766ab8b6d1c93f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262913, "uuid": "b69c42e6-553e-472b-a627-22c3773eb7a4", "comment": "Malware payload (AgentTesla)", "value": "40b3d1d4ce7ef8d64dd816b1f5c10f6b3bf21ef858776b0da7adddbf1b5dd6b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262913, "uuid": "e7ddbe5c-3e75-4b04-83ec-aeff5ac5f42e", "comment": "Malware payload (AgentTesla)", "value": "44099e39ee4b11b7705233f88223cf10b8329e9d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262913, "uuid": "e46d8470-b2b9-4b9a-9c82-f9619c38f3c3", "comment": "Malware payload (AgentTesla)", "value": "78795ee34ce862232e86673c454eb36b9d271be738d8a8e2b3d02a4b765fa17b027eeba13181929ffcdc7f1d3ac06530", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262913, "uuid": "0c90e5d0-9121-486d-80f0-bdc2696522fc", "value": "T1A0C41296F76BDD16C46C5AB3D4D2451103B0D202F562DB8E2ECD16EF6B0A3DA4902BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262913, "uuid": "bf20bdd8-8614-4f05-8645-619e771ef5b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262913, "uuid": "5fb32603-27a0-4336-bce0-11aed1e890aa", "value": "12288:TZCkFxzw7Pe1Xufg8MZX0VOMjoZb5GeZdoXxTx9Us6mwecnnsxEF:d/zsPe1XuTuXXMjoVJboB1L4oE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262913, "uuid": "af8beb9f-53d5-4438-8f12-ef9ac7bee3b0", "value": 552960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262913, "uuid": "0daf819c-295e-4693-b795-18cb7bb381e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262913, "uuid": "9b097dee-02f4-4033-b47a-a6c044e3099b", "value": "11981cc4b7a6a7dd2766ab8b6d1c93f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb32e969-b5b0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1649253146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253146, "uuid": "0928b680-ae99-427c-bacb-2986fb972b7e", "comment": "Malware payload (Quakbot)", "value": "be944413dc08d943d9a826f8df96f223", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253146, "uuid": "f3407fe0-d85d-4ab4-a0af-d016f3340d0f", "comment": "Malware payload (Quakbot)", "value": "40dd545c08d109626a0f9d8700f491189d80db1240ee5553aedb2b104ac7d110", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253146, "uuid": "89c211b4-fbe8-4dc9-96e4-ed6e99071f98", "comment": "Malware payload (Quakbot)", "value": "79563a99829a41bac2bb1ac8701ac1bd720a8dbb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253146, "uuid": "62134dc5-aff1-4e55-a024-be8cf48780b6", "comment": "Malware payload (Quakbot)", "value": "4a3bbada8b3ef3610823c2cfc692f5246414854acf24983bf09a5982f93ace8456cb69e8fb3011c2efa4ebe2b7c5e719", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253146, "uuid": "ca1b1aa1-38cf-4e06-b5f5-5137b1c08538", "value": "T17565AFBC75046CDAE66F06BBDE96ACDD13B6262299C794CD807577C309A3372EE02C05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253146, "uuid": "7994adf9-92ef-4115-b149-9357cb14aece", "value": "1538717eb64bec210d6f84c7331143bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253146, "uuid": "84e731fd-5d42-402b-b427-829e25dcad0d", "value": "24576:Xk3YrrLEaF0tTHMjuX5PmnKUz3NL3BAYJWDJnh+idFsv3YgPmHFeA:X+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649253146, "uuid": "c1f5a892-cab2-4b12-9693-222ea852ef05", "value": 1427464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649253146, "uuid": "d1ea494c-0431-48b6-b64f-1b88b5e46703", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253146, "uuid": "c22dcb0c-1a15-4ab9-b64d-aa170e732351", "value": "0x0002000000015588-276.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ba1e1b-b5e3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274719, "uuid": "ac68fc58-a603-4130-a447-043791479290", "comment": "Malware payload", "value": "05e0699fa5441bf7b2f1b117a1b0a97e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274719, "uuid": "5d793221-03dc-4234-82d1-10dbc1698bca", "comment": "Malware payload", "value": "42140f0235c825d8ae848076312f076878730ad9862b04df65ef0824e72e00b1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274719, "uuid": "34938e26-cfa8-4304-af19-48f079fb1b11", "comment": "Malware payload", "value": "93339014923bf9b0480b245ac06144cb36411e20", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274719, "uuid": "7088486d-8bf3-4b7b-b6ca-9152b4b0a88e", "comment": "Malware payload", "value": "ac093f6db3287ac543aba236ac89ae402afbfb3b19adfdf2fade6fe053f6a551855680aa2933c969acc80bfcfd7861d7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274719, "uuid": "f64a825b-fb0a-4bf0-ad9f-1c8e57123df3", "value": "T1B4A1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274719, "uuid": "035b5cbc-18be-4076-8948-43f10be38fbe", "value": "96:rRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:rRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274719, "uuid": "2122a8bd-9b1e-4751-967f-5714bcdb6e9a", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274719, "uuid": "f0ff6c31-b21a-458b-afb7-2fccfa7d5916", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274719, "uuid": "907f3be0-fc25-4054-b17f-3449a42adfc7", "value": "42140f0235c825d8ae848076312f076878730ad9862b04df65ef0824e72e00b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c9d4275-b5bb-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1649257712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257712, "uuid": "57c41200-c0a1-4135-9235-4ffac6777a94", "comment": "Malware payload (RemcosRAT)", "value": "af55f4f0ffbbf50f4307021641f33678", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257712, "uuid": "7f9423a2-15bd-4635-a0b9-b442e14dad4f", "comment": "Malware payload (RemcosRAT)", "value": "423027e6c48ac6f90205532dbad929462886eda81acbbffad8c24c4655d70587", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257712, "uuid": "1f8116af-a541-45bb-8160-060cafc8b1de", "comment": "Malware payload (RemcosRAT)", "value": "8eab4b124f1f80bce78c21ad5f56840225c17296", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257712, "uuid": "f487aa99-2596-457f-bf9f-095d62b5e44d", "comment": "Malware payload (RemcosRAT)", "value": "c881d148f44c28f20dca4d9bccec6ac478819839af27941f2573c3163d97d3f435d2670ce63e5904ebe7c9da9d6b5b6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257712, "uuid": "dd7c7886-77a2-4742-bf82-b2db0acabe5f", "value": "T132A4AF11BAD2C072D97251340D29FB35DEB8BD202935497BB3E61D5BFE30180A72A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257712, "uuid": "c79d9b13-c669-41fe-b891-cb45c5c1e671", "value": "029a987f21e33b48f24d21b6f9ff1129", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257712, "uuid": "d9b5cfa2-0754-4784-bc06-156805bc2e08", "value": "12288:9oCqKde3G314caiojGRoaOd+2sfZsjVg:eAdIG314cFo4Od+NZyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257712, "uuid": "a4474f1e-1b7e-4aff-8eee-8b4ee0ebb59c", "value": 473600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257712, "uuid": "1713b192-7a7b-4934-99fb-9b370250ced4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257712, "uuid": "20902fae-b2d4-4748-b54f-62e560e5d0c0", "value": "af55f4f0ffbbf50f4307021641f33678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10957403-b5e3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274738, "uuid": "2aeb768d-888b-4ce2-9604-d50c0d717b14", "comment": "Malware payload", "value": "cd4ee9c37456fff81da243b3253928fd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274738, "uuid": "5a3381ee-2584-4246-ac7a-a29cc1d18341", "comment": "Malware payload", "value": "4263a671bf7894d17d1e7de8b31d26f890cca8c984562662a2ea33cd188794c3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274738, "uuid": "fbe952e6-8d1a-4610-82c6-672311f3479e", "comment": "Malware payload", "value": "683885c1a4e830f450ae98c6843eb3c679312494", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274738, "uuid": "c14a9c4a-1e67-402c-bdee-a3cbd045b3a1", "comment": "Malware payload", "value": "b1dc00b955c8f5fcfb71d841da62c2635802964cc43b6d181b8075f55ba5d53c5a6f38cedd5def2b0f1c774346c81c87", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274738, "uuid": "0c853413-87d4-4f2c-bf5d-e57b893a5caf", "value": "T1174183C420713270BCBB5CBB67290C1932E164556CAC7E469CD4F9F489CEE5296C52FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274738, "uuid": "e3ead4b0-42e3-4eb0-86dd-4d9cc9d6bb69", "value": "24:Ij+Nf99vu3kwuKJaZna/1eRp0CEFnC4eDG91reDGg:XKYqCsT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274738, "uuid": "84254449-d229-467d-824b-998dcd4c6cd0", "value": 2394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274738, "uuid": "aacf92a1-ec97-42ce-b664-81d5182b5736", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274738, "uuid": "5d097532-af94-413d-9e1f-ec365581d53c", "value": "4263a671bf7894d17d1e7de8b31d26f890cca8c984562662a2ea33cd188794c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "290d4227-b5b1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649253304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253304, "uuid": "952e7cf8-a99c-416f-8d79-3f285607f0bd", "comment": "Malware payload (AgentTesla)", "value": "5a831d1dbe974426c31a15f0f545ad40", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253304, "uuid": "ac981bf2-bfa8-43eb-8ad8-df6c4ec99198", "comment": "Malware payload (AgentTesla)", "value": "428bd3acb7a35e9e28f6ef80818154350a93f2debac707c57941459ce6e94158", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253304, "uuid": "33480695-97ef-408c-9ee8-eea8fcb12f49", "comment": "Malware payload (AgentTesla)", "value": "d70cd191f14329a955adf1053e627b34541b179b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253304, "uuid": "fbb9765b-4392-493e-9f8d-9d22fa1c42d5", "comment": "Malware payload (AgentTesla)", "value": "a345fbfa3ebb7b809a01ea75edb22fba6d227ebe21d3985d4e9127ae288eadc6ae2d03b0adc8c5f246847a76a973d9f8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253304, "uuid": "ce84c4e9-5236-4579-98bb-ec05a90b6fe9", "value": "T1E4B42302172EE734E8FE56F8459289E8937C2A03B0D3F7A9ADDC6478B82365472711D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253304, "uuid": "6c5a0462-21ab-44fc-821f-8f9643a681df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253304, "uuid": "ee1861a5-4269-468b-9046-47514aa17f1e", "value": "12288:B0E3FO1dxjgxceww3iMcPKsmt+WcS7OQiQb:2E3FO1dFgxmKiF5E+WcSvLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649253304, "uuid": "112a4007-7559-4436-b33f-0ee525f8cc1d", "value": 505344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649253304, "uuid": "c3520494-6958-4dc0-a0ea-65dd2e902992", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253304, "uuid": "bbf0ce4c-5346-40f8-9283-e85484544bdf", "value": "doc 20220504_9910010010.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c7b7f2-b5ad-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649251929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649251929, "uuid": "eadcf1c8-2e77-4e02-beb6-adbec4e403f0", "comment": "Malware payload (AgentTesla)", "value": "6bc0f968bdc3ad970e53dd87f2927171", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649251929, "uuid": "8e8dd11d-b74b-463e-951c-8c2fc5388e14", "comment": "Malware payload (AgentTesla)", "value": "42d171b05adabb9f46b9d2176388da4fab98d00d5a61329823a45831ee8f3dbd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649251929, "uuid": "3a0ea921-9cf0-4b6d-925f-f8efed314eed", "comment": "Malware payload (AgentTesla)", "value": "8dede657ca4b655c3a2c819b334fe7430ad99f67", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649251929, "uuid": "f2ff39ab-6019-4e0f-be87-66b9ee590b47", "comment": "Malware payload (AgentTesla)", "value": "7e5d3f7e78b37e89f33be39531b54a95bfca7209829685e5d7098d83cdb95ab032e5d557413e4303ec0d5d6be8136b61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649251929, "uuid": "fd7ce390-b038-42fc-948a-88b1f536c6ee", "value": "T187F40661E3F45B4BC57F89B12434424839E1A90E2513EBCAEF65319DCBB1A4227F8F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649251929, "uuid": "2c58d3f2-11eb-4a63-91d5-2465900eee2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649251929, "uuid": "6ed00957-8b17-46e0-a876-6589d00fe435", "value": "12288:+qrRtCNCeABjk+qlPL0gQSSU6hBe3A6c0bFCXedQILGhXMczqm9zH:TRmD/6hgw1yCOCI/cz59z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649251929, "uuid": "e88c6e64-efbc-4b9c-8673-6e78e4d2f352", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649251929, "uuid": "ea2ae584-5795-4c72-b420-d3823d3fe219", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649251929, "uuid": "aa689578-fe2c-477a-a724-0da2776c58a1", "value": "4zzynkQkJnrbfT8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662f2e54-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277888, "uuid": "08ae37fb-92b6-4045-a742-bcc64dfa0189", "comment": "Malware payload", "value": "277385aa5dc42100bd6613ffb07e9d11", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277888, "uuid": "423e4719-734d-4aa4-a18b-0315c04de41b", "comment": "Malware payload", "value": "431e2e65c43bafa7b8b9e50e6431db1a70b6e2ef9188020926f2514705855ab6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277888, "uuid": "dbba1dbe-68a4-4754-bd53-82a23a3742de", "comment": "Malware payload", "value": "3df30306e0ef11035298b6a14b59f66b32d99008", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277888, "uuid": "b38dc657-66a5-4d06-9de5-482b33e1f1c9", "comment": "Malware payload", "value": "c470b7f9d8f131586ec0bf0d1bb643d423e5e7fb7b4e9f3498e0f7bb8444c4abf6a6b38f224675c48a8b83e3bb2dc957", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277888, "uuid": "79c986d9-d68f-4dd8-934b-d143fceb189a", "value": "T189418FCD02DA313A2C395E763E66044530C751BB99A71F8DAAEC28F9404DF00FC92AB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277888, "uuid": "7a9020fb-345c-487b-8033-711085afc7e0", "value": "48:vF+x6+xdF+xn+x71F+xL8+xvF+x8+xgfiF+xJ+x5LF+xi+x/1JF+xn+xVHF+xj+J:vFNeFOC1FBIFR0FkQLFvAFqSF8hUFhMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277888, "uuid": "f2148501-b1e3-4f55-9355-16fb9de03adc", "value": 2249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277888, "uuid": "6dc7672a-2755-4d58-8453-a5dcb6503051", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277888, "uuid": "d66751dd-d0da-4b2a-bf1e-3e61fbcb9fc0", "value": "431e2e65c43bafa7b8b9e50e6431db1a70b6e2ef9188020926f2514705855ab6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b78f8041-b5eb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649278454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278454, "uuid": "531974db-bcfa-4af5-94e1-fb135e75e04c", "comment": "Malware payload (Mirai)", "value": "623980aae8650a2fbadf9e863586fc4f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278454, "uuid": "d9749825-96d5-4af0-aaf9-3592bb94c344", "comment": "Malware payload (Mirai)", "value": "4376680380a523e973626d4ef49a7a312c3e2920518d42a31942c4e9ee7bd080", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278454, "uuid": "7be11eb0-39b5-4dbb-8c31-8bcb2426a443", "comment": "Malware payload (Mirai)", "value": "902d13f8f88422d3f623d663838392a59c4f41f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278454, "uuid": "0e6e106c-3f8c-489d-bf80-8183cfe2ba4f", "comment": "Malware payload (Mirai)", "value": "b0ba856c0afc5c02ccf17cd98b4ff4e49793993db41e15b99fee33de760f94c59d9233852cf3094b315f4679be293672", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278454, "uuid": "9438787e-b64d-4c88-be25-413fcc2fb6f5", "value": "T11E533B25AD792E26C0D4B57E21F78710F2E2220E26B8C51E7CB21E8EFF04B5065577B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278454, "uuid": "cbb96369-8c18-4b86-bdf7-ca8861dd23cf", "value": "768:VaYoQW1sgtq98oSWANyrk5K3YneVMAb6WsreAgOmdMcyPD5aO+neS6LF:VaYWmgtS8oxANMk5K3YeV/b6vr7LIngF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278454, "uuid": "0c9b0ac1-7d6c-49f1-858a-eed52ff0a5ab", "value": 61508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278454, "uuid": "87cf37c5-c329-43e4-afb0-9ecc3f58e415", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278454, "uuid": "31acdbcd-2322-43ce-9f50-957b07701bc7", "value": "623980aae8650a2fbadf9e863586fc4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3653b777-b5c8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649263205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649263205, "uuid": "e50dc672-dcd5-4ca5-9422-7c1fd77ce1dc", "comment": "Malware payload (Formbook)", "value": "ec1420c4b5debf3a6d97a1618b436cf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649263205, "uuid": "13dfe016-bb78-49a4-8bd7-9e79314fdab9", "comment": "Malware payload (Formbook)", "value": "43933efdb6406f03c3505c5bc398a841cb55ffbdf254cdcb6bd5cac87320a1cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649263205, "uuid": "803150d9-f5a7-4256-8270-ab7fdd5f82d1", "comment": "Malware payload (Formbook)", "value": "6405d573b25221cbc6cb09116ae060f42cde90ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649263205, "uuid": "7b330471-99d0-4fc7-a9ba-b724e783f5fa", "comment": "Malware payload (Formbook)", "value": "300c8f6fda35b60b37d1330991f70618374e748aea4ecc1a58438c5a26bca73a5880330608e44399c2b8ac0a74b87ef9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649263205, "uuid": "93894174-a37f-4665-a81d-6d2646b6ffb2", "value": "T101B412451BEC6712D8FEDBF5BA3C648007B6352F68A1E68C8EC174DB2C627909542F87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649263205, "uuid": "2b876e24-88f7-4659-aa19-a158ba2c3767", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649263205, "uuid": "d5158ecb-5d35-4a4c-9857-bdafda632c99", "value": "12288:GCOVGXaL4UDKo9VwRSp6yxGNEwUrxc/Q8wWKtC5bX0Rxt+1OF:ERkUDDuIp66zmSWKkRX0Rxt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649263205, "uuid": "84a2ad8c-34e0-4c87-a92e-6be0bca5ceb4", "value": 518144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649263205, "uuid": "570c116b-4d73-4ef0-88e2-f47ae8dfdd17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649263205, "uuid": "917f35e3-143d-4f27-bdef-ece257c0a459", "value": "ec1420c4b5debf3a6d97a1618b436cf0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df12544d-b5bb-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1649257904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257904, "uuid": "bc786423-5d80-4c55-b310-ed670393df46", "comment": "Malware payload (AsyncRAT)", "value": "6adf4c0b2f3ff6771aff123655963ef0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257904, "uuid": "f31c5902-e9e7-4b2f-8515-1820f1986839", "comment": "Malware payload (AsyncRAT)", "value": "441dc828d51124baec297df900c5fce4cca4401621bc209831b5b6a9c09c333d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257904, "uuid": "5cce6dee-6037-494d-881a-ed6b704437b6", "comment": "Malware payload (AsyncRAT)", "value": "fd17434b489c3ad5d8e53a8915b4cda25ad50178", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257904, "uuid": "bca694b2-0c7f-43ae-99d9-58bb0aabdc1f", "comment": "Malware payload (AsyncRAT)", "value": "3edfb716dec64114369d5b097a4e3aeaf98a7d8593cf1055afc089ace63f678c0d1f319e63dfebe1dd79124b207eb27b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257904, "uuid": "05e6b415-017b-4720-ba3e-97a946f5d61d", "value": "T18B1402B53EA31DA2E20B6D7F5D800C0C9667FD6D5816A2CC30FAB6A65C37EC54460EB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257904, "uuid": "986dc9cc-8f68-49c7-950a-84d8b1429fdd", "value": "3072:vLpseV/bWgUxmEd8Mpxdj1N0XibL6paazWhd6uwzkn9Rj0wymfE24wWpVEPSBgJD:DC8WJxma8Mpv0XibL8bCd6uF/428waBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257904, "uuid": "16743d1b-4b69-4c0b-89d3-39ef1b0abb3f", "value": 192136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257904, "uuid": "cf14e461-7faa-4e56-ba54-2acf57653c3b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257904, "uuid": "0ffc6f52-9691-4745-9da7-8ac4171cd784", "value": "20220301154429.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a1eb03-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277889, "uuid": "cc363bfc-8928-473e-9d22-807e06076234", "comment": "Malware payload", "value": "bce8cfacb7c303367292f9e5c21869ee", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277889, "uuid": "0bde6c4a-9746-4c9f-8e0d-67333864ffda", "comment": "Malware payload", "value": "44806e103690dabfa695f8dba4e6aa3ac170483cc84d0bdca255017908c10b9d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277889, "uuid": "314f0c04-f2c9-4131-9c69-7923f31070ac", "comment": "Malware payload", "value": "63fb66573d11d47575889511c71ec2f65e4cf4f5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277889, "uuid": "584f7b99-ff26-4f42-b8c4-d1af265c3868", "comment": "Malware payload", "value": "ea92dfcff09f08c4e7a4f9636ac92a2e758c42822d66b0ca610f0e167e8c7bc6175341a6e53670275e7a7420dff0db23", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277889, "uuid": "f1c82238-2fbf-4869-9c93-8787adb197c3", "value": "T11FA1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277889, "uuid": "a730a45a-4dbd-4acf-8db8-5e9c9e7a55f8", "value": "96:XRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:XRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277889, "uuid": "517ea231-405a-46f9-beeb-67fb2168f999", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277889, "uuid": "047a5dd5-907b-417c-b6c8-10d4ec4aac55", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277889, "uuid": "fcc53172-320c-4ce4-9490-1a032010c461", "value": "44806e103690dabfa695f8dba4e6aa3ac170483cc84d0bdca255017908c10b9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5714060-b577-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649228709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649228709, "uuid": "40b25ff4-ea8f-43c6-87df-b086518f9ca7", "comment": "Malware payload (Loki)", "value": "55cb0eac7cacf066e891f49f361efbdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649228709, "uuid": "74d63183-8e42-4dd7-af47-3defad868370", "comment": "Malware payload (Loki)", "value": "448bb7d8a12bc5ece3ec6a030aff9e0ecb54eedc0bfefecc71be3ac01c142aed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649228709, "uuid": "7cf3fcd8-60e6-4daa-bbe5-c66c64702574", "comment": "Malware payload (Loki)", "value": "77dedac1db483b094621743f617556c5e50fb14a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649228709, "uuid": "9370df7b-c522-4a0e-9858-434f33947f98", "comment": "Malware payload (Loki)", "value": "36951f3fe9504d31ee426f2200a947c6b71d8d98de734bd1184c086c3bf745f3d5c8f4bf632ef43e42dfbc99ca3a468a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649228709, "uuid": "b1d151a4-d9a2-4d7a-958c-1468077f0160", "value": "T18C341211A6E884B7EDAA03314D39135ABF708B522DB4CD5B1370EBA9BD279C5850FBD0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649228709, "uuid": "0268d6ed-65db-4e03-ba6b-a4a7cb698c1c", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649228709, "uuid": "c511cb12-0f70-4a6f-b127-b3134c41c5a3", "value": "6144:HNeZmGyVKjHlq+eDfVD52Xy+p1Js2rvuMsQFNO7K:HNlGyVK7s+eDfV12jp1XynQFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649228709, "uuid": "e73faa46-1496-4d2e-af3f-9505238438d3", "value": 235799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649228709, "uuid": "30ac4d0c-02c4-4ae7-81cd-f4d8dadb2990", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649228709, "uuid": "3bd66ce8-4dc6-4cfe-b33d-10000b474a72", "value": "55cb0eac7cacf066e891f49f361efbdb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4692cfee-b5e3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274828, "uuid": "457be5fd-25f3-4605-a66b-e0d0ac02064f", "comment": "Malware payload", "value": "34eae1d8173c253c051dba544de590ff", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274828, "uuid": "03073a2c-d247-4837-ab0e-090204f7395a", "comment": "Malware payload", "value": "44a2e5cf9fd66abd79722e96d9571ffb8b832ab39dce3a7119b4690169204ca5", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274828, "uuid": "e28dc6c3-6a3f-4880-9a6b-0264f8b25296", "comment": "Malware payload", "value": "553a58728fb4d0fb483f60d5102c202ffb337892", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274828, "uuid": "a08fbcd4-fc33-4d94-a72d-79e11eb49336", "comment": "Malware payload", "value": "e9f08da11eb6bb2a2ae3523e8e76262598f9137bf64297029090621c5a007c2967aa630ef11fed3834154323b7ca1cc2", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274828, "uuid": "74126aac-bcb3-40b0-b3b4-c90eeb375321", "value": "T19BA533B9B6DB30BD96A8B17767FFC924302BA6CDA01687E06DB611CE1406131DDD4B1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274828, "uuid": "f659ef72-ef73-4e0f-9099-8ed7b59ab4f4", "value": "49152:tT0+oOBiXLUNaRHKmjsbS21i2F/ecE+0n9aFctnpbbTruN3MKQq:tos909Qg6ecEZHyEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274828, "uuid": "918d03dc-5aa7-448f-85fe-8ea3a598045b", "value": 2113536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274828, "uuid": "3f11aa50-8cf4-49e8-9fb1-a0fe0a1b1e47", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274828, "uuid": "8799273e-246c-47ac-b5b6-b7f2d60d9cd8", "value": "44a2e5cf9fd66abd79722e96d9571ffb8b832ab39dce3a7119b4690169204ca5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f67177c5-b5c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649262668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262668, "uuid": "eb1337fd-045f-44d0-9c04-707937073d44", "comment": "Malware payload (Formbook)", "value": "8b8e8baed435d643a7aabb1e60d1ffd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262668, "uuid": "8e517779-8af0-4e88-bcbc-d9964177a718", "comment": "Malware payload (Formbook)", "value": "44c1010aaaf8086dc6358f391f6d957057246eb0e6313b40a05a80e2ec9ef9a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262668, "uuid": "749b46f0-4f63-4886-8ec6-54aa7b22f212", "comment": "Malware payload (Formbook)", "value": "fc75734dbced1e7b05e95b238614a1b744b4b6a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262668, "uuid": "c379a564-3968-4db4-b07b-f7d4fbbde42e", "comment": "Malware payload (Formbook)", "value": "5fd88e2a2e109a8c1654bc401c8690ba9c04b349d7723bfebff30ff7705b76c93b308a852d8472e68217d46017d9e3e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262668, "uuid": "332f3cba-37e5-4ae5-86ab-20d0bde5182a", "value": "T181341201678AD4A3D7720D332EFA16671EFF1211156C066F2390AF69BD22BC3492F766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262668, "uuid": "6008b8f0-8fb9-4a40-9b33-ad0c4b649654", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262668, "uuid": "067e1881-8c3b-4ace-bced-7d66e6374308", "value": "6144:HNeZmaWWSBxSo4P3wBgQ3TWeN1NB3tG5HMVMO:HNlhXBcBPstK21rI5JO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262668, "uuid": "41abf3c6-2f84-4afb-8b3f-8720a78eff70", "value": 249305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262668, "uuid": "f7921163-1449-4c2a-a0d1-bbbd42d995db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262668, "uuid": "709abb8c-ab17-4ee1-a5b1-9d48a0805449", "value": "8b8e8baed435d643a7aabb1e60d1ffd1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ef2a31-b593-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649240682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649240682, "uuid": "78ea9778-2ae6-4712-a758-ee5113bcb9ca", "comment": "Malware payload (SnakeKeylogger)", "value": "b6fb2526bfd2dcc257605669564656a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649240682, "uuid": "b0e79c24-ad98-47b4-9e77-0ba8c1834d9b", "comment": "Malware payload (SnakeKeylogger)", "value": "44d730e4f6866c8575ae963e0acd5c980fe9e1797a2bd07ddbb8871b137f06e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649240682, "uuid": "f8a736e1-3c07-440a-a97e-92ab488b847a", "comment": "Malware payload (SnakeKeylogger)", "value": "826a7d2ea0f8332f445c580796c0431b5e5574e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649240682, "uuid": "85292ac5-3c9f-4109-8860-b3500f27dc16", "comment": "Malware payload (SnakeKeylogger)", "value": "09c967c9db7690aed5c51a0a620ebc23066870b854c029cddb14f4074729eac2775f8e88d78700572719161d8907376b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649240682, "uuid": "ddf09da5-f8b6-4781-b663-9bbfcb2a20ed", "value": "T14FA40264B7B7D912C21E9A33D1E2565A0370DB13F863E38E27C8569F06063E60992FD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649240682, "uuid": "013377d5-68f9-4e9c-b567-6dac952147ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649240682, "uuid": "35f42a6e-db33-4111-8535-2d9b7f1a7f8d", "value": "6144:XdWiEJPMCd1Qs9wQZlKJJ1yCrhuaqRq+1L0/lWqYGbyvOW+EqXC48iLddLZt:8iEPZd6sbuJgCrhuTYK0hrRN8sdF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649240682, "uuid": "18862497-766b-46b6-8bfc-687c983cb513", "value": 468992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649240682, "uuid": "8954ed6a-0f06-4347-b2f9-8193ccb4befe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649240682, "uuid": "fdbd8256-a83c-4250-98f6-86cd6484472e", "value": "Quote JQ102474.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33e091e0-b5c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649262342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262342, "uuid": "03281ce0-b5a5-48b1-ad3b-65fbb4582492", "comment": "Malware payload (Formbook)", "value": "4ec8282f1ce43bded176a2b6a3edb0a7", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262342, "uuid": "1278eaa6-3cf8-4944-8e7f-ebcf1f231b47", "comment": "Malware payload (Formbook)", "value": "4593869b63520ac663a11232f5597f921b9bdc2b170db22030c396cb9a6bf076", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262342, "uuid": "0b3d1b76-9ccd-46ee-9586-c123948f5f18", "comment": "Malware payload (Formbook)", "value": "061949ba6ecaa5a5a5d0617673ee4ea5d95011fc", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262342, "uuid": "21717433-eb4d-4be5-a3bb-c351a03d7b88", "comment": "Malware payload (Formbook)", "value": "635afd7aeae1c11d1e87e64137d97cc883215b132b97078b0e6aa59eff3cf6c4ebe9edaa6459a3c8e947530f8a354ad1", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262342, "uuid": "b7aca2a7-95d5-41fa-8684-3342880648f6", "value": "T12B341235B1B5D1E2D4B14BB1AF33CF6BEFE5A22316B15A0F03501E89BC252E2845D762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262342, "uuid": "3afd3f39-2ad0-459a-966d-f2fbcc6fd7a7", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262342, "uuid": "b363db3c-14cd-464d-aa89-3ada43005923", "value": "6144:HNeZmZ6FMc5YAwVSjMb7bVuG1vP609sX9YbeHcK7hTcGq:HNlZ6+c5YAwV7bVuXEeHNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262342, "uuid": "bfe8f954-71f1-4545-a2ee-aaf7db1811c6", "value": 247356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262342, "uuid": "61bc130d-c491-4282-8f81-7b74bf5515b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262342, "uuid": "58559c30-6b26-4572-ad5f-292e1f96a4a9", "value": "DHL SHIPMENT DELIVERY-PACKAGE-INV-AWB247634563576.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c61c666e-b5b9-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649257003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257003, "uuid": "76bb34fc-8a81-4484-b58c-d47e297ce9f1", "comment": "Malware payload (SnakeKeylogger)", "value": "ed017ae51cd0fc6f2eaef7f3d99d5b05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257003, "uuid": "da15ea8e-0f04-472c-b653-ca27af3c1f53", "comment": "Malware payload (SnakeKeylogger)", "value": "463c0bd3ca5ff0b301e40eda8582705c2000f0e1e68ad345aff8fca983f2ab31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257003, "uuid": "f596f7d5-5017-45d9-ad55-cf27c35b0016", "comment": "Malware payload (SnakeKeylogger)", "value": "e88e136c7f9060ba436f04dd5daf94e9f7043641", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257003, "uuid": "06e8fb76-a27f-440e-98bd-514589b8cb8d", "comment": "Malware payload (SnakeKeylogger)", "value": "7c490e0f8a124a48f2569600c262fd1ff70f888e808cb8d9ec40db505f7488a55f1fdf7392bc2784b79891e97edcf57f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257003, "uuid": "e83a09df-4f9e-46a4-ada2-28468b334a3f", "value": "T142A402583BABD813D72E57B3D0E2101A07B1DE03A263C65B3ACD14DB1A1B7D25A52BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257003, "uuid": "b5008056-7b99-4454-8bc6-7691067541b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257003, "uuid": "e76bcfc5-8607-4cda-bcc2-446de2462fb5", "value": "12288:9a0+vcK305Jab07w4lmWcoy6V8HiHys3H8F:yvcK30gb07jlIJ9H6NH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257003, "uuid": "7660fe8d-77da-4a55-911f-dc2b90f32d21", "value": 470528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257003, "uuid": "8bd060c0-d2a6-4b58-b366-0e3552264753", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257003, "uuid": "e3411941-5889-4789-a348-96140a4dc9c2", "value": "J263q8KVk8VqydT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d0677a6-b5e3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274732, "uuid": "9e38339d-1f8f-4738-8a89-aa0ebfaf7e3c", "comment": "Malware payload", "value": "d49222ed913dfe9577db1a48b0c79205", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274732, "uuid": "86796013-1b9d-4394-bdd9-2b68c26f8b3e", "comment": "Malware payload", "value": "4663a0b7c90f2232946234ea48908cbe8d4b1d95f91b1234248c00eb058a548b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274732, "uuid": "8ffea790-d342-4251-ba08-072372e47434", "comment": "Malware payload", "value": "9e2f0d9281b3e56891c39299b4c68ded6ef93ac8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274732, "uuid": "dfbdecee-3af8-4468-b6f2-b4b057ff4944", "comment": "Malware payload", "value": "5a5ddbb25b0758a366bc59b31f05008716eb8197c5bd2531ec6c4e0c7d161e05e32142ee12f670bb2a8f0d98a6af36f9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274732, "uuid": "0f2b115f-9801-4cd4-af48-4a2ee875efb7", "value": "T19DA1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274732, "uuid": "6b126187-b0ce-41ba-9070-2677c0062d1b", "value": "96:LRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:LRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274732, "uuid": "2ff0d388-4f6d-49ee-bd3d-2eeb6b66c114", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274732, "uuid": "e4827703-f7d1-41db-b6aa-83622331abc8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274732, "uuid": "e46a1ac7-5960-4a52-88cb-64116a5873cb", "value": "4663a0b7c90f2232946234ea48908cbe8d4b1d95f91b1234248c00eb058a548b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e11a32f-b552-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649212591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649212591, "uuid": "222c3d94-60db-4c6c-bd80-83669fd865b7", "comment": "Malware payload (RedLineStealer)", "value": "1dc118bc18c086685f518f8b11443993", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649212591, "uuid": "ae1ebc48-e65b-4f2e-90b4-8fc951d2e9eb", "comment": "Malware payload (RedLineStealer)", "value": "4751b1e55b4534958566f26d28ffd2d48a25ff60888243fc0db41158a5a427e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649212591, "uuid": "94e13ed8-1903-42ab-8252-1e84bd70e753", "comment": "Malware payload (RedLineStealer)", "value": "1366ac759fe7aa8c16446af05eecccbdeaef68b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649212591, "uuid": "03c494c8-ea91-4ac1-8822-66c3b36edf53", "comment": "Malware payload (RedLineStealer)", "value": "0a57b91d69f9529f03528019c10d862623aaab3cf225ee7dfa1856fdf920b3062a89630b46840fea26c8c3c706458cb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649212591, "uuid": "af31a36a-30fc-4d30-b648-6fe410d2a3f2", "value": "T1D494E0C273928071D4513E30A862CBB0567F7832EA30555BFBB47B6E2E743E059B6B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649212591, "uuid": "2830fbb8-70cd-4a6e-a46f-6e9d4e83dd56", "value": "3e1371bce2a7dabfc48c6aff7cfba706", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649212591, "uuid": "73b0f8ca-35c5-4c03-bd74-845d7200d87b", "value": "6144:KGY9/hLb6I21+/I7PClb5SJs97zPLlUoQY0Q7ITsq7igaI:KGY5hLbhUhO8i97bLKpQ79g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649212591, "uuid": "1a38c0f2-e6c8-4ac2-972b-251b8f2b1de1", "value": 419328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649212591, "uuid": "88a66746-5908-40ac-a97f-93c6ea272618", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649212591, "uuid": "da831da1-14cd-4b1a-bd66-d60ca4ce94c6", "value": "1dc118bc18c086685f518f8b11443993.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "680380b9-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277891, "uuid": "d888c567-18a1-439e-b0e3-688cc8f255bd", "comment": "Malware payload", "value": "e9b348ab2fa549ea90eae0a8dcc55f75", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277891, "uuid": "0e12a990-8707-4868-aa7e-716b4f9140eb", "comment": "Malware payload", "value": "47d5920574bd41c7301f069a19d0404801ec47705a43a5822a317122d6128142", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277891, "uuid": "0b730d7c-a749-4a14-a8e7-7da45b80058e", "comment": "Malware payload", "value": "282755ace70c97cddb1c2fcd32f7098575a109fd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277891, "uuid": "927b32d5-427d-4d35-9b5d-58986f4fce2c", "comment": "Malware payload", "value": "96e1366ce0d51e20c3e2902a9e3549f1a78ed4d5a8f72a7d265c8a28e681c81bdf74324b17c039d08c238183587650dd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277891, "uuid": "5ff822da-8bc9-4321-b4f9-279ecebbab18", "value": "T1C60144CB032363353E82CABD73B747659110F19963D89118FED8DE55824D948738AF87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277891, "uuid": "96a0e0d0-47d8-4d3b-b532-b3770d5eb964", "value": "24:usXYsMsgs+sQsosynihsXHhsLhsPhsthsfhs3hsynKTahsc/msc/q/Y:MnisymOkKHn3F/g/q/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277891, "uuid": "7f33f775-2c15-4441-89f8-f367b18b94ca", "value": 822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277891, "uuid": "b2ac14b4-995d-4bee-b95d-6c72a109e375", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277891, "uuid": "c06899b8-1a07-4b40-b08e-df421b636207", "value": "47d5920574bd41c7301f069a19d0404801ec47705a43a5822a317122d6128142", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a11095a1-b5b9-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649256941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256941, "uuid": "838c036d-9992-465b-b97a-bddb3d5d3f36", "comment": "Malware payload (SnakeKeylogger)", "value": "5ffaf7413755a504069f7b6dbe6b6c0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256941, "uuid": "4cc40782-8741-483a-801b-a806b7e4d3d7", "comment": "Malware payload (SnakeKeylogger)", "value": "47da9a43eadd2a638c5341efa2ca8ba955de770fa24ddff4af84f86ef37874ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256941, "uuid": "57abf5f9-aabf-46f8-b914-aed3f3acc408", "comment": "Malware payload (SnakeKeylogger)", "value": "092b5eda4c9fcc68625548dfa75a82b9eba7cfc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256941, "uuid": "c89695b5-0e91-4fda-a995-5954ed897c61", "comment": "Malware payload (SnakeKeylogger)", "value": "4179926f8729469a8b5da8b547d0ba0b70ce88ad1e2b86c337ba213e3ef76c25d97346622cffee113a3747a6ee4aa3a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256941, "uuid": "401e9300-75cb-42ac-87be-ff8dfd12d89d", "value": "T125A40255A7ABD967C12D52B3E5D685010370EF02F463C74F2ECAA2DE4A133E24A927D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256941, "uuid": "9461d55a-1b4d-4c90-80ab-e7bd6ad110e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256941, "uuid": "6fb5fbbd-7e90-498a-b218-dfcb1eb57b33", "value": "12288:RaWOGcHmtA7bg2f+ev9intIn07SRpueIGZzF:HOGcGtIb9itIXRAlGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649256941, "uuid": "6c17cb7a-a36c-4cc1-b446-ab397f8970a2", "value": 473088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649256941, "uuid": "4cb60147-5296-4209-b0b6-1ab6d42d8f32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256941, "uuid": "cde00362-d7f4-454c-af75-b5852bcd4239", "value": "Our Quotation for April 6, 2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50543499-b5a2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1649246927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246927, "uuid": "cf70e2dc-5a90-4771-ae20-ab42306bb70c", "comment": "Malware payload (Stop)", "value": "1efd23164dc23febe2ca4bad166594ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246927, "uuid": "f14196e5-0ee2-4cd8-bde3-4112eda5d06f", "comment": "Malware payload (Stop)", "value": "47dc60477bc9c5c8c3bd3cca454cec1121c2dac80c07ef460fe80b43d8fd38a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246927, "uuid": "7abd2d6b-b606-464f-82f9-dffb283491f9", "comment": "Malware payload (Stop)", "value": "a1840a0a0b614318f7c89bf96ba41375efefd99f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246927, "uuid": "680859c3-842a-403d-9193-ed410fbf9186", "comment": "Malware payload (Stop)", "value": "c5cb653e19499f4106c11ada57cc967e12e522b02944f7f5627bcac7ea89e2f6cf9b8609d3d691defb1b24ed897063d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246927, "uuid": "b08e277a-547b-47d7-ad8e-eb9929016b95", "value": "T156F40200BB90C039F5B716F449BAD365BA3EB9B19B2494CB62D916ED0734AD0EC7131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246927, "uuid": "13062e12-1622-4eb0-8592-1618a9c61d35", "value": "0eee5b00eee30e3f45148ced95e2478e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246927, "uuid": "391e2c71-1be9-4eda-862e-48983f00cf90", "value": "12288:RnjuIIceN5t8pg8v8Oe//AZXUJK4XN3tC9iMExiTWfgvcGcpqioZnF4Ni:Rax5t08///gUJrN3o9FExiqfwv6qioj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246927, "uuid": "a187214e-8bb2-4a13-92ae-1c99b39b5158", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246927, "uuid": "6cb5e4a2-aa13-4c18-bae7-21bf7642a735", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246927, "uuid": "4ac6f343-2263-4bd1-b110-0de9c61ac73c", "value": "47dc60477bc9c5c8c3bd3cca454cec1121c2dac80c07ef460fe80b43d8fd38a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a3cb95-b5e3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274822, "uuid": "6dde2d22-d323-46b9-8320-4f47f49a5f9f", "comment": "Malware payload", "value": "c2fa9645513faed3f7b4e2335f5a7399", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274822, "uuid": "0f84868f-3df4-4c2d-a247-286ad2dcd581", "comment": "Malware payload", "value": "47f2d5f080eae0c94cbde9b0ffbb4237d8304f56d2d2cdf7b9f8e28577d97857", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274822, "uuid": "231bc680-3ed2-4920-9ece-dbe2d1dc4b71", "comment": "Malware payload", "value": "335c69e94ed4b31aeb0c90ecd0e578fa2c03cca6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274822, "uuid": "b782cc19-dbb0-4149-afd9-f7fcbeb8f2bb", "comment": "Malware payload", "value": "0016bd18b174141412c2382e07323c4bc598a22715e36837d9631b67abbe7008c1f372fafa55e6873240511e15037123", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274822, "uuid": "941a1493-0edf-48fe-b063-d72590fb5209", "value": "T13AA1E850112C1AB17246697AD26FFA52B50EC81B09777B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274822, "uuid": "64e01466-a469-4694-888c-4e5295017a18", "value": "96:oRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:oRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274822, "uuid": "8b9d0277-3af4-4bc1-a5da-e65e052afeca", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274822, "uuid": "09b04e58-bd2a-4397-93a0-066e2c717f66", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274822, "uuid": "e6e723df-85ef-4b1f-b11c-264591e796d0", "value": "47f2d5f080eae0c94cbde9b0ffbb4237d8304f56d2d2cdf7b9f8e28577d97857", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac5ae25-b5e3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274728, "uuid": "59db994e-52dd-434d-824e-ee02f53fa435", "comment": "Malware payload", "value": "9f0b4e4ddb5f4986b752c933f2d49717", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274728, "uuid": "4c494039-4cac-44d9-991d-f865efe7844e", "comment": "Malware payload", "value": "4848ca6c8f2e17ff55dfd17548faa9964d9c2ccb7bb0d8537e33b5afd832e5c2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274728, "uuid": "e58cbd74-fdde-47d7-877a-90b81315b3b2", "comment": "Malware payload", "value": "98512e2ef93f319bf635b11f4ffd0221899254d1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274728, "uuid": "92a19465-96f3-40bd-b2d2-bab69bcf538a", "comment": "Malware payload", "value": "ea0da717c2cef951bb5a890487ddfcd052323c5bb280d1ec37f2160a6e240e46c022a44b9d7ecc98fda893473d022802", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274728, "uuid": "71abd2b9-bbd3-4245-9951-43b1bdfddb95", "value": "T16CA1E850112C1AB17246597AD26FFA52B50ECC1B09777B358473A63C74F5DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274728, "uuid": "52353257-0dd6-47a4-b16d-287df65b6266", "value": "96:/RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:/RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274728, "uuid": "c4e84bd5-7a99-4756-9ac0-91d8db5ebdbf", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274728, "uuid": "461b5a02-37f1-4a81-b686-50f160cfeeaf", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274728, "uuid": "8e454df0-4612-4b84-862a-08dff57591e1", "value": "4848ca6c8f2e17ff55dfd17548faa9964d9c2ccb7bb0d8537e33b5afd832e5c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5137540c-b5bc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649258096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258096, "uuid": "24b5fcfd-efc2-4669-9ec3-12bacc43c3b4", "comment": "Malware payload", "value": "84843b066cbb641f08e6a2cd205d553d", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258096, "uuid": "943d4469-3ca0-4ffa-b768-cbfe9e2b9fb4", "comment": "Malware payload", "value": "486753cca0b253566f04d9713862fd6dfc83aabdda297918c6592464e05a361f", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258096, "uuid": "03b5666a-6ee0-496f-a396-82691fd1bb9d", "comment": "Malware payload", "value": "b271262261256059e575d8f7c4e734def6907e42", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258096, "uuid": "331816fd-3ee9-4bcf-a7b5-2666448cb4cd", "comment": "Malware payload", "value": "d2fd2ccb77f3e4464b1793dcb6cf6e0643b1a098878cbdfbba7f1f7c7f2445564a5f74935d4ab7e02e0c0afac6a98060", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258096, "uuid": "6444227a-f4e4-419f-beca-bbdb403052b0", "value": "T109140279328FB369F4095DB7746789A6CBF8DE238CECA64501D5B95C4F36A0848432B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258096, "uuid": "e24a2af3-6331-49e4-b775-f2c387ce4703", "value": "3072:TQpX6GrjDrxU4E3hMxMnF35fANp6EREC0c5q3/EPwFbSICGYQzpX+Zis5csx5KAi:C6GJU4ERz3+gEE96VCb+QNXDsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649258096, "uuid": "1e17d4b0-1be7-4c54-bed4-e7cc2604c9d9", "value": 192008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649258096, "uuid": "dc492820-c071-4960-8b1e-b958e71fe244", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258096, "uuid": "c4616440-c86d-4ad4-85e2-8a55c0629ff4", "value": "Purchase Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d34734-b5cd-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649265452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649265452, "uuid": "f9bf818c-34e3-415b-ae02-05fbf51a5c1e", "comment": "Malware payload (AgentTesla)", "value": "d8ecc791d8824f43d90b939c1ea6e281", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649265452, "uuid": "36853fda-0577-48a9-b321-4e39d9bc7129", "comment": "Malware payload (AgentTesla)", "value": "48d99d1339b33d98d93ed3033e961eca6b91a8b78bfdc984b3fece11e833ed51", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649265452, "uuid": "b7509c59-f646-4863-a6ec-b87ca56bce4f", "comment": "Malware payload (AgentTesla)", "value": "ba29c3bb8d2c5588991cf356afb80a51cf7defd2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649265452, "uuid": "da024e67-2e45-47b8-b438-95ed90ae7f0c", "comment": "Malware payload (AgentTesla)", "value": "076773b5f7a91ce716894f2aab11f96e6cd03cf47e5d78e37a07eed2ecdb83a7f981d0d3bed4bbb58bde0bcb2e3f9c4c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649265452, "uuid": "4c8ad9fc-5a4c-4ee6-89e9-a82dd95d98b5", "value": "T145C4124123E8631EE4BD9BF1A9FE10814BF1B97F34E0E39549D2A1EF5A167409A01F87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649265452, "uuid": "e82bf7e0-e501-4fe5-a660-0189ffb86c0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649265452, "uuid": "f41c2145-645f-4f07-abae-e76e76521024", "value": "12288:F1ICMpExSLqTAxFvXAVHLqOQQiqds9MMDm2LJfcvF:sDpExoD7AlsQtdsMMrVcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649265452, "uuid": "524d21c4-0529-4bd2-a988-6c61b58380e5", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649265452, "uuid": "66bc850d-c749-4eb7-9b6e-37a92dc25ef3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649265452, "uuid": "1e4784ab-19bf-48bb-8a93-9109a6067261", "value": "pembayaran.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76caa7a-b5ec-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649278990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278990, "uuid": "a5d926ad-ec9b-4ccd-8141-e004e1a99861", "comment": "Malware payload (Formbook)", "value": "8666152b66aac4e3af33408b76a787b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278990, "uuid": "f7618bd1-0a9f-4abd-aecb-60f7d6f29cc7", "comment": "Malware payload (Formbook)", "value": "497c2d5740b4bc823bc809c1ef6aaeee3afe3a207844ed3271f9fe31d7d22aca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278990, "uuid": "4aceb4c5-2bdf-4bbc-bae3-49e24ad9dec0", "comment": "Malware payload (Formbook)", "value": "3e6f54a13c29b5381eaafeccfe29ee0d9a95290d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278990, "uuid": "af9b9332-8014-45ac-942b-f7a9ef637eae", "comment": "Malware payload (Formbook)", "value": "ac33046582573b47260edccb0f61430fb94b4e33b1480670a616395e543793151be28cb9a84f9375746a196b7a681420", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278990, "uuid": "a8d62c18-5f68-40df-bb72-f9271e0135e1", "value": "T1EB0512141594A95BCA6FEBF948FA0531537E6F667D68D12E3BF610CA6AB03C2D081333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278990, "uuid": "6672b51a-ab00-4035-958c-565797176730", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278990, "uuid": "8dd7bb7d-2673-450c-a992-0354984e82b2", "value": "24576:31GuyRLGI+NqfscBKxUMU2KzXmVHb7Nz8Ru:3IdGq8xUMUvmhNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278990, "uuid": "5b042d76-8f73-4cd3-9c43-1baf40de73d2", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278990, "uuid": "ad66ffee-aab8-4b3f-b817-de4c0fd5d5e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278990, "uuid": "b19f89b1-1461-4f53-82f6-3f2f8f6986bb", "value": "RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b2bd043-b5e9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649277386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277386, "uuid": "2f94f8d9-0b8c-4bc6-a445-b4a6df6c4088", "comment": "Malware payload (Formbook)", "value": "09e4447ea8d8d700e0a3db794172885e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277386, "uuid": "ffff77d6-c633-4786-af11-65011312d594", "comment": "Malware payload (Formbook)", "value": "499fb85e548a134abdf18b6a9d149b9c4f2bf9b0f534dd4c86e600180fb19bf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277386, "uuid": "2d3c8635-386b-42a5-a602-fd4b24debc63", "comment": "Malware payload (Formbook)", "value": "7bd049d3ad3383720fe7a722cad44636ee265b21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277386, "uuid": "5d52d774-bdd5-405c-94db-910fb7270c3c", "comment": "Malware payload (Formbook)", "value": "fb1c5d62c5c95db383e0ce06f3ac61e2c64a0f071b933735e86208c8d1cf804f08b07a24de043e0812c5fc9b5b2996be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277386, "uuid": "a312c833-4028-4dbe-b0f4-c842765c1344", "value": "T1AE05120030646B62D5BDCFFA0192D6564BFA221ABB58DD1AAFDB74C839C63C013D1A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277386, "uuid": "d6aad36f-f06d-4193-9764-16559006abf2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277386, "uuid": "aa090ae8-f127-4dfe-88e4-da2761907a99", "value": "12288:3/RM3113C3AIb7B546q7Du5GzC5tmMuKAXrrSj+o094lmB/sOJJH+LZAjJPcWdzY:KDSwIZZq70MCpQy2iOJJeLKjJ/JKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277386, "uuid": "62fa1f74-b5aa-4818-9b51-1b898fe903e5", "value": 801280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277386, "uuid": "becc24ba-9736-456d-98b1-b6fde80538ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277386, "uuid": "af525232-6f01-4c7d-a353-1399778ff957", "value": "Novo pedido de compra.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d80fb270-b5c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649262617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262617, "uuid": "7f18e091-2594-48a0-b365-37739ab896fa", "comment": "Malware payload (Loki)", "value": "1208c75ea6c4c445282bb57c6ea19769", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262617, "uuid": "6aa0e350-7190-4af7-bc26-93e9ce32043a", "comment": "Malware payload (Loki)", "value": "49f55e57bc1e513217c4c73953247e3be1e18d08393b67fca780d21a15026ec7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262617, "uuid": "951c5eb3-a3fc-45b4-a5bb-5f48c782dfc2", "comment": "Malware payload (Loki)", "value": "3726215ab8c8acc3c5708b31d5314ba38610118a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262617, "uuid": "eb6c4c42-aa51-4a70-a3e8-88aa7a8f1711", "comment": "Malware payload (Loki)", "value": "d774f9334e3ad967e3c5335b17fdd3ed6dd5c76ca6ada2d25513fc5110a6cc31a462031c162f3a782555ec19e7e196ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262617, "uuid": "ae116c07-52df-4002-9771-b4d7aa363575", "value": "T1363412C53AE4DC7BD8910D33AE3A53679FB6DA030561824F5310AF56BC92183CD1D39A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262617, "uuid": "a131602f-8ca6-4cf6-8ea1-82733a5337c3", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262617, "uuid": "baad6933-3c34-4524-9d9b-2eaad36c64d1", "value": "6144:HNeZmhWNPylWSmqs2Rbdf5WyY8LfwpN37XgO:HNlhWNPomO1dh28LfuNEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262617, "uuid": "ea7e3e5f-b364-4e3e-b5fb-1a4fed13bea3", "value": 238881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262617, "uuid": "d2cf8f90-d885-4ebe-9313-054ed64df50d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262617, "uuid": "201a1863-9072-4f79-a026-f814479917b0", "value": "1208c75ea6c4c445282bb57c6ea19769.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a9af2d7-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277895, "uuid": "8a365286-ba3a-42de-8ab6-b699e62a0cfb", "comment": "Malware payload", "value": "c913e7f95ddaa637ac5f1c092a229638", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277895, "uuid": "5e28a814-6b5a-4f82-b039-999936d1c3fa", "comment": "Malware payload", "value": "4a9805794f2fbab4eaaf9c5a94a8ae22d4948cf14e9e0105c91af037cc3d5a8c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277895, "uuid": "445603c2-53a8-4b2b-ab63-71b635289766", "comment": "Malware payload", "value": "f9319d554c36bf91fd11e9a8facb838bb49710e6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277895, "uuid": "ef997a6e-1ade-4c5a-9b55-0111ad3aac6c", "comment": "Malware payload", "value": "32267567482427556a464eef6c2af1324a0dd23fa443ce5b6026aba1f56a5529147be82df2834675459711145554db8b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277895, "uuid": "04ed97a2-b9e1-48d2-9de4-7ff72c3da84c", "value": "T1B6F08C55104E155E6A0BEE0D922990F231415C35A5A0062FF5AFFA67CB5DEE23E0E826", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277895, "uuid": "142e4400-80b9-49f5-99bb-86bd512a2d86", "value": "6:hUg6fncg+UJtsFLnKOIgmRnxpTf1rdMIBy1K/QGFIhxBy8DVNcIZtZFj7bfFWfic:Kj+2uVKgi9fNdlByeMBrDVNcM9jH9Wac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277895, "uuid": "0f3d11f0-25c2-47da-88c7-d5e11ce1be0f", "value": 508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277895, "uuid": "22417b80-97df-4019-954d-4f17a467551d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277895, "uuid": "49265d6b-586f-43bf-99ea-caa21739af21", "value": "4a9805794f2fbab4eaaf9c5a94a8ae22d4948cf14e9e0105c91af037cc3d5a8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe2b2273-b545-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649207276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649207276, "uuid": "357db1a2-8665-4a85-b316-786a18137b4a", "comment": "Malware payload (Heodo)", "value": "2a078a1aef47cfe312a59e2b064f86c2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649207276, "uuid": "7ec820b4-6e35-4d73-8821-aba308ed1592", "comment": "Malware payload (Heodo)", "value": "4a9bfdd2ba341b8c46ba4c87d17da64a66d9232fc32e38dbbd170afea59b30e3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649207276, "uuid": "c6025a5d-96f2-4931-a153-7b93ed5a695a", "comment": "Malware payload (Heodo)", "value": "643cf60ea440d1512f0441af6778397e7a8fdb3e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649207276, "uuid": "bed548e2-cbb4-40f6-8c33-fa2dfc196ec7", "comment": "Malware payload (Heodo)", "value": "1147d4cab8fcee20071fd2af49b0faa673df780590fbff240017c5cf6a72f51206c11ba04697bafb2e3f8515a8ce4e49", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649207276, "uuid": "d33941aa-52b7-4860-aa0b-1deceb13bd22", "value": "T108943A0173C390F0C657A574840FD525ACB7B83C6B19857EB24BA26F8BE78D09A346F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649207276, "uuid": "bb56455c-76d8-4926-ba25-a1e5a06cb7f6", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649207276, "uuid": "57b1d446-fa7d-4ceb-a718-1c55887953f0", "value": "6144:S5uok8qcKhyMlSXVKfKGS4Tp3wb8iZ7B1yarhX7ArkqBoEimFmzUM0r:S54yM33d3q3Z7BogcreNmF+U/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649207276, "uuid": "b9633880-c0fb-4d22-967d-16d70f64d0bd", "value": 423597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649207276, "uuid": "8f170a72-0f0c-40af-975c-4fb57e8526af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649207276, "uuid": "2cfddefc-9e7d-450a-b028-38cb5f4e6240", "value": "emotet_exe_e5_4a9bfdd2ba341b8c46ba4c87d17da64a66d9232fc32e38dbbd170afea59b30e3_2022-04-06__010751.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "984267be-b59f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649245760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245760, "uuid": "88324d46-09de-4ee4-8da8-310f80653d23", "comment": "Malware payload (AgentTesla)", "value": "0a15b36e197dd38e9dcc09b79031137a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245760, "uuid": "77eb05bf-81cd-4db8-bb7e-d625927d7a7e", "comment": "Malware payload (AgentTesla)", "value": "4b6b53a1906b98835694d17eefbbbd3f53c8eeeb5e85c965149cf298dd06b649", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245760, "uuid": "7d530d13-ff34-4a78-b642-1a70f30686e9", "comment": "Malware payload (AgentTesla)", "value": "00f3e68aa2d2c057a6453e8d621f4d758c3fcb99", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245760, "uuid": "355eefba-e6ed-496a-b752-aede2e47b6bd", "comment": "Malware payload (AgentTesla)", "value": "268a70c1b206611d80ddd336caa8291ecd10abb8f7f64dd2325cddc5649d06895d3430ab77338a79644e76687153ea1c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245760, "uuid": "3bdbbc38-aa17-4ffd-88c6-0b3796b36a71", "value": "T16DB42385E3FDD8278A0BE732D2B74A06126097DAE675DE1E4F0E9F31ED588D52426303", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245760, "uuid": "be08ed93-b957-427f-acff-ca2a64842c2f", "value": "12288:1k5UIOpT/RKFYclysC85SszyLkZ+p2zJq423JDE:1HIOx/RUYyPSNgP9UhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649245760, "uuid": "a5bc6fc3-7cd7-4aba-ad4c-156daab97df1", "value": 504635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649245760, "uuid": "f4fc5ef8-e05d-49e1-92d2-a097580c519b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245760, "uuid": "4d9e60be-1946-4b9c-bb62-e8c858d35b3c", "value": "RFQ_List_3003847.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20316bc-b553-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649213242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649213242, "uuid": "a47abe34-a7bc-4d51-a523-bbce0e370366", "comment": "Malware payload (Heodo)", "value": "4a8337dbc5f2441bd63c3e97ded57ad3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649213242, "uuid": "70b2d50f-e26e-4d36-af84-71c29aa5e493", "comment": "Malware payload (Heodo)", "value": "4b9cd199426b8e6ea202c17b0d4dba91baef05c8a7ae6409f65582b596fc1500", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649213242, "uuid": "ca518018-7708-49c1-8bf9-92c0944edd87", "comment": "Malware payload (Heodo)", "value": "7a8034d81eebf3e298f59e2622200b31191860d5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649213242, "uuid": "67f90ab0-bd4b-461a-a3c3-38f66d75150a", "comment": "Malware payload (Heodo)", "value": "4012a7123b92ac3252dcc7090cd9ab827aa02b30de45104128a0de609e2579cfc3bf64dbbe0318fdce9ebd8f309af67c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649213242, "uuid": "eeb5bcfd-ba52-4079-ac87-c81664e0d21e", "value": "T12DC46D0173C390F0C6576578840FE615AC7AB87C6B18857EB14B62AF4BF78D09A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649213242, "uuid": "1f6226be-1c24-425a-901d-33efdee2b69b", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649213242, "uuid": "e2b2bd30-5edc-416e-8481-7a886e332054", "value": "12288:S54yM33d3q3Z7BogcreNmF+U/9JckIAGfUebb:SKh3831Bo6N6+ADckbebb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649213242, "uuid": "2f432b7e-8adb-47b7-b550-df73ee54237b", "value": 551937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649213242, "uuid": "d6e318f5-d159-4190-abf6-cd161b3674c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649213242, "uuid": "79cd4e70-8669-4bb7-b049-5b1af9fad330", "value": "emotet_exe_e5_4b9cd199426b8e6ea202c17b0d4dba91baef05c8a7ae6409f65582b596fc1500_2022-04-06__024717.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5703e292-b5fe-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649286452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649286452, "uuid": "f6bd9e91-e2e8-4183-bffd-259d7873d5c8", "comment": "Malware payload", "value": "ca1329d1e4d440219c3e7e6a2627db66", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649286452, "uuid": "497c1497-ae3b-40fa-a4d5-a52218116d7b", "comment": "Malware payload", "value": "4b9fafe5dcba355df0fcccea0c94e765c9e1ad1977678dbea965605b1a969d8b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649286452, "uuid": "e91aedb2-7915-40e8-9587-82496c6d980a", "comment": "Malware payload", "value": "01f330c9ef1d682fcc66d986304e39e271fec125", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649286452, "uuid": "0acba9db-d376-4ec6-87f8-27b80e30df34", "comment": "Malware payload", "value": "2f609445f55c4491ccb7af3375fe2533f555f64616704cd1a37ae9d9deb98e984a68cf7bdea5f1b6412fbb2cbc199832", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649286452, "uuid": "18483968-f8f0-457b-a1ae-6788a14c3c50", "value": "T137E4D081B285C0BBC25D11B81567A71956BDFD609F38C2C3F694ABBFBE741C19838326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649286452, "uuid": "1b429cb3-5990-4bd4-9777-4d3b7104dbaa", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649286452, "uuid": "a23839ff-f967-4ae0-a10d-d1fce3eecbf3", "value": "6144:yG0wlrDan9+27GuYWOLt5ZZnB9iHC4CqheKYnKD9veymj9LQBiRXZ5j3YhUiRV70:yGVr2n9+ZuqRlSLheKYKD9ijX3rUXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649286452, "uuid": "0b5d2324-b69c-4884-9e56-c749d6d7aec3", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649286452, "uuid": "75d511d5-65d3-45a3-9d9d-abd66e3fa677", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649286452, "uuid": "295c1482-4aa1-47c4-981e-7e9cbc1d2c8c", "value": "emotet_exe_e4_76adea3e90208efd71909f010b59c84aeaf9291e4e58caafa70dd30df1bf2dd4_2022-04-06__230728.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bad00bd-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277897, "uuid": "495e1b30-ae68-465b-9154-e51e3b9a1e69", "comment": "Malware payload", "value": "14f5727571d61e66530c0448e3cffcbe", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277897, "uuid": "e7a4096d-7d27-4dc8-a0f7-9a64533ab262", "comment": "Malware payload", "value": "4bc28cb34f0b8a59d02b8c6f914a9960380ca938982ea938b2c9d86aac52d8f1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277897, "uuid": "9c40084f-00cd-4254-9a18-f5e63bd66ccc", "comment": "Malware payload", "value": "70eca93d951c2b1daf65cdabeb52a872cdff473a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277897, "uuid": "4544c045-91bf-4830-be83-0e23f451b25e", "comment": "Malware payload", "value": "e99d2e08ad753fb817d62590b16f7e3e8f85f30f3e589385a1e02b3074f62c9d460d87dd086bd82616588d9a80518c0d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277897, "uuid": "2d939555-9b34-48a3-94da-83e13e375a7a", "value": "T196E06891008625827A47FE1C96343BF234015CB4A2E0023E92A7ED17C53CE31371B825", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277897, "uuid": "ab388772-23ca-4139-8569-5f37176ce206", "value": "6:hOcbS28AIWEMWD0YzTEMWayDeRHoGFIWlKXxyWlX7rLIZt8bQyp:vbS27lWAYzTlLyyHblCNX7rLMmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277897, "uuid": "8465526d-5e44-4c37-9d4e-eda2af5515f6", "value": 395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277897, "uuid": "11235015-c1dc-4e3d-bcf5-90b936eedbb1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277897, "uuid": "a99f612e-2eed-41b7-a8d3-aa3318c2f5d2", "value": "4bc28cb34f0b8a59d02b8c6f914a9960380ca938982ea938b2c9d86aac52d8f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60921e0a-b588-11ec-8e58-42010a9c0032", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1649235788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649235788, "uuid": "13bb5b52-1597-4973-b221-bfcc77c4654f", "comment": "Malware payload (ArkeiStealer)", "value": "880924e5583978c615dd03ff89648093", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649235788, "uuid": "f39f61f5-a19c-425e-9080-5d18bcda8dde", "comment": "Malware payload (ArkeiStealer)", "value": "4bcff4386ce8fadce358ef0dbe90f8d5aa7b4c7aec93fca2e605ca2cbc52218b", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649235788, "uuid": "505bdbb7-41d1-4317-9eec-17be1166acee", "comment": "Malware payload (ArkeiStealer)", "value": "ef759f6eca63d6b05a7b6e395df3571c9703278b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649235788, "uuid": "4f8e8ac8-87bc-4851-a68e-ebe029afe23c", "comment": "Malware payload (ArkeiStealer)", "value": "c96900a7bbf54040883ace540b4756f6e750963494d29f9a145c07c6bd82259bbe4c156b25ff172313708a949de76023", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649235788, "uuid": "11a7c0d0-90d7-47a3-b2a4-e660d3d4dee6", "value": "T1C1F31A38D740F16AD4A200BAC97B8B75ED946B72138950CB93E4A88157351FDBE3389F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649235788, "uuid": "c08d6d6d-c242-4605-a82c-0882c3f038b2", "value": "4e06c011d59529bff8e1f1c88254b928", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649235788, "uuid": "f7004b93-9c61-495a-972e-8eab015cb0b9", "value": "3072:U/E8k9fjpIg+zNch12KbAwSaSMtmSu4/bVBt4b8EG:U/E8k9bwz6/tJc/4xM8EG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649235788, "uuid": "8f1c3ed4-96df-4680-9cc8-1f7cfa64e2aa", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649235788, "uuid": "425e51b0-2e63-454f-b9cb-9739568a0965", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649235788, "uuid": "c9ed42cf-9442-4bfd-affe-701142c78c0d", "value": "4bcff4386ce8fadce358ef0dbe90f8d5aa7b4c7aec93fca2e605ca2cbc52218b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d8057b3-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277900, "uuid": "628331a3-1649-4186-89af-c1f545c57c80", "comment": "Malware payload", "value": "0cbe8a0e66cf0d2c00bbe2efb82ae20f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277900, "uuid": "d65f05bd-78e9-4beb-9183-1d422bff6116", "comment": "Malware payload", "value": "4be89ba00a46f1c8dd9bcbc6c8a6b3f8769af245fc918ae0e137bdb1461ffff5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277900, "uuid": "613e1b7d-9a02-4eba-8d7e-d551e955ceb2", "comment": "Malware payload", "value": "8b2f0b6b48f10ba4607c700e861b6a8127abb9f7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277900, "uuid": "314d429b-e2db-4f80-9f38-f7490a3a4446", "comment": "Malware payload", "value": "9091e26fb8291b4bff50f97a23c3bc7ad424dbb0b42add8361b7dc150c2b73add6aebd1f9c7d2a66aaac19669ebcab6e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277900, "uuid": "ea4fc88a-ac42-4472-93c6-6604b7292200", "value": "T18AA1E850112C1AB17246597AD26FFA52B50EC81B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277900, "uuid": "341db72a-8261-4a05-bd55-0236b6ffd1a5", "value": "96:iRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:iRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277900, "uuid": "22eb2f2f-f9ef-4d79-84cc-1fd6433f93da", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277900, "uuid": "fd9f28dd-c0eb-4490-8b0e-5b0858539e43", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277900, "uuid": "d9e6b9b1-593b-41c4-acbb-bf0ac83dac52", "value": "4be89ba00a46f1c8dd9bcbc6c8a6b3f8769af245fc918ae0e137bdb1461ffff5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f086a0a-b5e3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274977, "uuid": "d81c2797-92d1-4cc7-a3a2-00f2d55172a1", "comment": "Malware payload", "value": "8648bf05c8241020cab2712861b8ed3b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274977, "uuid": "6d376099-8ce5-4aee-af02-f5d446f78b18", "comment": "Malware payload", "value": "4bee0604f55efbe6e033e7eeca323610b82803dfb44e9e75fd3a2dd6076a017c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274977, "uuid": "df9eebae-fd6c-404d-be82-f21a79051c8f", "comment": "Malware payload", "value": "8b0c58377fc8283d0f9aafa142d9fcb000779eaf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274977, "uuid": "641e4d01-74bf-4f1f-948a-9e0f77c76964", "comment": "Malware payload", "value": "79c6cf63d389d791b1614afb480597b65549afb5da72415bdad00e89da90fb1bddadc80b4ce713ab00f9b3a55bd89724", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274977, "uuid": "e074190f-99e5-47fd-bc14-853a1dd1b97b", "value": "T13F416CCA31B13D703C679CD7232A1C6435A290552C95EEC5ADDCB8FC8CCEE8562941EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274977, "uuid": "7a238bf5-59fd-4283-96d3-27d0cfa3085c", "value": "24:cCaDx8Cl9CJrRgraWH0CnCPCZxcChACCmzECVxHC8CT+3nCC+CXm:O9xEuPp+8py+3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274977, "uuid": "92cc7ef5-9ec3-4083-a5ae-f139788c4035", "value": 2092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274977, "uuid": "3a528589-bfa6-4fe3-99e9-7a61a247ac58", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274977, "uuid": "549f6915-542a-49e3-9b73-130cfc1f89c3", "value": "4bee0604f55efbe6e033e7eeca323610b82803dfb44e9e75fd3a2dd6076a017c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c264f7-b5e3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274959, "uuid": "998b9b01-c405-4dcc-a9ba-6d5ea653e24b", "comment": "Malware payload", "value": "65c976447c722c7c923dd9c762b86c7c", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274959, "uuid": "775fb718-586b-4c67-b408-b996602f4469", "comment": "Malware payload", "value": "4c19a20bb3ab2e43b40f8863cc668bd47e13d74951c1ee404c6be6e7ce217b5f", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274959, "uuid": "d4fa4b51-8801-4068-90b4-413ff7677d25", "comment": "Malware payload", "value": "4fc22ba79896ef6b83f1876996a812e033c41522", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274959, "uuid": "3b0464cb-ceb5-4c97-975d-9004fcf01271", "comment": "Malware payload", "value": "a8c271d4c86807172602c0c9acb1ef5205b32245ec8481822bdc50c3e1ae22af432f3fce2edbfd19fc42a888dd132540", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274959, "uuid": "76d8d59a-7150-45c8-bd47-0233ddc75816", "value": "T192A53379B6DE30BD9AA8717767FFC924303B96CDA0558BE06DBA11CE14022319AD4F1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274959, "uuid": "d716723d-cb04-4fad-b3ad-26c27da71c0f", "value": "49152:tT0+oOBiXLUNaRHKmjsbS21i2F/ecE+0n9aFctnpbbTruN3MKv:tos909Qg6ecEZHyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274959, "uuid": "c4e1ed90-7f76-4e68-88c7-c71fa34d741b", "value": 2072576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274959, "uuid": "dfb88579-98f7-450c-85d0-3adb1cecf2e9", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274959, "uuid": "5eaf51a3-3c89-4037-b62b-e3ed0662cf40", "value": "4c19a20bb3ab2e43b40f8863cc668bd47e13d74951c1ee404c6be6e7ce217b5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996d42ee-b5e3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274967, "uuid": "44f88d20-281e-43b6-a6f3-fd1dd5663d11", "comment": "Malware payload", "value": "6472d8b692b15f743c6383216de53990", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274967, "uuid": "1a5bbcc1-50b3-496a-94c4-a9a388a31852", "comment": "Malware payload", "value": "4c4ce2190fec21e3b1a7cce6a7f262cbdb1630f75986cccfaef6c40439b5a11a", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274967, "uuid": "43f8ded3-273d-43a8-a174-e74d420ba5f2", "comment": "Malware payload", "value": "40d0f102a0ef727c618ae626725642f6906cb947", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274967, "uuid": "5fb3558a-93e9-4644-a9b7-36f52fb87407", "comment": "Malware payload", "value": "f595d4b8e24727670f5a8d1f9a5db9ce2e2855383e4fb185cc7f98a5685a8ed2c332feef2100d51d6a27feca7a6c7e32", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274967, "uuid": "88d73a86-986a-474d-980e-a7d687b59b20", "value": "T11F15330952B77CC9F6AF2A3416530CA8C3EE91F2A056929912880C9115777BDB35F3FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274967, "uuid": "8ece02ce-12ff-4b45-8309-e10b67465dc0", "value": "24576:IVbRYvjxOgOhntwZIdc/th82I0uDkbekANU:IDSOgOhntWID2I0WkAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274967, "uuid": "65a71d6b-e1b6-4826-92ad-dee05fc48b9b", "value": 901120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274967, "uuid": "c1366314-3c1b-4005-9de9-7da58065ab50", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274967, "uuid": "951a473f-385d-4d7e-af61-b994a9a04d6e", "value": "4c4ce2190fec21e3b1a7cce6a7f262cbdb1630f75986cccfaef6c40439b5a11a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f8476d8-b5c7-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649262925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262925, "uuid": "94ac4ec1-d54b-4bec-814f-536c72d83f43", "comment": "Malware payload (RedLineStealer)", "value": "34bd384aee437aecbe5bad0e067ecbdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262925, "uuid": "92e7737c-2836-438b-b963-089e88b85fb6", "comment": "Malware payload (RedLineStealer)", "value": "4ca6cda3d84856f3c7832e41b64924cf402d2b16aa11d30678111d60c3a31446", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262925, "uuid": "d11d8e57-5ce8-4d7e-acb0-dc8c39f78567", "comment": "Malware payload (RedLineStealer)", "value": "65a9973e24b18ae6cb73e6a391065c32d37e28a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262925, "uuid": "e6097b84-6ed8-4e5a-97c3-eab76ed7b48a", "comment": "Malware payload (RedLineStealer)", "value": "f16c93f6da1f1f11ea59eff11a7c8e5255a86f548a587b12a0e9da05fe638a252a8046d852b4c032f24bbf882baeea0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262925, "uuid": "2562ee3e-d03a-43c5-bb48-c9f89e7e78a4", "value": "T1E4152343B3C4C946C86C1933EADF8EA30F44AD4BAAADCE0797D9745BCEF5A5E8601510", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262925, "uuid": "5c03bb5d-1809-42d5-85d7-76d215b1609f", "value": "5fc341ff9739e89f3d28095e0df71740", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262925, "uuid": "56929d77-4ace-4378-80ad-5b8dcdc3d984", "value": "24576:Eo7wvaBMFvW/fE58X2O0kk0mnQs79ZADrE+r4nznqer7:T/sjO0p0gQs7sEM4n+er7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262925, "uuid": "9d7c78fe-ddec-4847-ad39-344ddbc9fa22", "value": 896464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262925, "uuid": "f46b17fc-5911-4452-99e5-84bdac277826", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262925, "uuid": "4df9429b-6174-4a56-b5de-e543503d1291", "value": "34bd384aee437aecbe5bad0e067ecbdd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d9bccf-b5e8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649276976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276976, "uuid": "45770458-f789-49ca-ac1a-5ea5fe7d749d", "comment": "Malware payload (Mirai)", "value": "4d1b1ef88d822c2949a90ddec12c31a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276976, "uuid": "88879efc-b96d-42ed-b3a7-9789a62c52b4", "comment": "Malware payload (Mirai)", "value": "4cc0616b8314a96bb8d5fa891de0a56ec51ddbabdfce15a30babe251b9cc0d5c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276976, "uuid": "f675d46f-dc3c-4a81-94e0-e98579efe580", "comment": "Malware payload (Mirai)", "value": "3cbd8a8ec6ce3cff23863115599d6a07ab2095ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276976, "uuid": "613d2894-0546-4519-a913-b6701e59956e", "comment": "Malware payload (Mirai)", "value": "5de769f4043d3799309001fdcef8b0814d6f49e4d8234f4a0b5f27af782ba67c2b094ffdb3dd4a7e9f052b12372633d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276976, "uuid": "1e3fbe15-7a9b-4e6e-b49b-16d1e906b062", "value": "T1E2C2D05EB592B98ECE6D7DFEF094236036AC51D0339D4B82C3224DC8656C647F08E5BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276976, "uuid": "c2425245-3323-4173-ab18-6240193d95b6", "value": "768:ipi1wDn6wAE68b++tZo9bWYj2NLeiAfgKWkY:iVDJ48b+S+rURsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649276976, "uuid": "c46f235f-5c08-4da8-9139-38ac9fc7b037", "value": 26140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649276976, "uuid": "457d137a-a45b-4ae1-882a-f3b42851c9cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276976, "uuid": "e177afe1-84ba-44fa-bf67-bdc0b467f5df", "value": "4d1b1ef88d822c2949a90ddec12c31a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7105f998-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277906, "uuid": "a2caf184-10a8-4b18-a66f-3fd33e54045b", "comment": "Malware payload", "value": "1a686f4474f355792fe4ce9489381641", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277906, "uuid": "f7a3a41e-4bc8-4734-bb12-5ada87c84717", "comment": "Malware payload", "value": "4d3b6ff4a02f1e7f79dde2f6978d3c757477ef440333b58ffdce577d53ff1fba", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277906, "uuid": "cb0cc79e-73ce-4ec3-a334-863882138630", "comment": "Malware payload", "value": "426c9e240ab4fb1f4e0e69415c54aa3a30028c8d", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277906, "uuid": "a27931e2-688e-4d55-bb32-be7eca39294c", "comment": "Malware payload", "value": "4e790c0d3a20b888e00508d5a9bdc53b396bac9701b97ce14d0fb76d970d97a9b98b51c1eb39ac7a9a820381c201b839", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277906, "uuid": "2cdbee5c-5769-4095-81e1-3165b42f2d69", "value": "T11F753378B6CA35BF696CB5379BEFC939302FD5D8D01ACFE04DA610C924054329AE4A1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277906, "uuid": "cfc3378a-54c4-4e58-b1ef-790cced0689c", "value": "49152:tT0+oOBiXLUNaRHKmjsbS21i2F/ecE+0n9aFctnpbbTQ:tos909Qg6ecEZH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277906, "uuid": "ddeed09c-bc91-49f1-b3b8-2c9f712adde5", "value": 1626112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277906, "uuid": "e35e5729-a8ee-4b21-a84d-f91a3759d91f", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277906, "uuid": "e71a7896-a916-4a4c-92b1-76d9b984e29c", "value": "4d3b6ff4a02f1e7f79dde2f6978d3c757477ef440333b58ffdce577d53ff1fba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b493ec4d-b5db-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649271577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649271577, "uuid": "819320eb-2580-43a1-8581-1c7f279625ec", "comment": "Malware payload (Loki)", "value": "f059cb0e2bf92d463c0a302220099970", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649271577, "uuid": "75a9ad52-86c7-4d8e-aaef-a5018419d6dc", "comment": "Malware payload (Loki)", "value": "4d6e8450b571967045de07da909240364f937d85fd1f66a1c908d2c927d9982d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649271577, "uuid": "0b02d735-d81a-409a-9f1f-ee63364f254c", "comment": "Malware payload (Loki)", "value": "7d3eaa454323008ccd1359fe228e846f306c6971", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649271577, "uuid": "e49d9c12-189a-4ab1-a278-48a8a2a27d6f", "comment": "Malware payload (Loki)", "value": "d60c02b786d63e569d0b4989d36a32668d0f680ff07854f54350c89ecd8e1a2f441700f45da4e9f15046d7f7f11f9fe7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649271577, "uuid": "292298dd-891f-4fd9-94d3-41ff01d22b2e", "value": "T18DF4AD59FBF6CE52E2AC0B77C4D75C0843B1A961E10AE72F3B9166E509033AB8C4574B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649271577, "uuid": "db9d8df2-03c4-4c1f-9909-abcc408ddf1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649271577, "uuid": "7638e464-a151-47aa-9075-7089f464195b", "value": "12288:pFI92sO59KvGJyGk+N/OvINK1TaQqbV3I0f4A8AA39W:pFI92TQGJhk5INmTlIVNA9j39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649271577, "uuid": "0746cbe6-5512-4815-8f91-393bb09aa4db", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649271577, "uuid": "d2ca11bb-c4a9-411a-b5ed-b80680d3e8c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649271577, "uuid": "a6f4cf5b-eacd-47e7-89a7-c222bd557187", "value": "MAR_SOA__SHIPMENTS_TT_SLIP_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d9d458-b5e3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274909, "uuid": "008b7cb3-f776-493f-9de0-db59b33da46c", "comment": "Malware payload", "value": "3abda258c6ea4e2d95376a4b6aa959e2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274909, "uuid": "12cc9c04-8f86-48e8-aee7-2bb8bf34c2d5", "comment": "Malware payload", "value": "4e2821e1f05d13efed6dc26bae8cdc2d5753be8e2d6fa83bff7639ee28193904", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274909, "uuid": "5e685a21-12d4-4895-bed7-78e52203af6e", "comment": "Malware payload", "value": "eeb134b1a674824814d0b6cfc96056a700b4fbd8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274909, "uuid": "a961339f-3992-4ab1-af63-bd7784a19aee", "comment": "Malware payload", "value": "e09d395efe753430ea4e7b62283e53944e4ad0ed3e03c6dd4d534430d6f7cfc953001d969341c2338a577dd8855f45c5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274909, "uuid": "36b8c30f-67b7-4619-b8c0-38ef2ad1e00d", "value": "T1DEA1F750112C1AB07346697AD26FFA52B80ECC1B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274909, "uuid": "c89c67ab-cc6c-4420-b128-50ca9ac55926", "value": "96:hRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:hRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274909, "uuid": "8a5a3fc4-fdd2-4347-8a37-cb590b5b31d3", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274909, "uuid": "12e14c4b-2f04-425d-bf50-ee02c659146b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274909, "uuid": "19bcac1d-8d92-4bc0-a51d-39801791ce21", "value": "4e2821e1f05d13efed6dc26bae8cdc2d5753be8e2d6fa83bff7639ee28193904", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e37d1c7-b5e3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274922, "uuid": "852aeb27-dae0-4611-b397-c26f38e0294c", "comment": "Malware payload", "value": "acbaf3156eb1dbebdd772347fdd31d39", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274922, "uuid": "b2498f41-4bbe-4d3a-9115-38e83bf3d4c6", "comment": "Malware payload", "value": "4e4b47ec0bb65059f69b3512764387277ae0ed34d7c3ea190637732c77db0a68", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274922, "uuid": "5c249d96-1935-463b-b362-be6699d3f7aa", "comment": "Malware payload", "value": "e76eec2bf40883aea8b94ceb9a3486d14d6fa0a4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274922, "uuid": "cc6e5c76-0ff9-4fce-9ccc-0bb6ade95451", "comment": "Malware payload", "value": "2fe8cf417d65414ce109e6d38e605d6b6545f7d2b3f6ac69ac72ea85142723bc70094acdf9ab53e6234e9f198ec177c0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274922, "uuid": "9359f5bb-3587-4204-a1be-b68eaacec26e", "value": "T1B7A1E850112C1AB17246597AD26FFB52B50EC81B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274922, "uuid": "93cf2c2c-94e7-42e9-ad0c-480be52c071d", "value": "96:RRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:RRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274922, "uuid": "ce038c19-c0bd-4720-92a3-8167f28ddcea", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274922, "uuid": "8fa07916-a17c-4aaa-8dcd-c488568463ba", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274922, "uuid": "daffb71f-3e71-44cd-8740-79697ec0f097", "value": "4e4b47ec0bb65059f69b3512764387277ae0ed34d7c3ea190637732c77db0a68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c1247ff-b575-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649227593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649227593, "uuid": "4bb01d2f-9b82-4a52-9cb6-1fa1e30849e6", "comment": "Malware payload (Loki)", "value": "1342e7c351aa4de6ced78f7db512bd9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649227593, "uuid": "952a3b54-a807-48a2-8231-e7f348fd4147", "comment": "Malware payload (Loki)", "value": "4eb001f1b608f98b7295f13f27858d2c281a18989e884c309de3b71298a4149a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649227593, "uuid": "cb068451-b287-41bb-be89-f3780adbbf84", "comment": "Malware payload (Loki)", "value": "fc873a1efe76ee9679a71270cb6de7cff219f931", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649227593, "uuid": "c983d404-7f13-4780-b68c-6318b25a3c8e", "comment": "Malware payload (Loki)", "value": "d4409e1fcc2385d4721b682379bb7c0e701bf62d3a4de83eb87958651179988bb3849911e9c4000492e41aff3f8e4fff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649227593, "uuid": "cb07e331-dce7-4cc9-b2e4-827e8fae75a3", "value": "T194036C22B75B6812C82E4931C19B81105B32A3477597C6AF36ED425C9F837CF0B99B9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649227593, "uuid": "7d7ebf57-bf03-48bd-9793-ed05c9735126", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649227593, "uuid": "2fff7378-c6cb-41e8-8117-560f4fc563a5", "value": "384:nHjEsWl8m97Fy/GjRnGp7ofbxPFyMpRu2g4KMleISDRYyff9vwEG9/XwJwq6uJfJ:HjjWmq27ofFPFyqRsMSDA2GzS2al9hR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649227593, "uuid": "3b6d5c57-8ada-4400-83d7-4fe042535d8d", "value": 38448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649227593, "uuid": "21229837-93b3-45cf-8914-040fe6f79ee4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649227593, "uuid": "c67c06a8-3b80-4248-85f8-c143fba983f1", "value": "Shipping Document PL&BL Draft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870f8fca-b55a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1649216095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649216095, "uuid": "8a805d49-bb9a-4811-8f12-1318c1b896f6", "comment": "Malware payload (AveMariaRAT)", "value": "572de728caefc13833fbfb482cefcd4d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649216095, "uuid": "8d437646-0e8c-43b9-9f09-5220239bfe23", "comment": "Malware payload (AveMariaRAT)", "value": "4f4640e94099d07f3be2a07994819b8bf2f763cfbe8ca5303f5599f8e8a593da", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649216095, "uuid": "626d5e1c-a7dd-4ca0-8e90-32a7be1779b3", "comment": "Malware payload (AveMariaRAT)", "value": "56c00f8e4ba75c3ee5f2fc2671b7a15111cfcc02", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649216095, "uuid": "cc007332-0533-42a1-909f-3607abe13af9", "comment": "Malware payload (AveMariaRAT)", "value": "ccb8146e17f2ad04767ed936ce0ee37dda8942aff33df90a06b289e600b9b564ced8c59ba2d13c1b7cd0661f434c1667", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649216095, "uuid": "4f48e3b2-8dd5-4beb-82b9-57a649df8fb7", "value": "T10734125430F8C2A7DCF603B02FB86567559BAA1101B4AB0FB3146F9E38327865D8FB52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649216095, "uuid": "159781fb-78da-428b-9558-2e40049c8e97", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649216095, "uuid": "7a5ec84e-cf6a-4cd7-969d-439c52a621a5", "value": "6144:HNeZm8NC2S/3Jb0SHpeaBi+/XV97uH9DomaY4:HNl8k2UZoipeaB2omK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649216095, "uuid": "24ef3474-e12a-4245-a6ca-ea3f3106ba55", "value": 245003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649216095, "uuid": "cea22115-e23a-42eb-95df-db3802f16991", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649216095, "uuid": "cb2a19df-80c7-46e1-8a2d-250e0262ced2", "value": "SecuriteInfo.com.Trojan.Loader.1017.14732.2585", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e5ba01-b5c3-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1649261063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261063, "uuid": "78c0b802-ea8d-4ccf-80f4-91dcd2dc6c3b", "comment": "Malware payload (RemcosRAT)", "value": "826f89868d5291a7aacc86ea2b936221", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261063, "uuid": "5bed331a-f967-4b94-8fdd-8d64d8e61497", "comment": "Malware payload (RemcosRAT)", "value": "4f64dc73847516de20d77365ca59b1877bd56e899cca6d2e56338ff462de2ec1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261063, "uuid": "4fe0498e-cf65-462a-8bd1-5c3e34367d10", "comment": "Malware payload (RemcosRAT)", "value": "cffaf5e82f3440a244bcb27668405d15f14ecf58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261063, "uuid": "1bcf64df-a0d9-4175-b900-c7d078d5ad50", "comment": "Malware payload (RemcosRAT)", "value": "485a0d8325125caefe380716d3a1c5f2df2037e439850aabc47dfa07509e08b0cdda843c514689ab7b8238af46742caf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261063, "uuid": "b198aed7-aa39-4770-a45f-8b4e2cdc8ac8", "value": "T1C90522257BD44B56E4BD1FF60A638040537B7B76443AE7CD1C8552CA1833F81D2A2B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261063, "uuid": "80c96434-1027-4fa3-96bb-7328e92627c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261063, "uuid": "e1bb49d4-d95b-424c-8798-1ee4616671d0", "value": "12288:Az2eXo6+CcuKrRH73957DjEIiCK/SCwjuKqiSb2gQ8869KCWY/XB65ug2:+Xt9cfZ5ziC0Cvqhb2/qKCTZ65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649261063, "uuid": "8b9aa941-21e1-47f2-a7be-9106a998ec4f", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649261063, "uuid": "7ffac078-72df-4d44-aa73-c877c31d5dd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261063, "uuid": "2a525471-af87-40f0-9cce-b524fb2463e3", "value": "826f89868d5291a7aacc86ea2b936221", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b31b8349-b5c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649262555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262555, "uuid": "9af1121b-8981-4dbc-a040-fce825346191", "comment": "Malware payload (Loki)", "value": "a974d8adf1e53b735f033a932301f64a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262555, "uuid": "1b168bf9-e9c2-41ac-8710-56fa5e4e1a6e", "comment": "Malware payload (Loki)", "value": "4fb69901a619af8f1e33045373fb0fd6691131bc83f40aa46a03805da004f897", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262555, "uuid": "87c8bd59-57ce-439e-b789-407c9331c8c5", "comment": "Malware payload (Loki)", "value": "047b3cb1a9d3c476548e641c63fdd07d46d0c519", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262555, "uuid": "1d2ebaa6-d1bc-49ff-a05c-4f7d4ba25eb3", "comment": "Malware payload (Loki)", "value": "42d8fc4d85b165a515381e37f8f8ba52fec61391b74c830e9a167b7fdf64c5aa464dec19ebe9473399125c4428ad2e58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262555, "uuid": "c585fa61-9a06-4ae6-9ca4-e92fb7bd074c", "value": "T1283412586B60C4F7D1B20F306C399D77AABEA60535518B0F5720D94A3A377A3DA4E382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262555, "uuid": "01c19292-92cd-4483-8b56-2f51ab8d5774", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262555, "uuid": "640ef758-fc77-40fe-808a-72041d110e96", "value": "6144:HNeZmDuG6i/igDh9O8wt6dwpxjlJ3ig6ZeZV+An0ME:HNlDuGt/zDNwgGpxJJF6ZeZtLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262555, "uuid": "53728a0a-66e5-48a4-b144-822eb9d93170", "value": 238711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262555, "uuid": "1c00be5d-5168-4c18-8d30-68c61a7414f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262555, "uuid": "9f4ac717-3ff7-499f-ab43-b8586e3c2e48", "value": "a974d8adf1e53b735f033a932301f64a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ca1eb6-b5e3-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649274741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274741, "uuid": "fc7288f6-86ec-413b-ab00-e5365639ab6f", "comment": "Malware payload (AgentTesla)", "value": "1f0cce9c27f8dbc7d0b2c996f8c4d12d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274741, "uuid": "c9bd9615-a502-4451-82f9-d149bd0ab4f3", "comment": "Malware payload (AgentTesla)", "value": "5079dbd9f11f35569cc43305df4c22a3cbd88d84384956be5384bb878f0c75ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274741, "uuid": "c1db51cd-f191-4bbe-98cf-fd17226a0f41", "comment": "Malware payload (AgentTesla)", "value": "c0d2078e4ad4d678674901d7de4830e8bbe90402", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274741, "uuid": "1f1dcacc-9a1d-4c4f-91b3-5ebc8c17595b", "comment": "Malware payload (AgentTesla)", "value": "100b10868b5797cc32d9f0bb17f24bc25914f4cd4760796c3227af4a3e9ae22ae82135bafcbce561be4d438fccd6826a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274741, "uuid": "44ff6153-2e9e-4218-a857-76aac2265bda", "value": "T17B44121D1AD086A3F5E35B7A0C3EE622CFFD922105715B8F1316AE5DF972682C61D322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274741, "uuid": "572c3a1d-5e73-453f-b876-13d2f0263b5c", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274741, "uuid": "fa6cde89-7cd4-4232-b133-e1e823b8053f", "value": "6144:HNeZmbk8rLAsz3A25ErGWQ3Ww6EVBnuWjVyCfxirq6s0l/m:HNlY8rL/Uw1V3wEruWjVRivs0M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274741, "uuid": "235191e6-4f5e-40a4-9273-983e0c326b6d", "value": 272839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274741, "uuid": "78d8b82d-3029-4af0-86a3-b5b4c70e95f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274741, "uuid": "71290e3a-13be-45bd-8112-3173a0c19bcb", "value": "REF0000301129930990211_04-2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7bf1b68-b5e2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274696, "uuid": "162aa0b6-62d5-4862-851d-7ed53fad4b14", "comment": "Malware payload", "value": "4272c3babc61838bd5238a01c40d8719", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274696, "uuid": "d0990c3e-648d-4fba-9b52-51f21c3fc106", "comment": "Malware payload", "value": "508465cc583286b8cc860dae9da20145b9aeb26a1ca40b2db229fd6c7890561b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274696, "uuid": "eb8881a0-dc59-4fd9-b89e-b9a382b002d7", "comment": "Malware payload", "value": "e231f63bf8a50cb34eb904e9f662f6403fd05276", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274696, "uuid": "e9a6ed82-9270-48d2-bf14-e30a0220a189", "comment": "Malware payload", "value": "d66cad9960bff702115292c003ada6dcb75fb2a68898db863d47736a8dc73530ced92a112172c395887733d62d7fdcc4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274696, "uuid": "5d66d191-7eae-46fa-94be-d2f015d8e5e9", "value": "T133A1F750112C1AB07646697AD26FFA52B80EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274696, "uuid": "65643843-c453-4524-a867-5e16382c9778", "value": "96:FRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:FRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274696, "uuid": "622b468e-8a51-4f45-91b6-72fbff899ec6", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274696, "uuid": "adf543b4-d50c-4fcf-8895-1daf57ff7b45", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274696, "uuid": "798ce083-f504-4b1f-8762-2f73c3930aba", "value": "508465cc583286b8cc860dae9da20145b9aeb26a1ca40b2db229fd6c7890561b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2662e37e-b5e4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649275204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275204, "uuid": "4bdc7179-844f-426c-ad2f-49cf2401d2c4", "comment": "Malware payload (Mirai)", "value": "200f53dbb0eaf2c9a40582ede0305847", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275204, "uuid": "f3688fd3-8c68-46e8-9075-454d28ea760b", "comment": "Malware payload (Mirai)", "value": "50d51b6d714498cd476602dc09aaa54515ccd0259f848d63e7b5a943d6a38253", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275204, "uuid": "9781c355-4fa8-4384-afca-8bb9a6dc0596", "comment": "Malware payload (Mirai)", "value": "819ffddc575165752cab094e9ea6e7952e4d18b3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275204, "uuid": "5bf4d1d9-0852-4767-8a2c-a482084f0f76", "comment": "Malware payload (Mirai)", "value": "f61f5cf9d6640d63b3be7fa5573bd52b9ee23f348353b4f52cfb62e878f8651a2c0aad36dc5d351267774a28271ff23a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649275204, "uuid": "01680861-a599-4194-bf4d-c2c21adb16fc", "value": "T16AD33A46FA408B13C1C61B76FA9F414A3322DB94D3DB330699189FF43F86A9E4E27645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649275204, "uuid": "416ae1c0-fa29-43f4-b374-1b476eb35fea", "value": "3072:AykcA1AVtbCc3ePJYYQwYIGGUONa1jWpM/9o0DObPzv:AyoYN6PJYYQNrGfa1jQM/97DkPzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649275204, "uuid": "195d9d1f-1afd-461c-887d-5a76a85766f6", "value": 139664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649275204, "uuid": "dc514807-1e54-4b59-bcdd-74bf7d34a174", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649275204, "uuid": "43e6ec68-40f8-43b7-9965-77225fc8e61a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e07021-b547-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649207898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649207898, "uuid": "2f8dec82-713c-41e1-83e4-5d325824169c", "comment": "Malware payload (Heodo)", "value": "04ea3d536524dad86463041901b58e16", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649207898, "uuid": "8122b7ca-46be-48bd-9c0d-ccb907aaca97", "comment": "Malware payload (Heodo)", "value": "50f986af3b8c1188c243e26c3cfe2f5de415a09d9384ea0422ade95e8f9b43e5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649207898, "uuid": "bc0df485-9d53-47ad-92ef-525ce5b70ead", "comment": "Malware payload (Heodo)", "value": "3d856410052263a9daa7e00f4ec143a0d0aa974c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649207898, "uuid": "f0e2e332-ab4b-4294-b7e1-2ebaf3bf02b2", "comment": "Malware payload (Heodo)", "value": "7a91edce914e13dc33bed323eba4c46bc7038c24dd3d7670f5be157be8d3e1d9956ad7cd53f4ab641aae3cb123f26ebb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649207898, "uuid": "966438af-99a0-43f1-805e-b583ebff74d2", "value": "T16444107D0FAE0052CC221770545C0FD991ABCA25BB125AFF24992E2E2EB57D718B9F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649207898, "uuid": "55c9663e-f110-44dd-9b31-6cf2946a545e", "value": "1536:0wAjC++znd222222dccccxjjjayfzzzf2222cfiu8xrdxHNHNEBQdKELL4Ot4Otc:rA5pcWyfJCALTQMLOuwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649207898, "uuid": "9512e4ae-9c2c-40a4-961c-2a8abd8be7db", "value": 256000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649207898, "uuid": "4f63c64b-ef2d-4db6-b784-f05ad07a0bf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649207898, "uuid": "c9c97115-677c-4c9e-84b7-42b1453569b3", "value": "emotet_exe_e5_50f986af3b8c1188c243e26c3cfe2f5de415a09d9384ea0422ade95e8f9b43e5_2022-04-06__011813.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe41700-b5a9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649250094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250094, "uuid": "17c31503-b930-4e45-8648-1cc14e7fd5c3", "comment": "Malware payload", "value": "f95a9abbc603335b5e0e87bb51c71c5f", "object_relation": "md5", "Tag": [ { "name": "Cicada", "colour": "#47E440", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250094, "uuid": "a748d812-d038-452a-89f0-359d249a1a7d", "comment": "Malware payload", "value": "5269db6b19a1d758c75e58ee9bbf2f8fd684cfedbfe712d5b0182d7bbd3a1690", "object_relation": "sha256", "Tag": [ { "name": "Cicada", "colour": "#47E440", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250094, "uuid": "9461cf95-b4d9-442e-af9c-75e540be9f87", "comment": "Malware payload", "value": "afe11f699931cf30f94315cdf14d3561b3a6543e", "object_relation": "sha1", "Tag": [ { "name": "Cicada", "colour": "#47E440", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250094, "uuid": "87e215d6-81e2-42ac-bc65-3402b2d4b9b2", "comment": "Malware payload", "value": "1bdb03b3078a7fb8d8f3af33430ca960539554bcf467dcf3008f9233eb67ce51d8d3d5c9ce3428a46847c53b19a506fb", "object_relation": "sha3-384", "Tag": [ { "name": "Cicada", "colour": "#47E440", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250094, "uuid": "e1d2010b-9b63-4e06-8fc9-852b29907667", "value": "T1FE434A5A676100F9E0638B35C8F14A96EB73F502A3B5930F425C81660FA37C66F38B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250094, "uuid": "8260f335-c829-4d13-be90-4cb280f28bfd", "value": "11d5d2b6f7d49f50409929cd2038a4ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250094, "uuid": "f1a5f43f-7f52-4d6a-be30-e9d98d625b3c", "value": "768:swFX+/npllLTFZ/uxx8Zwg57kzXnadOIUR2XX+kDjOsFSH7yw8puGIytED6RBjrn:swFcFLTF1tZwBXaYnR+BOs4OsytERs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649250094, "uuid": "9ab1f173-6aa4-4862-a335-12b208c81a5f", "value": 57120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649250094, "uuid": "e5efdb41-bb4b-4be6-aba2-62127cfccd6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250094, "uuid": "c9416203-6d08-4b30-8768-0518fa5b62ac", "value": "5269db6b19a1d758c75e58ee9bbf2f8fd684cfedbfe712d5b0182d7bbd3a1690", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0713920-b5c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649262631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262631, "uuid": "f31e1649-db92-49ed-bc77-6f04935061fc", "comment": "Malware payload (Loki)", "value": "8b3d981e101bbc9e5e2fdbfdb30dbaff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262631, "uuid": "8fca15bb-edbd-4f84-870f-f71c823dc262", "comment": "Malware payload (Loki)", "value": "539ac32027aa267d15ff949225382106f00f5eb3bee212d9675f391064359fed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262631, "uuid": "43ee0b1e-c44a-4cd7-98f9-8de78dba2512", "comment": "Malware payload (Loki)", "value": "eee239ef4a499a2eac63a01337b31b7a64638b6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262631, "uuid": "6075bb4c-6399-44b3-af03-a3f9aa7b4771", "comment": "Malware payload (Loki)", "value": "d001fd6ac6f099c7e865bffc0a4f692d1d18b07bd2ff536ab11f61c1e7b4a8e750926fe6ed1e0f08e6011c9ce15ebd1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262631, "uuid": "63016d94-35d8-451d-b6ee-504a81deb885", "value": "T1B234021666A0C42BF8B245B20F72B357AFEA947751E0634F13104FBCBD287529B0D7A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262631, "uuid": "b7422730-57de-4428-9d1e-7b8cc02acf5a", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262631, "uuid": "64ac4e83-28ba-4bf0-9773-5135db2d4b21", "value": "6144:HNeZmZPa31noGNlkEnvAHZmYGoTVZPopZYzGjP:HNlQ3WAVoHIYGo3PopZ1jP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262631, "uuid": "eee11a89-6142-48df-b467-cc7e65ac7fdd", "value": 236023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262631, "uuid": "e8e44649-d765-433f-ba34-9cd5dba9a916", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262631, "uuid": "5b791012-dec3-4b89-9aa6-e4576c23f141", "value": "8b3d981e101bbc9e5e2fdbfdb30dbaff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27990ed4-b5ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649257167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257167, "uuid": "5a32bfd7-c9c1-4767-824d-e36138ab708b", "comment": "Malware payload (SnakeKeylogger)", "value": "412fcb5704883da65b48b2e1d08be89a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257167, "uuid": "35e2988e-e86e-4d37-8b91-f5503d9696a6", "comment": "Malware payload (SnakeKeylogger)", "value": "544f26001452cb9ba77b6b24f2a0954c321fbf9ca2e17c1ac3d6fcab5a7e537a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257167, "uuid": "c5904165-0e7c-4aef-b68d-12b3799c2fc3", "comment": "Malware payload (SnakeKeylogger)", "value": "8b3a33677624ffaf5c614084c9a0e7134827218f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257167, "uuid": "c1033475-28b3-425e-b35f-0b626b280b88", "comment": "Malware payload (SnakeKeylogger)", "value": "51bef91e7bfc978ee86e1c5bafccdeffa2322abb99ade19a65208d988886cd284751f8717b082e1aa0eea3e64f82df97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257167, "uuid": "f0ecb97f-be9d-4622-9b11-5fda0eaffe6a", "value": "T13485E030F6BA5908D9B64B701D365BD0277ABE267A04C76D3649720D8D32A338B11BF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257167, "uuid": "732a9d07-adf9-4d3b-a39c-f66ac707f706", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257167, "uuid": "5b6996c3-8ccc-437e-8f8d-39b3c3d234f9", "value": "24576:YCmYzEYPykBp5dhGgtKGbUtH+gWJdIxeijw4fBiIlW0W0f7jV5BTHNRLJ:MYzLyAp3KGbmHPWTI5fBiIlW47jdn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257167, "uuid": "a45853ec-8f42-4fff-92e9-343608c1d83a", "value": 1821184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257167, "uuid": "478bc675-68c5-456d-bc9e-f86a6d044e20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257167, "uuid": "7f3a558b-7c62-4886-9503-690bd6994f46", "value": "Excel Quantity and Specifications .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24dc426b-b5e3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274772, "uuid": "4f61a059-927d-43ca-a899-208dedb21954", "comment": "Malware payload", "value": "17abc541757bdf3a01e297619668a200", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274772, "uuid": "ed055212-af17-4c34-a8e9-9b1c566eeda5", "comment": "Malware payload", "value": "546d1d4c361f1afb4894d4cc562777a3820c43a26308a3205d3a25dca182a9eb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274772, "uuid": "ea538a81-aef2-4b63-8927-12a0727dd310", "comment": "Malware payload", "value": "25d418844ce298ff9f41f82e49f0c0ee79e00e51", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274772, "uuid": "61b54a0a-fa81-497e-80f7-4367b7f9d277", "comment": "Malware payload", "value": "408715bd133795742b79fce469994f3f7b5f4a7e5c3d63eaa42bd2c73bed00dc5d5ff2d766e616d2c1e989a08892638a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274772, "uuid": "d4c0fdf4-0953-426b-9d1c-d0be0475459d", "value": "T164A1E750112C1AB17246697AD26FFB52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274772, "uuid": "ededdfc9-67f1-4862-83ac-cf4e228b9cee", "value": "96:DRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:DRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274772, "uuid": "98f46168-bf8d-42c3-a55e-fef2c88fe0d5", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274772, "uuid": "c4278cad-65ee-4171-af39-6485b9eee9ea", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274772, "uuid": "36bab0aa-cf43-4158-9d6f-7dab51b3ef07", "value": "546d1d4c361f1afb4894d4cc562777a3820c43a26308a3205d3a25dca182a9eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7abd22ef-b598-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649242704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649242704, "uuid": "0ae49ac3-7c28-4551-8460-13af13aadab7", "comment": "Malware payload (Formbook)", "value": "79d0e122154f127dcb8f1f65cd05446b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649242704, "uuid": "d719fedf-98be-4a67-bb6d-590f69e07d14", "comment": "Malware payload (Formbook)", "value": "54a9149399c6d09d4bd72fffda675491d14ccb913a100134af3697828f8ad111", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649242704, "uuid": "224483fe-c3b6-425c-b61f-7bff2be60c3f", "comment": "Malware payload (Formbook)", "value": "c0affb16bc2118f29f460949e6109800e5e1d47a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649242704, "uuid": "13c79af9-af10-4457-9bee-1ef4b8b3a773", "comment": "Malware payload (Formbook)", "value": "3210bf6d30d9e4392b180f2b9146acc2ed308b2aabbe1b63ac81b5802360ffcf71f2027ecf0f73345020e8f3c377f9b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649242704, "uuid": "49a33067-7fb5-4775-ada1-15feb1e1d995", "value": "T1DB15A49D722072EFC857D4729EA81DA8FB6174BB931B4207902716ADDE0D897CF244F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649242704, "uuid": "26fee214-b688-4979-aeb2-7fd05c36d153", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649242704, "uuid": "93880f36-b31a-4324-8b01-c38ada699d00", "value": "12288:W1qWx3ufk2/6hcemEqWGxEY2o1HdxBkoX/QwJ6jKRPNcUUSSXi5Qys7XKBbh7KSB:W13+M7cemEqWXY9CwP85aaCRBV76Peb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649242704, "uuid": "9a439330-d4e9-48a0-9978-0c1aaece38c2", "value": 932352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649242704, "uuid": "5f890183-d54b-49e8-ad88-df61d9bcc244", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649242704, "uuid": "871d77c5-c990-4466-969e-cecf8991eaf5", "value": "P21-0033 \u5927\u6c49\u56fd\u9645.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b477fe-b5e8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649276867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276867, "uuid": "6f1bcd3f-6501-4492-a1b8-d9d0ec5990a0", "comment": "Malware payload (Mirai)", "value": "dd1bfa9eac4be624468f20cc729560fa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276867, "uuid": "f1015eb9-9a62-4d10-81ec-562dc153522a", "comment": "Malware payload (Mirai)", "value": "553c00905fdf2e6c276a4aa8371100dd21ead12c5f0fc61b078ff7117ed9da07", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276867, "uuid": "ecbdbcc6-a725-4e97-a7d4-50abe6025c80", "comment": "Malware payload (Mirai)", "value": "964d6e2a21fcdba31dd6631a731b1c8c0cfd9dc7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276867, "uuid": "bf23edb1-4837-43a3-97ac-66f3077950c9", "comment": "Malware payload (Mirai)", "value": "c36bdd09ebfffd2b8fb96028935920cda0bb87e935abb9f8ab3483cc199b82a2ae215310f81e991d7cefbaa234ca9cec", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276867, "uuid": "0590e0d9-404d-4f5a-a947-efe4303b4236", "value": "T1CFD33C46FA408B13C5C61BB6FA9F414A3322DB54D3DB3306991C9FF43F86A5E4E26606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276867, "uuid": "7d1ac67d-f8a8-465b-900f-ebc0e79eef60", "value": "3072:VlvpxlZa14tuzbHJYYQwYkVGhuRa9EyxV4Vzv:VlvXk4+HJYYQNYGMa9EyxVCzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649276867, "uuid": "d966d3aa-90be-43b4-a31c-86f7d55dad76", "value": 139648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649276867, "uuid": "c29980d6-8fbc-4255-8869-bdca29b7b5ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276867, "uuid": "874b28cc-1d16-4657-aa6b-5646d8750f8d", "value": "arm6-20220406-2027", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5e3cb5-b56d-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649224154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224154, "uuid": "1a74cea8-9e59-4d64-83c8-3b5b3ae6c36c", "comment": "Malware payload (SnakeKeylogger)", "value": "4c690af44c95ba4653063458f96c0de9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224154, "uuid": "2a4393a1-2d8a-400c-9350-f343afa4a9a4", "comment": "Malware payload (SnakeKeylogger)", "value": "557388a8f638f4237c3db3317dd8c0033e042778735ab0109ed8471eb0045ecf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224154, "uuid": "4dd24ae3-9a72-4128-bcc5-f0a8f143c214", "comment": "Malware payload (SnakeKeylogger)", "value": "895d59624baf1095fee6898d5212edcdc5c05deb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224154, "uuid": "211b39ed-b676-495d-b266-0a8dedc06e20", "comment": "Malware payload (SnakeKeylogger)", "value": "0c7f69d8635d73e1b07711d0d0dfba6c561022287c28470990ac74eb0dd3d7b107989759688b09ae28e8f5717eebbe68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224154, "uuid": "4a3f0b36-c45a-405c-9420-d31ea598bd47", "value": "T109A4120032ACBB17D9FD9BF6A83A115147B1752B2671F7E88DD129E72E12F508902F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224154, "uuid": "77801b51-3e6c-4aef-b347-0103c8d67845", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224154, "uuid": "3bd93319-17fc-489e-bc38-ce9e4dd67b51", "value": "12288:lwFXdFT1i9x4H6VjLW0OcMJrnpJmgjJE6VNk/F:MDH6VLWcMd2gk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649224154, "uuid": "914a39d5-a8a6-40a5-a776-234079021973", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649224154, "uuid": "42eddf41-9a40-4d5f-9211-42954b58f9e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224154, "uuid": "33399fd5-3f67-4aa7-a305-8abb068fb78b", "value": "ORDER TKHA-A88160011B.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0364e569-b5e3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274716, "uuid": "137e83b2-b61f-483b-a764-69d8947bbcf0", "comment": "Malware payload", "value": "278255213fed2fb613d0c24989595d9e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274716, "uuid": "933dd337-a306-4d8f-b578-ea6f388728cb", "comment": "Malware payload", "value": "55866d91cce002a80b19d0cf049ca99b1c2d13218e2cc7c474ba7343e01b36dc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274716, "uuid": "c83b7cc9-ba83-42d3-a92d-f22f9712df7c", "comment": "Malware payload", "value": "c04c9e1a58e79154cf91cceac4fbeb735936f0f7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274716, "uuid": "44f29f67-d9e9-414c-86fe-d8ebfb21a327", "comment": "Malware payload", "value": "a2f473f380aca39f6ea2817dff60908a9c638da6811d2f84852cab892f82fcd66c858fd72f775ff2d639c67468147370", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274716, "uuid": "61b99af4-4b8e-4952-bbdb-b507218b69b6", "value": "T12B518CCB436223703CD1D97F77FD160A7AA0E8A591D9BA05E9F8BEE5D18CD052340647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274716, "uuid": "1bc0daea-fd6b-49b3-ad05-4dc6bc74918c", "value": "48:vF/g/q/lFnFSFraQGKvFkmRFAKFFnFSF7B+FGgrFsO93pFZnsFPt6FbheFPt9:vN82lmLvfFGCfLpU+iR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274716, "uuid": "f1265574-f63e-4432-aaf7-29befd636ea1", "value": 2656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274716, "uuid": "57cd2850-82f6-41c8-9303-d3ae3bdcfee6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274716, "uuid": "9ec3b25a-23e8-4b98-9a35-4e17e6c4c574", "value": "55866d91cce002a80b19d0cf049ca99b1c2d13218e2cc7c474ba7343e01b36dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eaa9b8f-b5e3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274815, "uuid": "2a711031-410c-42cb-b1de-b28610d14db6", "comment": "Malware payload", "value": "0deef573a13a56b0c5985edfa0652f93", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274815, "uuid": "1c0fe832-9560-40d6-94c0-0885bb4b4efb", "comment": "Malware payload", "value": "55e1cee88eee0910cdc35d3a57087127e0ff99e228e246eb8779f89b7e0a1d70", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274815, "uuid": "3b335069-75aa-422f-91dd-89e52da66cdb", "comment": "Malware payload", "value": "c37a436bdd001e3b9d5b433d3a8716263653917d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274815, "uuid": "1dddda27-9f1a-4cab-b437-cb50a0fea320", "comment": "Malware payload", "value": "126585c40b1bd78f337a6e58c92b816ea6ec343cfadaab8c5e1ba50c7ef4235741369e992d88147782a98ad96c120f69", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274815, "uuid": "1c8d59a3-bbce-48ce-a756-a445e5efdef1", "value": "T1553178D597232C487CD80DA4317FD88062CBEA8828D65F36F1EBB67084DD502BCA1F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274815, "uuid": "fb93f38a-5eb2-435e-b580-4965bbaa693e", "value": "24:ELCLblLXEDeDiXLfLmL7xLw3P4T4w4iJ5e5y8oi:TEDeDick1ig7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274815, "uuid": "809e1b84-06e6-439e-9757-a31972981905", "value": 1668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274815, "uuid": "aaebc0c4-d151-460a-8519-d0f952967dcb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274815, "uuid": "648ebbe4-8119-4c37-a6af-7d6e02f311fa", "value": "55e1cee88eee0910cdc35d3a57087127e0ff99e228e246eb8779f89b7e0a1d70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b392708-b5e3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649274809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274809, "uuid": "e242bdf1-719e-4247-97a5-b5a9a84f5c56", "comment": "Malware payload", "value": "e61246ab5e92d31c48c4da8f9c548c88", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274809, "uuid": "d378a9fb-9ae2-4835-9bf8-6fa77e55f38f", "comment": "Malware payload", "value": "57d2e9251bc1b86818a75c021090e0ee783032fc2b858060987c9f7c2f3e05e5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274809, "uuid": "9e4882b2-045a-417d-8442-147dc578e660", "comment": "Malware payload", "value": "e15db1341445ac121e0643a5896c8f6df43162bf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274809, "uuid": "e27eed2f-0564-4263-a7d4-62fcdc768509", "comment": "Malware payload", "value": "8d499c53f5fa678a33960e034ed0ed647c684f054d11342c79827d83751259c7dbe362439c4453e55d43951f1c827dec", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274809, "uuid": "ac0244e8-fe6b-4512-9c8a-472d07e3fed0", "value": "T1393170D135B129383DF364B763650820F1D060342CA46DC9E4DCB0B8AAEEE8276845FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274809, "uuid": "177f7735-1c0e-425d-94e1-77f9b2226ceb", "value": "48:/eNhSeNh1BeNhueNhZiVZ0ieNhZHe8eNhZspLeNhZBAeeNh3eNhmeNhOu:mjavPn41einau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274809, "uuid": "bb9a0b3c-dc8f-4c91-a3d6-2dd405957f45", "value": 1840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274809, "uuid": "7449b018-9c97-4f24-bd8e-b38577db65c8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274809, "uuid": "86cafd28-1a8c-426f-9f59-d74f27f95342", "value": "57d2e9251bc1b86818a75c021090e0ee783032fc2b858060987c9f7c2f3e05e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe513153-b5ce-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649266117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649266117, "uuid": "2f88112e-b4db-4a53-91a2-771649d0e7f1", "comment": "Malware payload (SnakeKeylogger)", "value": "5cebb01c77c88f49771883f4bad93b18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649266117, "uuid": "27446fe1-1d83-429a-b115-e8938cbc23ab", "comment": "Malware payload (SnakeKeylogger)", "value": "580623b3323c1781f3a81411ead6dc05148c612c6acfbcf339710acda2672d61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649266117, "uuid": "2df2ab8f-d6dc-4e5b-9142-83af118cb65d", "comment": "Malware payload (SnakeKeylogger)", "value": "69d2ff83f2195b09eefddf80547e8898dfe9810c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649266117, "uuid": "668399c8-c53c-4c91-a40e-28f8cf560e87", "comment": "Malware payload (SnakeKeylogger)", "value": "de30a839aebf6cca8fc3326b45297d1e555e07103fb724ecbe284129afd0e9b1271826a8a85ed8f886d2e1b6a4a6fe37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649266117, "uuid": "7f756303-b670-46e6-9a94-144d9b6ac622", "value": "T1B345B1A9B2E072DED467C93189681C65FA607CBB931B8147A01335AD9E3D983CF543E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649266117, "uuid": "aa33bc90-a9e5-4169-8fdb-b902daa135c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649266117, "uuid": "ce45a40b-2ea9-4731-a05c-126a61ab77b5", "value": "12288:hoKjkeHuVs+6C5fD4g4TO9md+Wm3xIsNfIsbeMhjl/5hHpdxhA05OhCOB3A0RMVY:hJOCggO9mhZuP3yd2OluON4fA9uC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649266117, "uuid": "c874797a-c9c6-4ec6-a2c2-192496985316", "value": 1168384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649266117, "uuid": "e16a21ce-7c3a-4e47-92e7-420ef9b43975", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649266117, "uuid": "0e09c7eb-8751-4b11-a0ca-f447b7e02a58", "value": "FRQ20220500002 ORDER - XLS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75e60277-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277914, "uuid": "54efa67f-2a54-415e-b3b9-4cb84fc40934", "comment": "Malware payload", "value": "98a0a0122a6bdcd348c1a4b62c8826e1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277914, "uuid": "4f552470-afc7-4cee-b88f-45c610693466", "comment": "Malware payload", "value": "58a66515ec47b85afa8b0df0c0a4dbf521c6f49ba1c5aaf6ec1e7b1a457a8dac", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277914, "uuid": "e1839dd4-746f-44e0-913e-750371e59851", "comment": "Malware payload", "value": "ef4abac605215e0cb4959858c259831b681327db", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277914, "uuid": "36bb685e-ee24-4231-8340-da9fc1986f59", "comment": "Malware payload", "value": "e9ff38187a8a5f21eca6ee66df21053223f0f433d2d0099f2af2d3ba28c0406e116a0d44e759237f0b5d5e963f1b6b24", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277914, "uuid": "d17e072a-1fdc-4e51-91db-0fb25d70c1c0", "value": "T1E5A1E850112C1AB17246597AD26FFA52B50ECC1B097B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277914, "uuid": "0ecc298e-a177-4884-9b5a-9530cf2061c3", "value": "96:0LRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:IRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277914, "uuid": "fc1a3563-460c-4d93-8c68-a522a2ee12a9", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277914, "uuid": "66a1276c-5a9b-4810-9f08-48ae90390ddf", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277914, "uuid": "fe7f845a-d199-4ea7-b3f0-6ec0dca975d5", "value": "58a66515ec47b85afa8b0df0c0a4dbf521c6f49ba1c5aaf6ec1e7b1a457a8dac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76657c54-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277915, "uuid": "f3359e26-c186-48dc-9541-80985da74fdb", "comment": "Malware payload", "value": "c78e38db957e3cf790219105cb3b28f9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277915, "uuid": "d045acbd-eedb-438c-83b4-1fd35affeb19", "comment": "Malware payload", "value": "58c0122ae61983bd92572ae850414f33f091fb9585d88b8710833962085d145a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277915, "uuid": "288d4989-d55d-41cc-9e5f-04b9f35cfa57", "comment": "Malware payload", "value": "778a20e35f4b9f0965f15c7b59969e33795ec5ea", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277915, "uuid": "0aeff2c4-f9c6-47f3-ba56-32bb822905b7", "comment": "Malware payload", "value": "58e067032c4a084e16099cb0e4091f9d4552b039298929fb86ed4f86364c33375a2e661884fb92847418a8d79d3df75a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277915, "uuid": "e69d0f16-2661-4506-99ef-5e835204f04f", "value": "T1B7A1E850112C1AB17246697AD26FFA52B50EC81B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277915, "uuid": "969d8554-b323-435e-950a-8e5fd0715445", "value": "96:VRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:VRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277915, "uuid": "9cc36f23-796d-45b5-ace1-a109d488fe73", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277915, "uuid": "82c10fe2-f617-4e91-90bd-40cb5d8a75d3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277915, "uuid": "b91f71d3-2006-4b8c-aabf-dc218f305500", "value": "58c0122ae61983bd92572ae850414f33f091fb9585d88b8710833962085d145a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c7ddd3-b5c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649262162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262162, "uuid": "3fe756ff-3e29-4144-b346-47f694be32a4", "comment": "Malware payload (SnakeKeylogger)", "value": "c65ffc6ad6b5bd21bca75d5603ddb1cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262162, "uuid": "f59fb3cd-99bd-4300-a63e-d6a00ba041b0", "comment": "Malware payload (SnakeKeylogger)", "value": "5a3975117c4497c2d5d583505d50f40dcdbe8b74e0f5c0f2fced0475aedf6666", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262162, "uuid": "4873d473-f137-41df-8357-3a54b8ebc48a", "comment": "Malware payload (SnakeKeylogger)", "value": "fe3595b7d298afb82e71b62ee495df5edf2c39b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262162, "uuid": "f313d994-24ff-4b38-b4f1-a6dae44ab45e", "comment": "Malware payload (SnakeKeylogger)", "value": "31e61732ab0f058e481a07283745899f34d1953c0c48101f02dbb80ed025ee1456c8a177d11e0ed2e4ad4d7963ff28c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262162, "uuid": "cf388de2-ba96-4e7d-9478-84199e9554cd", "value": "T17FA40214B75BDA22C99D97B3A0D2260507B0DB12F163DB8E2BDD26AF47163D20942FC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262162, "uuid": "bffdd211-45c6-4911-b2bd-bba1f36bd254", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262162, "uuid": "b0d7decc-70a3-4077-bfbd-e881cd2b9ebf", "value": "12288:H19rcXGPOCLuqQT1wzd46y3ZabnPnDxF:V9rcXWOCLyT1w54n6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262162, "uuid": "2efc136b-60b1-4973-90b3-bc33f1506ce4", "value": 475648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262162, "uuid": "19bb9d91-24dd-4847-9e0c-04419c7d651f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262162, "uuid": "c1611d60-9ced-4307-9401-2786d6856477", "value": "Halkbank_Ekstre_20220327_073712_983787.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cabd0de-b585-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649234520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234520, "uuid": "0fba3c3b-0d15-4bfe-8371-154e340db232", "comment": "Malware payload", "value": "899d0f8ffa9f23b75cab00ae2446de84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234520, "uuid": "a2457ff3-60cc-4a7e-b99b-987f1c82c537", "comment": "Malware payload", "value": "5a8eb933d063b43e310040918126c0387c459130e849702b5b75f2a6b7eeede8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234520, "uuid": "9a8f4863-fbee-4ca6-9bfb-b53adc083de5", "comment": "Malware payload", "value": "9cc4bab3fc1cf6b16f367f4fd584a6b26e0086f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234520, "uuid": "87414f63-2ebf-4146-a144-67c6f5588138", "comment": "Malware payload", "value": "f91dd61644f67bb16d3f5809da284e0b1ea637b3cfc1370639717bbc210a753159256dcf7f01f58740d6e1c176f820d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234520, "uuid": "022c03b0-7e0b-4af6-a1a8-3a839cb4ee5f", "value": "T103A48C3F82ECDED5E08E00720203C8811529582D0B118246CDE4203F78615FC2E89206", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234520, "uuid": "fe334d92-218b-44ed-a6a3-564d05bc8f65", "value": "3:WlWUqt/vllEYZcFTS9gXeF+X32Zp/WXYFaD3MILrP6e1rYWzw19pqX:idqGVg3F+X32PFI8IHCe1rY0wU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649234520, "uuid": "40d967ee-c9ca-4ad9-b0d0-346d5c73c079", "value": 460875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649234520, "uuid": "cc6299eb-3b8f-4a98-96d0-d040a1872349", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234520, "uuid": "386749f5-d34e-4a71-8198-9021cab154f7", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf069ea9-b5ae-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1649252294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252294, "uuid": "6cf1a745-3f5a-4c4e-a949-9019202a790f", "comment": "Malware payload (AveMariaRAT)", "value": "20ee6aada898b702a9aca559c38a726c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252294, "uuid": "c491f483-a119-4d8b-adcf-d4310205c2db", "comment": "Malware payload (AveMariaRAT)", "value": "5abdcd716331161644b54888f1cbf23a8cdb1902e5fe379077c15857268bbbc4", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252294, "uuid": "5f8968c9-1064-4450-81cb-ee8e790da1c9", "comment": "Malware payload (AveMariaRAT)", "value": "f693c2e79eb5aa5e1610772da1bab4604062c5c4", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252294, "uuid": "fbc731eb-018c-46b6-bc33-f491f2e6ac85", "comment": "Malware payload (AveMariaRAT)", "value": "21fa903671906b495dad50244939fc34c34eac76bbb50948cd92936c2529343d7e2ecd2eaa2618925da2e33073912548", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252294, "uuid": "8945388e-03e1-47ee-acf8-16c6c3b45da8", "value": "T1899423FE2BE78E71F9AE04F508609341173571173B01F2AE8E9839699A6378551F8FC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252294, "uuid": "231d1a1d-dcac-4991-9767-1bf33fab5ad7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252294, "uuid": "654e2937-a08d-406e-95b1-fac30a247177", "value": "6144:3v00kRpQcLXMacDSZU17Pcdj8QP0qclx71JwoLTO9zRZwdy2m0Y5vXmn5pTh8NDu:3c02Wcz0DkUFcJ8N5T0t2m0YFEcNDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649252294, "uuid": "58def578-e43c-4984-bec8-74841f83a8c8", "value": 448512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649252294, "uuid": "5f476da3-bf1f-4a81-bc76-4e381ba5aa2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252294, "uuid": "04f95a34-b728-4a27-9053-8f9822998925", "value": "DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77648944-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277917, "uuid": "13930d47-83cb-48de-b321-99cfbad35f8d", "comment": "Malware payload", "value": "c12d211d1312d9c770c6e9e5649f0740", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277917, "uuid": "768c662b-09ac-46c7-8f38-078be7fe7ffe", "comment": "Malware payload", "value": "5b0658dd97495912d07b9c055301b814e52ba7afe0011847b9b30575e09f23e6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277917, "uuid": "d48ef338-bcdb-4c6d-b32d-a0956b4b3431", "comment": "Malware payload", "value": "8b3c9f56def7390911c53f6d8194c3e473952108", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277917, "uuid": "a2c29866-733a-42fb-b300-46d460cf78e8", "comment": "Malware payload", "value": "501910004e01da8f18ffe6c2c0f31e06207ca9fc55546e938302147b12f4d2e40c6de441e27751433e43bfe75a1da9c3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277917, "uuid": "5426c4a0-a6d0-45e2-a2bd-40b0f8a5fb84", "value": "T12F4162C476B132703CBB98EB6B661C1932C164557DE4BD45E8E8BCF889CEE5132841EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277917, "uuid": "280483c2-0c00-4b78-bc9d-43e42f095a6a", "value": "24:IjTbHTwTXSKJTOWTOpDaTOLTgeeTtTMkxnT4jTW7TyTWC:WKMRphQxo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277917, "uuid": "0d43f651-2da4-4678-8691-c55beba7d0ee", "value": 2056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277917, "uuid": "4e9def0b-5c80-432b-a750-7aae8fb26b75", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277917, "uuid": "e70c9d1b-9e1c-459a-90a0-fc161f2aa28e", "value": "5b0658dd97495912d07b9c055301b814e52ba7afe0011847b9b30575e09f23e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43974a25-b5a2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1649246906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246906, "uuid": "b9f4afca-1547-48cd-ad8a-9a224b99bee8", "comment": "Malware payload (Stop)", "value": "6e82c31c496989497b1d6451b2c0a77a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246906, "uuid": "674bc67d-3491-4fd3-a118-71e2c5d4607e", "comment": "Malware payload (Stop)", "value": "5bfb7408eced7cf5790acefb708fc0be56d126e81364992347fd005f12542372", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246906, "uuid": "6be2a756-a3a9-4b66-a9fe-0b97f09967cd", "comment": "Malware payload (Stop)", "value": "26fed09e3d6f82a5ab29c2ffc27791d543991261", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246906, "uuid": "ab55718d-09a5-4bcf-8083-bacd5a53fb11", "comment": "Malware payload (Stop)", "value": "28a5630a40b015138d68ffc3fceac492173a53a6a560e2d21d9e1bb4301642e078c4eb4fbee08eb57475bc9c37d95ab4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246906, "uuid": "71936a9a-9460-4023-8af8-06034dab031f", "value": "T12C0512D876528472CF912D32A42A8BE46EBB3839CB349676F738732FDD646C07562341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246906, "uuid": "4b5ae36d-04d8-4af4-bfa7-05cce1fe6815", "value": "c573cb6c93cba3d870a0445c3d1cb654", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246906, "uuid": "779793c7-b4a1-4000-8859-2e8a742e17a7", "value": "12288:xLhSswk2ZwWkC0E5F9BBOUAGyntK0wJk5R/8s/6FV68dX9R52hLrVqSQTBRQ79:xLekCw3MnOUAGynbf8s6V6SMeSua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246906, "uuid": "c30d0e85-984d-4f90-aafe-0dccefd14aef", "value": 845824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246906, "uuid": "a81793ec-9766-404a-bafc-7758ccb2bd4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246906, "uuid": "7594499b-fddf-4248-a640-2f26d2f0033c", "value": "5bfb7408eced7cf5790acefb708fc0be56d126e81364992347fd005f12542372", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dddf5554-b568-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649222254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222254, "uuid": "dea2b13b-2c65-45ef-be38-3e365a4a7072", "comment": "Malware payload (Heodo)", "value": "a252c7551254603a4ca3e0e537d689ae", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222254, "uuid": "3026b077-7732-4d47-8909-9339c4b22ece", "comment": "Malware payload (Heodo)", "value": "5c0ef04bdfe067f4e13706683fb84c55ed99c7855480407e6dce0ed391752c9a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222254, "uuid": "e7842412-4945-4fa2-bff4-1dce36f91686", "comment": "Malware payload (Heodo)", "value": "b74298787866a44b266393b2d96707be3619f971", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222254, "uuid": "223a360e-fa74-45bc-b95c-5e1d2294a807", "comment": "Malware payload (Heodo)", "value": "f23d6c9d3f843501784af1d5edf79604bbb1031e59e400864e33cc3a1feef824f561583ca41a6b5d36c0d6a71e1436df", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222254, "uuid": "d36d132a-ed3d-4793-88bf-98008c732bc5", "value": "T131B43A317492B279C2EBD73408A35275B21AEDF157E274E36EE707CC4B366906E72602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222254, "uuid": "bcbb7059-badd-4d91-b8a2-32eab13abb21", "value": "55cf9ae1e74cef637eafd17181390202", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222254, "uuid": "b697f58a-d050-43c1-a7e7-24a36688480b", "value": "12288:7FFCpYDLbBHqKK85H3j72VlMD4zeSvturG9+:7VDLbQK0VlMDOtv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649222254, "uuid": "6963a6d8-d1aa-4dd5-b2cc-0569104070d7", "value": 516096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649222254, "uuid": "9e9ce35d-837c-44a2-b8bf-e0f7b867bc35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222254, "uuid": "0edaaa04-1050-4184-b1e8-1dbeaaf8fc2c", "value": "low.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0d475b8-b5b9-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649257048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257048, "uuid": "e5730a01-8363-4466-bd0b-5ff8012dbf2e", "comment": "Malware payload (SnakeKeylogger)", "value": "28838b6ed62c5e9930b49d3e9c9f489e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257048, "uuid": "2bccb8f9-83c5-4439-a418-20ed66b41611", "comment": "Malware payload (SnakeKeylogger)", "value": "5c44b24b9b70c5d4a48d65fe7e93cdb54b54d350017298bdd58c30bf80ea0d2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257048, "uuid": "a232ba1a-4d74-43b3-8b65-979f4c1a8085", "comment": "Malware payload (SnakeKeylogger)", "value": "b1849aa7634b7e51668cf6ea100d03552deb60f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257048, "uuid": "f8214ffe-8b00-4399-a8f8-91eeb1a194f1", "comment": "Malware payload (SnakeKeylogger)", "value": "9f805becfcd17a07add8e1188e0dae1418de6476c21d38ed41b9fd019a192077917bd108a5a45f1136f15fe2f43967e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257048, "uuid": "12268914-8710-4516-923a-47aaf2f5b1ab", "value": "T1D4C4455F299A520EB651AD255FBCF132C55EFAF1183A4CB70DB70C5A1016AF08B6CB23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257048, "uuid": "9fe81698-78bd-4bb8-ba42-4f0495147c7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257048, "uuid": "d4ee24c2-20f1-41b5-966f-3c8a77d631c6", "value": "6144:XD2tMPU/OXUZeoMPRr5RtEDu3bDpYAL4iiEg/iFF0qXqP4/VSJDG:XD2Ceq6AtSJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257048, "uuid": "9c3ce49a-1433-417f-91f6-32a53eae4bdd", "value": 580144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257048, "uuid": "5b162b93-9b17-4189-803e-e3d6f5827307", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257048, "uuid": "aa046dee-6008-4c51-90b5-5f4826c74864", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "078e45c7-b5c7-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649262697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262697, "uuid": "8d92d92a-bb58-4d4f-ac46-906233c3637a", "comment": "Malware payload (AgentTesla)", "value": "817809f349ff66615d378ec5fe728263", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262697, "uuid": "f0e15846-73e8-425f-b65f-aca15a1fcc0f", "comment": "Malware payload (AgentTesla)", "value": "5d0711a352b67326bb5f7f51541ae9218a57a1187978c703a2efa3fdd42bd112", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262697, "uuid": "a16345ca-131a-400d-9251-7491fb2b0ea5", "comment": "Malware payload (AgentTesla)", "value": "722374487c52611dee79d1154459c346028f3a08", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262697, "uuid": "7dbc5b60-fe45-448d-9060-ba9f958be867", "comment": "Malware payload (AgentTesla)", "value": "8c3c7b55f8442fba382969efd62a71601bfde0d6dfc5b80e33d0de9205a461d30b2ee2f2fd308df2bd4ae373555f42e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262697, "uuid": "d01f0dbb-e0f3-471f-8cc4-625eb72e0678", "value": "T15CC4026DA76FCE26C16D5BB344E3140403B04757B19ADBCB2FDA15EE164238A5882FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262697, "uuid": "b7000617-adf7-4f43-8b12-91c4830c75f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262697, "uuid": "cbc9e4bf-b3ab-4c50-81c5-3795615fc7c4", "value": "12288:X4/3oPRY0oVmLy2AEnY1/z49n8BAvceF3sj5/0l8XW6DhDF:a3oPS9MyZM98BkFU5/0n6dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262697, "uuid": "4833943a-1ee6-43ce-9bf6-e36b2a546ece", "value": 546816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262697, "uuid": "38056d6d-5f59-4c98-a1b6-e894cee55a6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262697, "uuid": "c1ea1018-e947-498e-9f8c-47fe9e54ed0e", "value": "817809f349ff66615d378ec5fe728263.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "795753b2-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277920, "uuid": "7c50b925-6de6-4752-898b-788606a3eff1", "comment": "Malware payload", "value": "075fafcb172726bc1e2e47c63403b3fb", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277920, "uuid": "d23311ac-88c0-4485-8beb-83bf8290c012", "comment": "Malware payload", "value": "5dd7eb2d34213f640abaa899d5e7570b382b66d377e4f86c1bf5d7a38dea9fbf", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277920, "uuid": "12919a91-d3b4-4993-a7c1-da497e8f12b0", "comment": "Malware payload", "value": "a96bd5548af81bb007d0fbc99ed3a0a050458d02", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277920, "uuid": "bf80fd39-1da4-4edc-8627-2495184bcfca", "comment": "Malware payload", "value": "d97a3cf2d7e7fc2c61f1b38496b89412d979a2e437db50fc21d6afab60ec61107cb4db18f4bc077fe18aac86553f0cb3", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277920, "uuid": "ffa52279-11dc-4b29-a158-a8b8e62909f3", "value": "T1BFC5330C13BBBCFDF98E052927638DA5C1BD91E0B58260A2D76408A85C3F57E13CF962", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277920, "uuid": "6bb5f230-a2f1-491c-8502-44b2d62ef93e", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprcM58YdL4R:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277920, "uuid": "e7a08b84-2981-478a-9c7e-7747f2c98b70", "value": 2727936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277920, "uuid": "b5161253-3b90-4821-9caa-93b250affcd0", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277920, "uuid": "750ee3e9-6e4f-48b1-83d9-ed1f0e533656", "value": "5dd7eb2d34213f640abaa899d5e7570b382b66d377e4f86c1bf5d7a38dea9fbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d4648e-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277921, "uuid": "24e77cad-6772-4c58-ab98-028c4606bf74", "comment": "Malware payload", "value": "ef701d427a76b92d392aa473f47231a7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277921, "uuid": "bede6f56-424f-427b-9b71-ba73d8729b3e", "comment": "Malware payload", "value": "5de1a046da85e7e415b5cd28e5b06704d88f827a0edb57d78ce39695d8901e47", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277921, "uuid": "751fa4c4-5ac7-4a7d-b918-c59f3b0bb94f", "comment": "Malware payload", "value": "7bc1ce7e633a1d11054cc006bf174d52b02d5464", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277921, "uuid": "ba2c1e31-8c1d-4f94-a2db-1d02189e009b", "comment": "Malware payload", "value": "9178850752a269ceb6c5aa53b168c41327368127d6342286857393e91373712775e805ded6971c7ff3091e811fa74cea", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277921, "uuid": "c831fd9b-5d92-45af-9288-262bb71f6956", "value": "T1E5A1F750112C1AB17346697AD26FFA52B80EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277921, "uuid": "56dd4890-d028-4ff2-a19d-38f268e90eaa", "value": "96:HRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:HRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277921, "uuid": "7f2abb3e-c27b-4f86-9c0a-56bf3a99d887", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277921, "uuid": "79bd148d-9a23-4576-8b81-fd834aefe21f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277921, "uuid": "80d62258-29c3-4eaf-835b-16a01f864aa3", "value": "5de1a046da85e7e415b5cd28e5b06704d88f827a0edb57d78ce39695d8901e47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc5e78a-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277924, "uuid": "850895a1-1572-4f57-ad47-060029937ddd", "comment": "Malware payload", "value": "22ebad506f69027b7815e4c3e641716c", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277924, "uuid": "8640eb9e-5bd6-4e9a-9ba1-d585f5954d6d", "comment": "Malware payload", "value": "5e0104b5bfbf99111d9933530b89af9e10ea0a06406000fcac238c2ed3213cd4", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277924, "uuid": "45dd4ef8-969d-44a0-8f59-1d642e69032f", "comment": "Malware payload", "value": "62b9e49971320bf83c4fe6da3cca01e021841c5d", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277924, "uuid": "971a4b8c-26a4-4427-9427-22515ba5e7ee", "comment": "Malware payload", "value": "88b7eaac4767f8a06a11c8d674dfd385709d46a83ec2b3a1f3ed3e05665b4ca459ec9b8c1226e1bfaa762350da6cafd1", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277924, "uuid": "f5999cc4-f0b2-4a59-aee5-c18c783ea4d7", "value": "T1433633082265F8FDED460E293B7349F0C1A016E1594159E1CBBE6108497EAFF1BEE673", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277924, "uuid": "864a5943-3cc4-42ae-b779-1e068850caaa", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKSAFE225K/g+7+Q:0XSxVJG2fLAqFOfT9sMYNM29SAFN25K1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277924, "uuid": "18ee963a-f694-4220-a775-c762dee920fd", "value": 4968448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277924, "uuid": "407870e7-2409-4ad4-8067-1d05ac7bc421", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277924, "uuid": "051592d0-da69-42a5-b8c3-266a3aea02bb", "value": "5e0104b5bfbf99111d9933530b89af9e10ea0a06406000fcac238c2ed3213cd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790b6bc9-b5cb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649264605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649264605, "uuid": "c77ff71b-a001-46fd-af8f-2ca21e8350ef", "comment": "Malware payload", "value": "68d375c0d761ee856d4d76193a804ca4", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649264605, "uuid": "2ef5bed5-0134-434f-9922-7c90fac8a812", "comment": "Malware payload", "value": "5e2367c794d63afa3ca19321a703d3b1cc974bf8bfdbc26bf01b1b741a189de1", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649264605, "uuid": "19a9fde1-084d-4a76-a49f-3f5ffc852e53", "comment": "Malware payload", "value": "abdd392e513e7e5b51fe4d507a1612512279fb88", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649264605, "uuid": "d5f2ba01-e640-45b7-ab58-cba216572058", "comment": "Malware payload", "value": "ea350b8f3801200ddea07dcf15a93d379abf447fd35953a056fd62f448945c0b055a3cfab04ca57ff8a49144e4f388e0", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649264605, "uuid": "d1862105-d6f1-4e81-920f-75bf44f1b8a4", "value": "T1F816238BF586CB3FC1EB8B71656BD33680BAE138019355676364B40D7DE2280A3D71E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649264605, "uuid": "248b6c0c-bb3c-48b2-9a09-c80399d0df27", "value": "98304:JAY5AxIFrBvf/jMkQ0WWCowEUKIFrBvf/jMkQ0WWCowEUFIFrBvf/jMkQ0WWCowH:JbFrBv/QbWCoyFrBv/QbWCohFrBv/Qbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649264605, "uuid": "5196d7b5-e85a-49e5-a52d-6a28d335a12d", "value": 4063232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649264605, "uuid": "8eb003fc-345c-4e5d-8858-ff9a383765aa", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649264605, "uuid": "5f53d8da-31f6-441e-a0ef-4d594f5452ee", "value": "P971fL2tkpuftg pozcqu.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b6b488e-b581-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1649232799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649232799, "uuid": "ef485170-4392-4c68-ac24-3911372debe4", "comment": "Malware payload (GuLoader)", "value": "ffa2068e1f088ba44ec9a26ad00683be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649232799, "uuid": "d1c81742-b3d7-460a-8559-3ce80f1468cb", "comment": "Malware payload (GuLoader)", "value": "5e6cd024393c26aa7fd953df500ff4324a7c3c5ab8b9280f3b5a34a0629cd57c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649232799, "uuid": "32b3c32b-1638-4d21-8a9b-a86f14c9e99d", "comment": "Malware payload (GuLoader)", "value": "3d682f41b95d42c448d8fba57d5e58be14e697ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649232799, "uuid": "8a556a6e-3c5a-4c43-9b4a-94619d138f33", "comment": "Malware payload (GuLoader)", "value": "9bfc43ddc0cb2e52132284df25a6f63cc5097f30279b81e89de0e23516fdd684778911fb16f4707d149d04cc8316bab4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649232799, "uuid": "f9cfb0c1-ac4d-49e0-b880-33b508233be4", "value": "T1E1C4F1B1F6A998DAEC12237548BBEC3325577E6DA874151E211A33297D733D3006BA0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649232799, "uuid": "b43429c8-fd38-4355-87f0-351bd2933b35", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649232799, "uuid": "9c8e723b-71b1-42fd-b4b1-b1b6b2af71cd", "value": "12288:pYzbtWpoOVcEQPp+ELZL9V6LPTK7LMvBQWUAh5:pYICOKEQPp+IiPSLqGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649232799, "uuid": "96ad9dee-1140-4a30-a06d-393a2cde01a6", "value": 555360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649232799, "uuid": "89aa569c-f2c5-4bb8-a16a-bdce8fd65ec1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649232799, "uuid": "f2b8bb0b-d2a6-47f4-b7fb-d2887ff8648d", "value": "859461Dokumente.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1734d0e7-b586-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649234806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234806, "uuid": "5b80b705-ba68-4e9d-a4e4-9f95818aadcd", "comment": "Malware payload", "value": "aa18fe71e47f9aa177cb656b37ce2fe4", "object_relation": "md5", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234806, "uuid": "83fd6a29-c796-4ecb-b7f7-34a7aa6c52b2", "comment": "Malware payload", "value": "5e99dd7af985221c8ab3eb49a52a115699fc93dfc596f5f84c0e969f23900073", "object_relation": "sha256", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234806, "uuid": "48804bf5-f6dc-4e1e-bb22-64d2ee78545e", "comment": "Malware payload", "value": "730f5030062cf1eca8e42574452540e66998e034", "object_relation": "sha1", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234806, "uuid": "4d0e142d-d748-4263-8049-b5e5515c3341", "comment": "Malware payload", "value": "9783feafb2d1e4710c69f1307838c3f932e050a067f03f5302a0fdf710e94122db08c715622b47f606f768f58565bd42", "object_relation": "sha3-384", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234806, "uuid": "ca9bd496-9e8b-4f47-8006-be0ab6a26b3b", "value": "T1CC4413653B5F2C60838156611B2FE3B0180F6294AFB19567242FD18C6EBD0FFCAA017E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234806, "uuid": "20282429-cf22-4ef7-9d77-36af79fe3ff2", "value": "6144:wp7hB51uXK+H7BTrY6G7IMCVoglS5XbrsVI0eclf2X63:wjnd+HBG7IMCqgl+L4a5clCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649234806, "uuid": "64849b71-7b88-4690-9716-fcdf52e67678", "value": 254080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649234806, "uuid": "545cf363-43a1-42c5-a019-dc10b1a269e9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234806, "uuid": "9df8652b-c1d6-4289-96c7-058cae2dfdb0", "value": "c18ca3a8-0e98-4f55-482d-720df9b35e44.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd3684a-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277927, "uuid": "dd9b6717-378c-420a-92aa-0e4398bb7e2d", "comment": "Malware payload", "value": "452784892f0806044019d8c4fbb1d78f", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277927, "uuid": "61166bff-7cb9-4dc7-a29a-fe65e0d07181", "comment": "Malware payload", "value": "5ec26b3cb1a005b6ef78a15579b096727720ec6ad80092f507dbe620f7699a23", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277927, "uuid": "7b4acf14-5974-4c92-b672-63922d1882ec", "comment": "Malware payload", "value": "ee7c9440ca2bee9eb12c7f032b3043106d325baa", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277927, "uuid": "7831e876-31b7-49f2-9995-fe3d5fa106d2", "comment": "Malware payload", "value": "57925067e0f4f82a7889873ec3eaa7c58f4002f9b42dccb3e1178fe1b3639654fcd4b10295b6b05b35ce39524c756829", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277927, "uuid": "ce9fb14e-481b-4841-9a83-c93ea602e48c", "value": "T1363633082225F8FEEC560E296B634EE1C0F416F0194155E29EBD6008197EAFF5BDE973", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277927, "uuid": "ff9f9198-5fa5-4851-b058-17fae1744940", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKSAFE225K/g+7+E:0XSxVJG2fLAqFOfT9sMYNM29SAFN25KZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277927, "uuid": "8175367e-f198-4731-9982-95afd5cc4a47", "value": 5165056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277927, "uuid": "159585e7-dd93-4f1b-be6d-e486f4ac40ee", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277927, "uuid": "008a76cf-9cd9-482b-a09f-7fa736c98aa5", "value": "5ec26b3cb1a005b6ef78a15579b096727720ec6ad80092f507dbe620f7699a23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e710cca-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277928, "uuid": "054bf5ea-3429-4fe6-8bbf-54b9b1d4f600", "comment": "Malware payload", "value": "0d52e1eda9721e57943978db544c4464", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277928, "uuid": "3ac47bd1-f464-4b4d-a5d4-50334aefa0dc", "comment": "Malware payload", "value": "5f227b32570517fb68530aaa6d4ec1475733d776a9e1356cee3b67f5553f5d5b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277928, "uuid": "07dbe3ac-eb83-46e2-af40-15a94fe7e683", "comment": "Malware payload", "value": "8500c7da4f8480a252a69a7d51ceede2999cffbb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277928, "uuid": "bc2971d8-ef25-40e6-a95b-1ed071a11b3b", "comment": "Malware payload", "value": "99f61f871fde94fe0d82b3b7aed36f2fe489e7d9ad6a7bd2c9c47670c0e3b4b7256b76136364d807bd6361b68b73b362", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277928, "uuid": "bdeccc49-201a-48d5-bbc0-296316dc42ca", "value": "T1A651BBC7136223703CD1D97F76FE060A36A0E8A5A5D9BA04E9F8BEE5C18CD05234564B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277928, "uuid": "cafce434-2c19-4f42-96b0-5c57b091ee11", "value": "48:vk5/RdF/g/q/lFnFSFraQGKvFkmRFAKFFnFSF7B+FGgrFsO93pFZnsFPt6FbheFH:v6dN82lmLvfFGCfLpU+iZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277928, "uuid": "bd9fbbaa-f794-4a5c-8209-ee17841c5f58", "value": 2919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277928, "uuid": "f66d8a7e-9521-4485-ba5e-aa5bbcd4f43c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277928, "uuid": "bd974343-f304-479a-a288-6be474ae6636", "value": "5f227b32570517fb68530aaa6d4ec1475733d776a9e1356cee3b67f5553f5d5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ee8b62b-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277929, "uuid": "9e5afeb9-a706-4f14-890c-9a000ab96a4a", "comment": "Malware payload", "value": "98d73901a9394d86498f350add57a0cd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277929, "uuid": "d6f02cc1-c190-49c8-82d4-6742ad9739b7", "comment": "Malware payload", "value": "5f2f0e3a97c991d4d0e4959c73837d9dcfe1d1588cb289d12e702ba789ce04ab", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277929, "uuid": "3b47c902-31c3-46bb-8d1b-cedf88472486", "comment": "Malware payload", "value": "520e9984d566da198d28e5f50b9a6d4256258700", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277929, "uuid": "80e4ef53-c2a0-4370-ba11-944d009223ca", "comment": "Malware payload", "value": "821d0aa9664840d0237c637020e9d1c8e9be46210aa3becb600fb8aa291f977aa708a521c53733b12f74633a421c7b53", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277929, "uuid": "313721fa-a6ae-4660-9823-e7d77bd85744", "value": "T1B9A1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277929, "uuid": "68dd952f-8f32-4373-8d6a-38c38383701b", "value": "96:mRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:mRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277929, "uuid": "076136be-20ba-40a1-85c5-6694be43972d", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277929, "uuid": "42b45da6-9ffa-46bf-8bff-3cb0fc3386e1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277929, "uuid": "eba5c26b-731e-41d9-acf2-7bd8818b6ba4", "value": "5f2f0e3a97c991d4d0e4959c73837d9dcfe1d1588cb289d12e702ba789ce04ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a149f7ec-b5d3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649268109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649268109, "uuid": "534bf463-ff7f-436e-9bfb-4020adbe9264", "comment": "Malware payload (Formbook)", "value": "f8cdb860b45fd9fc1554454cf90114ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649268109, "uuid": "421f6628-9ac5-4c92-a54e-ab4ba0383a85", "comment": "Malware payload (Formbook)", "value": "5f52f8c0bea37caf9864c880433dee7f57b2fac7fa5fd709fb9310b4919eb14c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649268109, "uuid": "aaacf1b6-f767-4923-8241-d46a3c152383", "comment": "Malware payload (Formbook)", "value": "28a3a384dadc9d6909c3d33048944dddd2e50263", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649268109, "uuid": "6503642e-8e2f-442c-9760-99084f842408", "comment": "Malware payload (Formbook)", "value": "b84902e4635e2ec0452664737acb0a706b010a4babd36e8379cb52a5fa1d121ec8710d723e050a2c4bb1a2cb413cfdff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649268109, "uuid": "158d22a7-8291-4974-814f-17234ef5aef2", "value": "T11834122677D9C543D2B417320E37B29677AEA13960748B2F03D05B8972277A3C25F726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649268109, "uuid": "5ea4bc0f-fcb7-4849-982f-56768d1484be", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649268109, "uuid": "abaa22ab-5542-479b-a0a9-1f815d9f39d8", "value": "6144:HNeZmOUj50TsH4S8SHWtVdobcxYGekWFpICgrW23:HNlOUjCReW72A9ekVCgrl3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649268109, "uuid": "cef6416b-9012-4dc0-bbd0-c0d0910e2f90", "value": 246622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649268109, "uuid": "cda745d1-b605-4143-8f26-f6e227efd760", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649268109, "uuid": "cf187dda-be75-48ba-86bc-1c4f262dfd5f", "value": "PO300099.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f8b8917-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277930, "uuid": "1a0dab56-9df2-4871-a396-702225ced17a", "comment": "Malware payload", "value": "8b3e34b90dfee3a7e25696ea057a8c79", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277930, "uuid": "2a9a176c-fc15-432d-b053-91a9a1378a05", "comment": "Malware payload", "value": "5f6440581ccbac424c11e7a0f13667915029f6971e27f70ec43dd4837d4fd941", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277930, "uuid": "70264f40-6609-477f-9d95-8e4069401192", "comment": "Malware payload", "value": "fda165e73a95cff2c6ea99da2581d83ef9f5bf05", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277930, "uuid": "fcad56c3-8498-4124-b959-34b1a8bbecbb", "comment": "Malware payload", "value": "8b899e4fc905d46a53aa81363105d8ae55c65ca2a991d8f0d53d0cdf20bbd71c00e0caea556e5123544c3fefe852598e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277930, "uuid": "99555f36-7dc1-47ad-b0d7-a49959edd786", "value": "T1814174C1A07134B0BCF75DBB1339882432E570652D9C6E0AA8D5F4F5C98EF42A9C52F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277930, "uuid": "f6d84ce9-3a03-4c37-9e9d-ec2f28c79000", "value": "24:Ij+PO0m0f9aIOLvu3kwUoOyH4gqOU7OGadiOgk0pOHXOrebO8eDG/OO:bl3h9q7laAVJoDjh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277930, "uuid": "cb6a9784-3740-4c63-a96d-d04188a8d663", "value": 2007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277930, "uuid": "30ab320a-573e-4d54-9580-7a19b688001a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277930, "uuid": "0e493fd1-539b-4f0c-8aa0-a91c66bbb840", "value": "5f6440581ccbac424c11e7a0f13667915029f6971e27f70ec43dd4837d4fd941", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcb3743a-b54f-11ec-8e58-42010a9c0032", "comment": "Malware payload (STRRAT)", "timestamp": 1649211461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649211461, "uuid": "fc34d491-7e49-4c42-a374-62d88e1403e4", "comment": "Malware payload (STRRAT)", "value": "280b1beba83b543cc780e55716ad9a0e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649211461, "uuid": "9f0071fc-2923-443d-8a15-b3f23c5cabad", "comment": "Malware payload (STRRAT)", "value": "601a49478b598dcaeb5a02322bbcc59bbad8f3c8cdb8f71d50216896a0ba9f45", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649211461, "uuid": "e1946f79-a3a9-4956-921b-51374486bfcc", "comment": "Malware payload (STRRAT)", "value": "1ee93ab095d113fa941d0ef973d3bb5cc0b63e04", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649211461, "uuid": "351379ac-0d6a-4e80-bd55-45291f8d9383", "comment": "Malware payload (STRRAT)", "value": "242e925404cbdd31e25cba5a68de2405f6c9531d395ccf6bd1b96ee40f6fffa0cd2ee5736158adfde7ca220c0478a585", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649211461, "uuid": "c7c46d51-d923-4cb1-8e9a-fb68504a137c", "value": "T135F43AC53A987506D372EA2CC315B737FD35E523288729DA7D803F496E66C940DACAB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649211461, "uuid": "815b4682-fc57-4eb9-accf-3bf04d0fc6bd", "value": "6144:q+9uPN8gK59vMNhEfYdGHRz/waRbZ0ob5A5mrBrO16JTKe6/0/t5i9KpPnvLd+S+:i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649211461, "uuid": "7816703b-988d-410d-b3bd-17d85b35e23b", "value": 761241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649211461, "uuid": "2b24f9e7-0c5a-4310-b0eb-2d025db2c678", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649211461, "uuid": "bb33de7c-1b4d-4564-9410-4c0e554c1f95", "value": "SCANDOCUMENT-65202267891027890001.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "801643c4-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277931, "uuid": "eefa1ec0-a9ee-427b-9630-e113afc4475e", "comment": "Malware payload", "value": "91007dbf92fff3f1b38edb697a3ad69f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277931, "uuid": "f7a6c6a1-5b3b-4050-964e-6fa5d31a15b4", "comment": "Malware payload", "value": "6024c321440f8fb466c0635fbfb3ae2d8da83af46ca731aa67b279ef7200bbd8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277931, "uuid": "2c8b04e9-c80c-4a7a-97c0-99f6f825cff1", "comment": "Malware payload", "value": "b6f8533602697e72031c5f91ef356d4def493a19", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277931, "uuid": "9a705258-77af-4267-b428-ef42330c3afe", "comment": "Malware payload", "value": "fffb2da3e1d8dc07d662f9904292b7f197bd390ae3585ac0a472ea777b19186feadeef51c88fd4e852231b8fc94b93e2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277931, "uuid": "3ad89e42-60a6-49ee-9faa-5324b24a36d9", "value": "T194A1F850112C1AB07246597AD26FFA52B40EC81B09777B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277931, "uuid": "8eb77147-2d1c-4cb6-813c-944af6f81b5e", "value": "96:kRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:kRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277931, "uuid": "dc76c0e7-2dd4-4f92-a745-4bc735954d37", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277931, "uuid": "d7eaa3ad-bedc-41b8-90be-18329e2c3234", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277931, "uuid": "f23a88cc-0b8e-4dd7-9d6c-db6c547dea61", "value": "6024c321440f8fb466c0635fbfb3ae2d8da83af46ca731aa67b279ef7200bbd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75023601-b5c1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1649260303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260303, "uuid": "0f38cb8b-daac-467f-8aab-5c13f3f4b869", "comment": "Malware payload (Gh0stRAT)", "value": "037f617a108acb13c0bba69133c7a677", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260303, "uuid": "6c2a5bec-1595-446b-b453-67f270579b8e", "comment": "Malware payload (Gh0stRAT)", "value": "609e5ecdda8c08c02c123b8376566361568646eea8b50d3eee852c6140ac2698", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260303, "uuid": "395f43c6-d620-4b23-b4f9-0d5e09e30dac", "comment": "Malware payload (Gh0stRAT)", "value": "81192f43d0f6916bd8de809c033bf13bdace6798", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260303, "uuid": "7f09ec4d-e8fb-418b-b5c1-3b908f41fa32", "comment": "Malware payload (Gh0stRAT)", "value": "925b7283a4164fbd9127028c5d456c9d27ebeafca2c03ba190299014810e611aa3f824d9e5460c8669065540bb96bddb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260303, "uuid": "16b12c4b-cb77-48a6-be7d-f5af5e974cce", "value": "T11AE3130400F779ABFD184D3A2FE984E6B5D0355C93B79222E21F32813068E66D5657D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260303, "uuid": "f1d13c01-49ff-4b34-9bc6-6f2ac394610a", "value": "82f3c2423281ec63612a748dd3291a80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260303, "uuid": "1484f662-07e3-498a-abe2-2a49551bbad1", "value": "3072:EYEqPzH6t99OdYr9lhDzMo0fvo/WGw0y2ShL07lyq3xkIA:Uq769Omrh09HFGbeCl/hkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649260303, "uuid": "1967d0fc-6ba4-4e5c-9df3-940a1383e58a", "value": 152064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649260303, "uuid": "2041a50a-057a-4e7c-857c-6b72109d221b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260303, "uuid": "74c97d99-33c2-4029-a027-d54fc6c0d499", "value": "609E5ECDDA8C08C02C123B8376566361568646EEA8B50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "809f92f5-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277932, "uuid": "9a7136f9-21f2-40ab-8eec-78bf03a1efcd", "comment": "Malware payload", "value": "526e5597610dd2fbad9823f3b39ff5e3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277932, "uuid": "f01c5b00-6094-43d9-b91f-ce3d8dcf0abe", "comment": "Malware payload", "value": "60b2a3a0113878d2955684c3066777e7d538900c5169802bced318204e34e870", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277932, "uuid": "a2b34790-766c-4c83-bb21-8d1bbd0959d6", "comment": "Malware payload", "value": "5f4c4989ed3de9972065ea3e5a261bb10be4372a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277932, "uuid": "a1ad7c01-4028-49cf-9d1d-b3bd43a04df3", "comment": "Malware payload", "value": "72e714577a930180c7e62b6d2d4031e877150211105e2f7b5fc520350c455f5b4c835e4690c535eb4ef4504bd4d0fb23", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277932, "uuid": "6883ed76-e6a5-4fda-ba7c-3ad362c5609c", "value": "T1D0E210058EE34950A3B3F46667CDE4097F9B84C74F8BAE243C4D529AAF9137493F4A84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277932, "uuid": "66f172a7-8245-4692-be33-46aa070d442c", "value": "384:EIoq47z2YEERHBL+B4z6JdfB7SevtTJJJ2JJJ2efveSPN788T:EIoq47z2YEMHBL+7XDPiZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277932, "uuid": "95c9f6ae-5f70-4093-ae27-8b5ce622c1bd", "value": 32889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277932, "uuid": "c9cbbafd-cfe0-479e-a1ea-57ebf5ac1a13", "value": "text/x-perl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277932, "uuid": "cf490563-d6d8-4e93-8bc6-14ac33b2d4a4", "value": "60b2a3a0113878d2955684c3066777e7d538900c5169802bced318204e34e870", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e957cf-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277934, "uuid": "dd764453-3456-4a8c-b9e3-22d3b45b143a", "comment": "Malware payload", "value": "f749fd849633d25d3890ec6ccc6b0e8f", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277934, "uuid": "720572ef-9472-4521-9209-4603715b9e8c", "comment": "Malware payload", "value": "60b82c18289233d333efe2d2e000612d81558db3403df6777ae3c9a2a7b19066", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277934, "uuid": "0624c7fb-fd99-4589-a9e1-746a6f00a462", "comment": "Malware payload", "value": "f34b729f7b40a24efcf6211fab27dc498b1eb2c5", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277934, "uuid": "0c6ec714-4409-4e59-b4ba-ba1dfbe832c3", "comment": "Malware payload", "value": "eebf3df33ea3d78ac603ff37be6f0362a75abab9fc80273c09ebe1bba69327b8ac433d23a2ce7e1dce248e5af8beb153", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277934, "uuid": "ead5e43d-fca5-4297-bd80-096161a9c45e", "value": "T1C8F533109AD112C9F698CD2A1BDC7626013FEFDE24B4AEE3864287F5040FF85DAB1565", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277934, "uuid": "1044f41d-1798-4950-ac77-152605796eda", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXGfYQvqE9b:G1wwAjzIQOMK2GNKslgus10Y1/UJ7T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277934, "uuid": "6afd62ff-bc2f-4aca-b9ca-3ba1c258af8a", "value": 3559424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277934, "uuid": "0b79d4e0-c338-4869-9f0d-87e0d79a6665", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277934, "uuid": "12764428-24ec-4816-8175-84511967deac", "value": "60b82c18289233d333efe2d2e000612d81558db3403df6777ae3c9a2a7b19066", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "826a3a17-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277935, "uuid": "d4bf2c8f-916b-4912-b986-2383259130b6", "comment": "Malware payload", "value": "06f704b6ec73d01c6aae52fcc5f4fa95", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277935, "uuid": "aba0789f-8c83-4c44-a721-87d8c602f92d", "comment": "Malware payload", "value": "60fd04d3646905de88cd83172156b37b31b4c621d8d068a9877f6543a62bbbbf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277935, "uuid": "863ef659-2309-457b-af30-ed2835c511ee", "comment": "Malware payload", "value": "75ef7d563d214ff19862d538f07330966be87be0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277935, "uuid": "869d1b02-5274-4113-be94-aa32f2b4e0ef", "comment": "Malware payload", "value": "9724d0bcc90d94e2ac87ec067b162b21fa4e964e3deae04f3e9f17ef1eef15162bb2654889890dabda336254b25de3a2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277935, "uuid": "bc771021-44bd-4df8-b48c-1082f2e03801", "value": "T1AFA1E750112C1AB17346697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277935, "uuid": "1222c69f-db82-462f-a385-2a9b4fa8dc64", "value": "96:iRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:iRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277935, "uuid": "bd2c2d36-147e-45c7-9d66-7ae25217ae8f", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277935, "uuid": "0587a48e-5ef3-46ae-aad0-5c109feb0eb3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277935, "uuid": "874bc38a-1e98-438d-988c-98f07c10434a", "value": "60fd04d3646905de88cd83172156b37b31b4c621d8d068a9877f6543a62bbbbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28884816-b5e4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649275207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275207, "uuid": "9e03c185-d28a-41b4-990c-a13504452a4f", "comment": "Malware payload (Mirai)", "value": "d06442d8b30379bc4d20d8b5430efc39", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275207, "uuid": "4e7964ef-794e-41f3-a57d-596b56c6783e", "comment": "Malware payload (Mirai)", "value": "6170e2ee4d4336d3b81d488e667c5e40767bc563b114a928b4bfd9756325bab2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275207, "uuid": "b34e0eec-6446-4bb3-9ebe-d87eedd19847", "comment": "Malware payload (Mirai)", "value": "8f124abf7d50e16bec7c6bbc6c5d0f8079664b49", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275207, "uuid": "24c3d928-6826-41d7-a97c-6d9aad0b7142", "comment": "Malware payload (Mirai)", "value": "fa897668add828e80cd472546267d0fcebad5dabedcf1dbbb4fdbd771a5102913d3889ef237815059e8d7ef4863fed53", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649275207, "uuid": "9c9120a3-d41a-490f-9af9-1ce9b0c1414a", "value": "T1CCB2F1789D1ED127E433C3BB135B4E6BB534A5E0934DE726228E80B843C61D32B65A6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649275207, "uuid": "d816e73c-4c99-46ee-9bdf-5a86bac0a4cc", "value": "384:MQ7moy6+jH+dv9tKcgRT2QpID7sdFEzJbEqC6bfp0rQoLq6u9dJeD79tUmhs9v1z:/ioc+dv9FiHy7sdFaJbdCktoLqt98SR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649275207, "uuid": "1aa2a879-24da-4efc-8c05-55831e60c6ce", "value": 24828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649275207, "uuid": "3d27f266-a83f-4e73-b42d-0cb50446a604", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649275207, "uuid": "7ceb75cd-40c0-46cb-a197-b2a65fd412e5", "value": "phantom.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83058777-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277936, "uuid": "0cb73472-688b-4719-90c5-5dd00a7c1757", "comment": "Malware payload", "value": "5262ae03a5c7098e895ba0b830092bae", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277936, "uuid": "8bab43df-d4bd-4d63-aa6f-81ef3d217a8a", "comment": "Malware payload", "value": "61cb69023d72d089e6cf69b2780531ae0ebd6fb333912eb5c2b038966625015e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277936, "uuid": "c8ebf164-44cc-4633-8816-b196f34a2557", "comment": "Malware payload", "value": "8862005934ef3b7263c55b36844d3163af018d21", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277936, "uuid": "46f155a8-c73c-4d40-b3d4-9f0987948414", "comment": "Malware payload", "value": "c5de8a7672cf2392a5eb4775582634a4eb303721bd714f3387ab1e480bc0746b0677202a4a7fbbe5b427b368c2747372", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277936, "uuid": "179840b0-f65c-4ac2-860b-8b3fe3ce49a5", "value": "T1A80144CB032363353E82CABD73B747659110F19963D89118FED8DE55824D948738AF87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277936, "uuid": "cad0903d-6192-4455-861a-a10b579f8926", "value": "24:usXYsMsgs+sQsosynihsXHhsLhsPhsthsfhs3hsynKTahsc/msc/q/C:MnisymOkKHn3F/g/q/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277936, "uuid": "f0694e8e-4318-45b4-8012-1228a34d295e", "value": 823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277936, "uuid": "7acbad3a-aed2-4d28-b2d1-5199c3da41c1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277936, "uuid": "c65c8843-be44-4798-bc28-0a1415bad09e", "value": "61cb69023d72d089e6cf69b2780531ae0ebd6fb333912eb5c2b038966625015e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ce7eeb-b568-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649221949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221949, "uuid": "e89b7a7a-0a63-4cca-ac31-80ff5943cf3b", "comment": "Malware payload", "value": "3cc60bfb565f90ba1fcf7cbe80471c85", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221949, "uuid": "09d00c8d-6213-4893-8441-8c60413a5a15", "comment": "Malware payload", "value": "61f1194b2b3a4dc3b4861a5a61c8dc58bce93a0ad0b18f61c8d66dbdbc04972c", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221949, "uuid": "dbf55276-2c39-4900-8480-496624b180e7", "comment": "Malware payload", "value": "d4c0b9a17d2b6bdf46db3df8c2bdd6757c7b14ab", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221949, "uuid": "a5638392-3706-4887-bda6-1fd9c13b3919", "comment": "Malware payload", "value": "9782472a54e89b73bde63410ab8b46a206de583bb8a500f720c9c24a257fd372dc6c798e2b2584e7ccd4a4458d2e6bc0", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221949, "uuid": "6c52ff10-1cb9-4c71-b0c0-5c2ca641f6e0", "value": "T1B5168D52A7A800E8D4B6D1388A56D233D7B17C5523B08BDB12E4CE6B2F676E15F3E350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221949, "uuid": "93b47141-2ba7-4da9-99fa-e501fbd388ab", "value": "b87fdacff8ab4bf476a24b846e70f6ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221949, "uuid": "37d2910f-49dd-4a11-8cfd-826265d140de", "value": "49152:bGtlq3BIU6iSwsEA9vVjQLNKK1Yh0iXr1nsl8VybcVefsSe49O8jYBz8M1T3+iPe:g+S00AYh0iX9sitI2z8Iq+TV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649221949, "uuid": "35321a8b-eea9-4039-ab59-3ac976eafa01", "value": 4062720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649221949, "uuid": "9e2bb19d-004a-4d86-a82b-57567de9f66a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221949, "uuid": "edbdda0f-c7ea-4c6e-bcf6-0aeb55e0a604", "value": "Pandora v2.41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d272ae-b5dc-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649271841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649271841, "uuid": "ac13f293-db4f-4d2b-8d14-0d73b9f95169", "comment": "Malware payload (RedLineStealer)", "value": "aef89e406756c0e6b004e64e6cb0a87e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649271841, "uuid": "eddf3fb5-4378-4c6c-a25e-6eae103cdea6", "comment": "Malware payload (RedLineStealer)", "value": "621bd96876a7d0fd45fab882dfec7112fa5c76b3da25dacc03128e3760e5533b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649271841, "uuid": "b2e2ea6d-8c9a-4d4f-9338-19f264ca8389", "comment": "Malware payload (RedLineStealer)", "value": "490d639b19e91d23f6d00b87060009992a7b5054", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649271841, "uuid": "20616b93-6e05-437a-b2ff-2daa4ed7defb", "comment": "Malware payload (RedLineStealer)", "value": "b30d3f5a1ba161ad8f51a981298bafa1ce024ddda1d625d2055ae4ee07df1d26daa10a73822deeefad7dc427038d3265", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649271841, "uuid": "aab5ee59-9c1d-421e-9e1d-8fee70726ad1", "value": "T19026237753951441D4F6C836862BBFE430FB036B8F80E9B4DCB7A8C517259E8E212A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649271841, "uuid": "19edee6c-f1e4-4eda-ad9e-8118fc5de764", "value": "92abf5ad90fc2838b3b0b9a065cff363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649271841, "uuid": "7a637ae6-031d-45bb-98c4-3b87b0829bb2", "value": "98304:7W8WOWcDDq3KSbRlRXyMNc1W9XNIeFfy/Dy67uRSBZD7G:iLAmKiRpNc1ONIMfWb7u2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649271841, "uuid": "4cb7f6e1-d17e-4c54-8b3a-c33515e7dd93", "value": 4579496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649271841, "uuid": "62089dde-bc52-4554-a987-59627756141d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649271841, "uuid": "13363dc5-61d2-49f6-b42f-81141bcc4b76", "value": "#3Y6OLSbuild.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "084aa34a-b5c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1649261409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261409, "uuid": "c83073d2-c948-49ed-9571-161254adba9d", "comment": "Malware payload (Quakbot)", "value": "1b7f60cd44c6a084aa5144a1a119a5e2", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261409, "uuid": "cd515475-c296-4ca2-9008-5c34fc038657", "comment": "Malware payload (Quakbot)", "value": "630172a8554497585e6fd7ebb266e040d29f49b09f728ef00d33b178a6604120", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261409, "uuid": "8fdf45dc-7130-4c21-8dc0-f8e623194b3e", "comment": "Malware payload (Quakbot)", "value": "bd03d129975bcc51f79769c305e1acda8a1387a1", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261409, "uuid": "5c9a5761-385c-4955-8dd0-8c722ffe2633", "comment": "Malware payload (Quakbot)", "value": "a1af353e1ef669fbcf41c5cc9b3da70d7587d3a78156f90bbf787e8cc4b78fa6658a1ac7df5947851edb52d44c5b565a", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261409, "uuid": "94bef6df-e063-4080-a7f6-2c28ac556aa6", "value": "T15615AE72A2D194FFC1723678AC2A61909C35BE902D24CC8CB7D91F5F4E3A792272525F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261409, "uuid": "40092e44-41cb-43e3-88ff-5a7c1d7687a9", "value": "49475e98a322cf931bef4088d7fe32a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261409, "uuid": "31e6d5fb-73b0-46cb-bc52-107dce77dba7", "value": "12288:w4Z52dj02g1PG9kBQLCygwjHItQOhcrga114QFdy4unYkAi5QVhP3v82xidH7FKb:Zrj9RTyEtQOhygaFdyHYkANb82xilFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649261409, "uuid": "f96c9ad1-2a1a-4f8c-9eaf-cbbdd1ec4601", "value": 875863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649261409, "uuid": "9ae9e7c1-01d3-47c3-a27b-8ef5881f9828", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261409, "uuid": "8a026f74-b36c-48fe-a0b5-233ae260daf7", "value": "Lknh.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "600a7e1d-b604-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649289044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649289044, "uuid": "83e8fe14-e3e6-4a4e-9047-9d789d4c7e2c", "comment": "Malware payload", "value": "2ebf434beb87340c4f19752e386f3a08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649289044, "uuid": "7af57270-ea64-4d4e-bdfb-51eabea0a5e2", "comment": "Malware payload", "value": "6389d62e6981d832644efd582571e61e849a680b05eb07f385384098649127b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649289044, "uuid": "0d6b1420-cce3-4329-a9fe-28dd8139a8db", "comment": "Malware payload", "value": "ed07bd8ab61dc2bce13c0a7137de6fb996e97752", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649289044, "uuid": "7d12ec7a-a861-4f14-bf61-2ab2c0f8f09f", "comment": "Malware payload", "value": "d76094bd7eda166e8fb0b7b4e6442ba81fd73f7f4cf3d04fb0f3e64ae7c31e48c76d80ba2c5bf4e60ab441a4a30e0a4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649289044, "uuid": "0e29bc08-aa68-4c23-bff6-8d1c20067881", "value": "T1BE64BF93A2648561E7544579A813C8B52C3D7F35DB03762BA3E0BECF3AB0247366532E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649289044, "uuid": "bf56cdeb-2c7b-462c-8d0f-e4817b3b38b0", "value": "a758f977f5c6bfb8c4eb2cdb0c48b781", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649289044, "uuid": "f606230f-6b53-49a9-935c-fc253a3562f8", "value": "6144:NmEdSunAqHdroKcykhPBbiMV5xzr2fXPeuS7vxN:N4ujKyUp+gOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649289044, "uuid": "a0e9e3d4-e1cd-4c9c-97f9-07d46141345f", "value": 323584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649289044, "uuid": "882302ac-1f8b-40f3-8bfb-b91ec6d6542e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649289044, "uuid": "ab3e57cf-c443-4a66-a342-3622fcfa1c6b", "value": "6389d62e6981d832644efd582571e61e849a680b05eb07f385384098649127b4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83dbc6e1-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277938, "uuid": "42a1763d-2e9d-42c7-947a-8eea1e0b3bfe", "comment": "Malware payload", "value": "d1b3b1ddbb1ee29e7e4be336fcba8f29", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277938, "uuid": "e3ab51f8-951b-4b0e-b777-f2304979ba62", "comment": "Malware payload", "value": "639526ac21cc0756e85d287199ab8c07329f6cbd5d1ae7d44b8e681fd358fe26", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277938, "uuid": "6c2256b9-8c48-48ba-8418-bcab2160966a", "comment": "Malware payload", "value": "334d3854dc27686a69dc3deff583b897a5cc4bd8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277938, "uuid": "fa0fee01-075b-45a8-ba9a-9d96b52d3e58", "comment": "Malware payload", "value": "68190ec127b4b516afb16c20cb2bfdfd938ba97b0ac78c20ea57e4947cc805315892dd3d2aa8e0095c208fa3c92c16ff", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277938, "uuid": "6900510c-1069-4fb0-b37f-a2b5a249f8dd", "value": "T13EA1E850112C1AB17346597AD26FFA52B50EC81B097B7B358473A63C74F5DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277938, "uuid": "dafe17f0-7edd-4c51-b427-ae043475ea69", "value": "96:LRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:LRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277938, "uuid": "0790d19e-0984-4794-b833-74d5eb4ec5a3", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277938, "uuid": "08155d2d-e2bc-4405-992d-8c75f91fafec", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277938, "uuid": "100a520b-953c-41b7-b7f6-b1c9e0e65bde", "value": "639526ac21cc0756e85d287199ab8c07329f6cbd5d1ae7d44b8e681fd358fe26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ba9afd-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277939, "uuid": "0a888931-0cd7-4572-aa58-cb45f16db07d", "comment": "Malware payload", "value": "5bfa9789f6da19652b4be880cdd2fa1a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277939, "uuid": "d1e54e6d-70f5-4bbb-a91e-8d9042a959fb", "comment": "Malware payload", "value": "64a436f5747650141960ecf81f223ae1f503d0fd444cc687056c4131853b81c1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277939, "uuid": "ed9b98b0-7a9e-4040-ada1-0d7f14e02d95", "comment": "Malware payload", "value": "0f9bfe17b7b40168f790c21a97015310d593f31c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277939, "uuid": "6416957c-3a3c-4de8-8738-8d3e4ce85010", "comment": "Malware payload", "value": "cfeb6b93265cf4b6973e5475a8a15428a8597a4217462de9f7017918e6721bb6eddf3ffc9827c3ad4143392d32f497a6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277939, "uuid": "b0149a0a-f08b-4ff1-a820-7515c7d094c4", "value": "T146217A8A43310F1309D3895677B146C8A2C4A07F6D63D9AFFC15CD3F6589A067259942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277939, "uuid": "58d21878-6ff0-450f-8f04-bf4763912fb3", "value": "12:ejX14jX+njXE4jX3s4jXEi4jXPeJGKjXp4jXlBw9jXEL4jXYluFjXx8i4jXxoWG1:0mxeszyP8ToWVqwcUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277939, "uuid": "a9126dfc-8294-4e40-ad77-ff78c554f078", "value": 1392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277939, "uuid": "8e259271-0dba-4a36-916f-dd0e90cfc1f6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277939, "uuid": "0aa01a9e-485e-4ad6-afee-38ac24e4c05f", "value": "64a436f5747650141960ecf81f223ae1f503d0fd444cc687056c4131853b81c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f1b899-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277941, "uuid": "aaaacd6b-ac5f-482c-83f5-e0551c3f038e", "comment": "Malware payload", "value": "075f2cf0a61c3de719f44c447b930fc6", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277941, "uuid": "17f9527c-02e7-4f90-912f-46f630412f8d", "comment": "Malware payload", "value": "64c74ca3f4a7e1e57222275c6c23dc3a2481e7396368cab256d55e054c81f6e3", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277941, "uuid": "49233881-a6c0-48c6-90c6-8d6b7f3198ad", "comment": "Malware payload", "value": "324dad8904b35a71b45cbb3aa9b468c6f4819139", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277941, "uuid": "47fb2558-8609-43b3-bdbf-eeb8babf9ad6", "comment": "Malware payload", "value": "98e8af94b5dd30ed6f0e5147c42372d0de822c384313de798ea7e46ad9464ad3d7639cfd12a7c89e54c853c89479d5e7", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277941, "uuid": "6e0763b3-92b7-4dd3-b25c-dbb857a212a6", "value": "T1CC9533229D3BB9D3857E0501E45243B3E5A1FCE85416F918B3FAE94925CE6F6B0C2932", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277941, "uuid": "201a559e-8dcd-4873-ab48-46f6eb31f0b9", "value": "49152:DJMych6OZaIU6M9yZ29jsE4dKi4qi7/RhQrM+mvsx562dQ10L0:DJmAJI9M9yZqQEmKlqi7REM+mvb2Tg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277941, "uuid": "5784c37e-3625-435c-995b-95e24145b1aa", "value": 1945600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277941, "uuid": "2bb554d6-94f3-4332-a335-63b919e81b1f", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277941, "uuid": "fec1e331-dfff-41a5-95bc-656ffc5db052", "value": "64c74ca3f4a7e1e57222275c6c23dc3a2481e7396368cab256d55e054c81f6e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52a5909-b5ad-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649251875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649251875, "uuid": "19802262-6825-435c-b096-2cf7b5e1a5f9", "comment": "Malware payload (RedLineStealer)", "value": "16350cba7be7cd1f3bf3552ea2e0ef3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649251875, "uuid": "3aafd664-b565-4cf5-b17f-1bb6953097be", "comment": "Malware payload (RedLineStealer)", "value": "6556b141cb6d777870608bcdcccf2851e4707edccbe14793bdc81b01f5d0819d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649251875, "uuid": "cf0cb44f-7abc-4f85-b040-aa134c26b814", "comment": "Malware payload (RedLineStealer)", "value": "7b0ea7a291774a35fa40f5ce56e8475b3f8576f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649251875, "uuid": "ea1cefd3-aefc-4068-a9d7-44121c3626d9", "comment": "Malware payload (RedLineStealer)", "value": "6cb9a162abf772efa27c09e0520ee8d7ac2eb6f71f19757e1102ab92ee316f289203ddbab4f62f3eab356202bb73674c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649251875, "uuid": "0cf4b3ba-4563-4571-92e3-f54728461ff8", "value": "T16E54AEC172928471C0662E30A826FBA1253B7C31E6705457FFB86B2F2E703D15AE675E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649251875, "uuid": "85a94abf-8efe-4432-af64-1f6c47667c89", "value": "2ae2b02f1c6c07ced2174fa032cff5a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649251875, "uuid": "7862e1c9-f875-4a83-afbc-70b356ac49af", "value": "6144:wKHGM/C5bxRpNu/eb7XOG0y7ITsqdiga:wKHGM/C5ljU/Kcy7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649251875, "uuid": "00f989ef-33f4-4115-8ccf-86e96a068174", "value": 288768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649251875, "uuid": "6f190d9e-76ca-4416-87be-8cb15c554992", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649251875, "uuid": "8bbacb2c-8e90-43af-810b-1d8f06d20e83", "value": "16350cba7be7cd1f3bf3552ea2e0ef3d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "868155cc-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277942, "uuid": "500f2e59-9199-421f-8ff4-60a193d8a90d", "comment": "Malware payload", "value": "c5399a067cc3d5faa09fbccf26d78d02", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277942, "uuid": "7ad6fb1c-6536-450d-90b9-8301becdb0e7", "comment": "Malware payload", "value": "656bfceb8d1a220686a62f2eeae4f934f4fcc3e4155b827c30de82f425c7188f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277942, "uuid": "e4949f03-9c7c-4d49-8f07-30dc9221488e", "comment": "Malware payload", "value": "abfbcf2595adb500a965d4dc65610210aedb8df1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277942, "uuid": "38bd94be-248d-4131-b6ef-1b52e408af4d", "comment": "Malware payload", "value": "aa04e0ac3e871ee91dd7791a723e6d69ba5ca40a6918d3232b831b1a104945f4e6f20f0c858aee1c3d0ff1b0077321b8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277942, "uuid": "f931f997-7dcf-4050-9724-fbc761b2dea2", "value": "T1401160C9129210B57CA9AA7373BE1484F0D1F2C5B8C03D45DFDC38E684DDE143A85693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277942, "uuid": "aac680dd-0c7d-47f2-943d-5d3308dee746", "value": "12:z0FNf5aKp0F0OaaKp0FxFaKp0Fn9naKp0F2NaKp0Fvv0V:wxMKadKaeKaQKa9KaHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277942, "uuid": "bfe5b253-304e-407e-949c-405d1f97be7d", "value": 962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277942, "uuid": "da28d0ae-f874-42e2-b03d-700ccf67e911", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277942, "uuid": "34b16db5-3ee3-40ef-a8e4-faf8ccca0173", "value": "656bfceb8d1a220686a62f2eeae4f934f4fcc3e4155b827c30de82f425c7188f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b315122-b5ab-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1649250865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250865, "uuid": "0aba6bdc-cc19-49f2-82b8-dff8477e545a", "comment": "Malware payload (Quakbot)", "value": "0f8f4d754c97f4507f080030a4ea389b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250865, "uuid": "6879789e-ff9c-491c-b379-7f68f79d9f52", "comment": "Malware payload (Quakbot)", "value": "65f76c1840f5f9dd16a7a2e5c9d9f28c6de3a84cfc2ee0d10ea25bb79420d684", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250865, "uuid": "683fc932-deb3-449a-bb4e-88597ec16253", "comment": "Malware payload (Quakbot)", "value": "84c794bfe8cf4420e6c286c208aab7d4bde56c42", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250865, "uuid": "09b41033-3090-43db-9e3e-c2cf3ee42ab6", "comment": "Malware payload (Quakbot)", "value": "1ffa80d96779040c4f911b24937cc2291a2d0978e4d42c63843612736cce972300867392b4079dceded0e3471e9e0b64", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250865, "uuid": "3c7b7101-87a2-4b1c-a6c4-ae32370468c1", "value": "T17065AFBC75046CDAE66F06BBDD96ACDD13B6262299C794CD8075B7C309A3372EE02C05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250865, "uuid": "7d91f559-32d6-4ed0-a77e-d909d2885075", "value": "1538717eb64bec210d6f84c7331143bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250865, "uuid": "831bef6a-4ac7-4bb6-91f1-a094ec9a5e20", "value": "24576:7F3YrrLEaF0tTHMjuX5PmnKUz3NL3BAYJWDJnh+idFsv3YgPmHFqV:76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649250865, "uuid": "9e59896d-8b50-4121-98ee-a400b9283c6a", "value": 1427464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649250865, "uuid": "6effe35a-f984-4554-b0a9-64c2d0e6ca6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250865, "uuid": "711f19f4-a051-4664-b7bd-462c21d3c467", "value": "7790983516.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a96759-b573-11ec-8e58-42010a9c0032", "comment": "Malware payload (Hydra)", "timestamp": 1649226849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649226849, "uuid": "8be2f4aa-f551-487b-ba44-04aed6f4bef6", "comment": "Malware payload (Hydra)", "value": "d61a1d957f3f509220adcd1e7f975153", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649226849, "uuid": "1bf06918-070d-416c-b339-df76478c166c", "comment": "Malware payload (Hydra)", "value": "6615ce1e651653426e799bc5e07823ed6628c89fea5e7ee372d7440968ef028e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649226849, "uuid": "46ec441c-742c-41da-ae0e-8f58108b51c5", "comment": "Malware payload (Hydra)", "value": "df6c31c0e052b861b73e12dbf15942a9d5aa7770", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649226849, "uuid": "9e003506-59bc-4d9b-81ff-4ddea2a1e0f6", "comment": "Malware payload (Hydra)", "value": "493c01392763c6ed4755338ea53a19f0b3a07822b9b64557d8235c7788e3a829fbd8119defef0831d15e15d0644aa764", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649226849, "uuid": "b530ee3e-43bd-407c-8d8e-ef5a5a7961a7", "value": "T1A70633A27E94A1AFD8711B3175F38B0323760E940B51219F69403B3D51BBBF5A213BAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649226849, "uuid": "fd6f01dd-ddc7-4adf-aa05-d28a1ea17c8a", "value": "98304:ja/v95UTs3eUNcpmWGFx/MJXJHcWpNMAC/mndtRXAs1iQf:ja/v9sjZgiJXiWfxdtpAsYQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649226849, "uuid": "3af19ff1-98c1-4621-898b-d565f581790d", "value": 3713114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649226849, "uuid": "34f7872e-2cc8-4c58-addd-3cbe6a5a146e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649226849, "uuid": "04b903ca-6552-40df-a72d-9afff37fc578", "value": "bawag.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87094086-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277943, "uuid": "1fc06cf5-b24c-4be6-af04-7f02a5dcee80", "comment": "Malware payload", "value": "b115ce72ded93b7cd0d89e80922ee8bd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277943, "uuid": "9c966adf-bd05-4005-8bd3-6be74d5a53dc", "comment": "Malware payload", "value": "66be0af730fab5b09a8b62837fcb67bc7603ff2e2b0edaaa9ede2eb60920525b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277943, "uuid": "7204c162-df38-4f49-996d-a16b431a6963", "comment": "Malware payload", "value": "ca81f8f131bffca561a5cf03a02a90e6562ed96b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277943, "uuid": "f2c6d688-c3ae-4ca6-b9de-d793e9db3d80", "comment": "Malware payload", "value": "a8517c6df4984c0921b8f54022f9eb30b7059485a8e9efc18054e2a332421f195f2c94392ecdee57de4c1150194ddb06", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277943, "uuid": "003c8cf4-c982-4ca6-a3cd-4a49ddf441cf", "value": "T149A1F850112C1AB17246597AD26FFB52B40ECC1B097B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277943, "uuid": "50f9d157-1f96-411a-808c-6f93ce1a2c7a", "value": "96:ikrRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ikrRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277943, "uuid": "c67acd87-a052-4143-b64b-ab3a29bffc12", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277943, "uuid": "12e7ecf5-2128-4fff-91d0-023bb726a01c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277943, "uuid": "f7869736-6932-431f-91dd-06e2fdb9eaff", "value": "66be0af730fab5b09a8b62837fcb67bc7603ff2e2b0edaaa9ede2eb60920525b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87898cf2-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277944, "uuid": "d4da03c7-7664-4f4c-857f-668a0899301f", "comment": "Malware payload", "value": "d5b3ee806c12b06f18e243d41b86cfeb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277944, "uuid": "6fa4ad9d-fa36-4652-90d2-673b26867491", "comment": "Malware payload", "value": "67070cb921f5ab287cb5771a356f4c1fd203923b7362cb04634698c95978b3ba", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277944, "uuid": "3dc7a55b-6207-44c2-b5ce-0131a1ab0906", "comment": "Malware payload", "value": "17602e8f62c92392c44074fbdb2e66ca38b34a57", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277944, "uuid": "f115afc5-752f-46fd-8a9a-09a30ee24a9e", "comment": "Malware payload", "value": "318de0e4e9dfbb5926872a63952d9534bd9134e6992d531d27ca4f04003aaeb1ba73026a152d429cdfdfd6991cca999f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277944, "uuid": "b45645f4-9c96-4ca4-a64d-94c01cbfe01d", "value": "T113A1F850112C1AB07246597AD26FFA52B40ECC1B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277944, "uuid": "7da69ff2-1bc3-4764-a55b-556fc6babfe5", "value": "96:MRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:MRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277944, "uuid": "bcd80023-c699-4392-b918-26bb94c1ff89", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277944, "uuid": "d683a316-7c74-4e6a-8de4-e148bb3ef506", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277944, "uuid": "36d38244-5c6d-44a6-b8bc-32565369a1a7", "value": "67070cb921f5ab287cb5771a356f4c1fd203923b7362cb04634698c95978b3ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb5fb9a-b5c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1649260049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260049, "uuid": "ba83e9bb-160a-45a4-85c9-adb1d000bc94", "comment": "Malware payload (AsyncRAT)", "value": "654395dffbd7320df37550f5a65d3ea3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260049, "uuid": "08f865e2-a763-48e4-be54-4187478b80af", "comment": "Malware payload (AsyncRAT)", "value": "67a0e695143f811e5ba418e2a6d457364297e4b3b90c4d4527955a567a2347b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260049, "uuid": "14273d15-329e-4084-97e5-81c168a3df69", "comment": "Malware payload (AsyncRAT)", "value": "4039e2ee6ce377d6c53e6fc8f687af0dbd04fd72", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260049, "uuid": "499b6c34-26bc-44ee-bc0d-da15ced11474", "comment": "Malware payload (AsyncRAT)", "value": "fac6db89f3ab40dd114cb2c293d77475c8111e4555117839a61f206665dcc60b0cf2015bc29a9c2ecc1d4f034f766a3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260049, "uuid": "d553ee24-3274-464b-89ee-6e2e52ef0b50", "value": "T17984BD02A79CEBE6E17F277594E9602103F9AC9B1533D25BACC0F1F86EF5E004A45663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260049, "uuid": "0c33e2a0-0a6e-4d81-8d47-fc67baba5cc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260049, "uuid": "f8c2cca6-cf21-43dc-ba90-26e9c7581027", "value": "6144:FnC4+/499nEZS3bUmSoiDnQtUcs99EEz9P05gr:Fn5DEZfmwcAyE1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649260049, "uuid": "a70dc9f9-17bc-4b82-93e2-3a0985040f0d", "value": 395776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649260049, "uuid": "ebc21307-5bbb-4dcb-927f-9676b4421577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260049, "uuid": "6de382d6-7cf2-4c36-bdc1-3c25c6bb11c8", "value": "654395dffbd7320df37550f5a65d3ea3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b7c93d-b59a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1649243611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649243611, "uuid": "1a9f0a7f-deb2-4a60-805b-30dc1419ada0", "comment": "Malware payload (Smoke Loader)", "value": "906365a300f67eeb42c867b9e8862403", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649243611, "uuid": "5d65034c-7862-4456-9494-f5b40918b499", "comment": "Malware payload (Smoke Loader)", "value": "687ca5a69fc193e08538b21f8b0aba4a279c75561873b45e71e3ce57721c815b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649243611, "uuid": "8526ef50-fb81-46c5-89fb-f53bc6fced14", "comment": "Malware payload (Smoke Loader)", "value": "e13fc24891f57b025ca940c10a275cef805391fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649243611, "uuid": "7a47978b-df0b-4f60-92c1-34755d6478ec", "comment": "Malware payload (Smoke Loader)", "value": "023ce747babb3665cad42b35e67b8d7fce33f48afd57841caa8a23bc53a38c4eebc123c9aa642928bc773231992df011", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649243611, "uuid": "a60456d2-f0b5-4502-bcd2-76657c91545c", "value": "T10454ADD272928471C056AE306866FBA1293F7831D630D41FF7B46B2F2E713D06AA17D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649243611, "uuid": "575a38a1-ca87-4595-810a-b3170178afc4", "value": "5cbd107a7eb6202007731da5377c40ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649243611, "uuid": "415c6489-f0b3-4372-8274-f258759c8274", "value": "3072:TJXgb4pC4km0dfYcZCZtpN2orEj2UB0KtVggjcGkNIVqIpsxkgaBChUNJ:ZS4d2fYc0Xdy10y7ITsqdiga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649243611, "uuid": "ef5281b5-15ef-451e-8cce-bdd38f99b589", "value": 289280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649243611, "uuid": "fad66e6e-727a-4dc6-be30-f388dd69c8f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649243611, "uuid": "43ea6ee4-4e00-4dca-a903-032b69f33a71", "value": "906365a300f67eeb42c867b9e8862403", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88662c7a-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277945, "uuid": "2c1e64e6-272e-4448-a828-1530c02bbec3", "comment": "Malware payload", "value": "658b750e55f9602c9626fdf271924397", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277945, "uuid": "1cbe8573-d8c8-480a-9efe-61e259baa3b5", "comment": "Malware payload", "value": "68b78b5aa39da8d111a596c79e6f5a19978c45b5f1c0bc32387cbcc96fe8c60e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277945, "uuid": "6bc97155-5c9c-4432-baab-76d430e7b7bb", "comment": "Malware payload", "value": "e5c883895ba0a8e0d9bc8b9ba410c186a7c953cb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277945, "uuid": "53215a73-6b24-4a05-bd69-05b81dd57b82", "comment": "Malware payload", "value": "252774cead1de9bdb12301f125919219f692d89c6c7cf7b2d3dec92d6213d07420934a9dfa3d70c379f6d24d1296aca8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277945, "uuid": "bb116982-eb81-4301-b9a4-7fc3977e4f03", "value": "T1FEA1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277945, "uuid": "f13456a2-1302-4a14-9255-ed7887617305", "value": "96:6RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:6RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277945, "uuid": "e2597aa1-f9eb-46c0-a062-d0c50af46dfd", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277945, "uuid": "29ffeff0-df8e-4702-9f46-cb9c78d76bd4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277945, "uuid": "df455427-61c0-4409-b6e3-7aace2b21933", "value": "68b78b5aa39da8d111a596c79e6f5a19978c45b5f1c0bc32387cbcc96fe8c60e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c51e95-b5ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649257296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257296, "uuid": "23dc1f45-9f1a-464a-8313-107c7eda433f", "comment": "Malware payload (SnakeKeylogger)", "value": "7f4ec69a0ac161005e8fa07263f1b5df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257296, "uuid": "f2796f80-29f7-44af-a216-e44e4caf0adc", "comment": "Malware payload (SnakeKeylogger)", "value": "68c4df7890060b6342e137bc4009fa3ec8f8a9dedbf79b719d982768f54a8c77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257296, "uuid": "18a69fbf-4d42-4401-ac1e-c4f2f6bf439f", "comment": "Malware payload (SnakeKeylogger)", "value": "cac8718fb079b9f8991b886940605a251c719aac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257296, "uuid": "24f66fbd-d825-4e24-beda-20e5881064f3", "comment": "Malware payload (SnakeKeylogger)", "value": "f8c2135f89db57640b382adadf94d949d223551f54e5af04424d4aa773b65321081264722f34f051a46a10d392bb7a88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257296, "uuid": "cc9a001b-ee9b-44ea-95d2-c77418fc98a1", "value": "T13BC3B2037296BF13D498267980EB092503E1AFC77237D7797E84059A0E47BE58E7A3C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257296, "uuid": "efd99fa0-760d-4c82-a5f3-3525efc04b5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257296, "uuid": "1f4e1d1d-8f55-4ecf-ad01-297f99db9b2e", "value": "1536:A4oI7E7UFFlIEl+uw+Z4WOelKfhT/8GbKTH4lT51AYgAtr:n7E7U7FwA4WOelKfZZbKTWTfAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257296, "uuid": "149d6887-8f6e-4a52-a9fd-837d4b2188ab", "value": 119296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257296, "uuid": "2bf54d48-7fae-4379-872f-4f716b3e60a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257296, "uuid": "86d8c80c-278e-4ea3-8d36-64cd6e82e0d6", "value": "BLT20652100079.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88ebc4a9-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277946, "uuid": "db650632-56bc-4e75-9c94-ffba31885fa1", "comment": "Malware payload", "value": "f2e93aa00cb762916bc1b224fd252921", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277946, "uuid": "40336443-37b3-428e-a135-d1e053126a46", "comment": "Malware payload", "value": "68fef028f171c1dc1b8ddab6c4a7cf3f3fd7780d4b725985d25cee17ce3bde65", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277946, "uuid": "478980f5-20a4-48e0-802a-6eb7d146da3a", "comment": "Malware payload", "value": "aac4f964b7eb639031f2a4da9c057496753fee01", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277946, "uuid": "d5ef29c8-e9ad-403a-b8ec-f0596d03a552", "comment": "Malware payload", "value": "3df0d506b265d5ec897d9d2e6e17d40ca21310c40f3d0cb32a03413b47c2b857c350a87d4aa5f5e7bf319854e0057dce", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277946, "uuid": "b87f8255-4a2b-44f8-aa38-98ba7a7dbf03", "value": "T14DA1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277946, "uuid": "a2a6f9b8-1b1b-4d2d-8f2a-f5ce9020300c", "value": "96:MRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:MRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277946, "uuid": "a3abb2a9-454d-4997-b111-3233bb4352df", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277946, "uuid": "c0552bc6-1db4-4fa3-9afc-1a6bd549072a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277946, "uuid": "1bb47920-1588-4060-aa6f-157924e9d2c0", "value": "68fef028f171c1dc1b8ddab6c4a7cf3f3fd7780d4b725985d25cee17ce3bde65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f38946-b5c7-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649262882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262882, "uuid": "256bdd57-c047-4a08-9e05-fcc57fbf5499", "comment": "Malware payload (AgentTesla)", "value": "a4741e30b7b12d7b7ff728527bf7023e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262882, "uuid": "6597d533-c94d-469d-b331-3434dee4de7c", "comment": "Malware payload (AgentTesla)", "value": "693b96514d1d57ee01269e74390bef130a9980cd91f8487cac6f3a89c4f18b25", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262882, "uuid": "3fd48abe-7dd4-43b4-92cc-dbac97f7fee2", "comment": "Malware payload (AgentTesla)", "value": "d8429912433ca80b1fde886c1e91af51abab5efe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262882, "uuid": "1dedcb31-3c32-4ece-9435-140b3fe0e627", "comment": "Malware payload (AgentTesla)", "value": "df00e5ece90e6baaae8448e2c4b59667392d973216580440e756e49792fa1f5b7de6565c5eb4dc563b7f4f853e975c3b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262882, "uuid": "7b4d0dbb-7102-4593-a0b1-b9ad2c867324", "value": "T1F3C40113B7D9AF5AE07D377A15B0608023F9B9DB2230C76F6DC441C86A1AB812F557A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262882, "uuid": "987cac27-cdbf-41ae-b5b3-f35806b01e17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262882, "uuid": "c9227e93-159a-48e6-994b-f6bf27c2d04b", "value": "6144:dO99nEZS3bUmSoiDnQtUcs99EwG4EJJjtnqN1+Wwv/UxTRJQF8gswo7r:wDEZfmwcAywwFxv/ifgf3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262882, "uuid": "3fe3ff93-43f3-49c9-8eac-18d594b4b154", "value": 596992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262882, "uuid": "17e78b75-ce07-4ef6-b713-c2b96a567d10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262882, "uuid": "4fa1140d-7194-48d9-8a1e-8412e92e0554", "value": "a4741e30b7b12d7b7ff728527bf7023e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d14ce714-b5b9-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649257022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257022, "uuid": "4952e59e-e7cb-4c17-8123-05561af313fe", "comment": "Malware payload (SnakeKeylogger)", "value": "c2490c7ab288af5fd2179c4ac06ea660", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257022, "uuid": "8c76c739-3097-42f2-a663-adf865ddbe16", "comment": "Malware payload (SnakeKeylogger)", "value": "694f412fbc577fa0401c1cdda591d78736064616e65d62783655616cf05d7a9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257022, "uuid": "ba444324-6c03-4936-b4c6-29ed26b53c34", "comment": "Malware payload (SnakeKeylogger)", "value": "35d4a0b52a1c079e5b667b01642b50b188112fc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257022, "uuid": "0408f933-480b-4256-960c-40e9613ebea6", "comment": "Malware payload (SnakeKeylogger)", "value": "d514befc275bc8a92c375be55348ac5f088a829fce2f67e54492fd62579a5bbd7b69d09d34a4a0f5641b039f653fe720", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257022, "uuid": "97eadcf4-78ef-46da-bc45-30f88f03962b", "value": "T121852361B769EF56DAA457F4E40082F803B05C29C165E34B8DC9BCDE3A7ABD00E85763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257022, "uuid": "bc78fb12-31e0-4da4-950a-f26412e866ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257022, "uuid": "a70ed3f8-136c-4a25-a5e3-1141b0cc61db", "value": "24576:N6U7X7X7X7JvY0UDJgYg8oclq/dVoG9oSPoxMjmpOXEP32rUWvhb4Pem9Y+WHqv+:N6Kp8JyofSHib2hdwemq3BA91N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257022, "uuid": "93b3760e-c885-4809-a0d0-c72f1c44c714", "value": 1837568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257022, "uuid": "a4328c4b-04b8-4b6e-b0c3-75be972205cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257022, "uuid": "2191e9ea-8dc2-4536-9969-0406781ba743", "value": "c2490c7ab288af5fd2179c4ac06ea660.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f8140a0-b5b9-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649256858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256858, "uuid": "4b71f53c-a69b-45b7-94fc-4db67cba076b", "comment": "Malware payload (SnakeKeylogger)", "value": "c669c2439a1c4aa4125b145d67a32280", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256858, "uuid": "d216b3f2-33db-4a60-aed5-dc909ae1eaf4", "comment": "Malware payload (SnakeKeylogger)", "value": "6ab6583c21ee7a778e54995c9a36a7dc9615d910429f597efb2c292722e8b8c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256858, "uuid": "7247a19f-2e13-4ba0-8494-a2b602b05d18", "comment": "Malware payload (SnakeKeylogger)", "value": "4af5bdb70d5f0e1e8974c559743ab845562c0bef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256858, "uuid": "8dc3c48b-08fe-40ea-bd0c-bb19d8e74768", "comment": "Malware payload (SnakeKeylogger)", "value": "963058b7ea42b11fbc92d9a33de5cfbf9d815aa897b6e94cb7b922c8d92441f2f06a537240f348d65c42738b0db6106a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256858, "uuid": "45dced76-a3ce-4c73-807c-c62fefb22a82", "value": "T1D3135C0E7BCCAA59C36C64BE84E3991013B591EB7602FE1AFCC471582A53BF66506F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256858, "uuid": "eeb1a70d-7bd2-4499-a659-0f4d2a2c8af8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256858, "uuid": "3e450369-88d5-4081-a25e-54db4812ad84", "value": "768:4CLPpLs+VTD44aG74e9KHx36dpgbALX5gRxeM5S4WuuycyrsR2vZf:4C9L0HG74R3EpoYX5CxzxvvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649256858, "uuid": "2f577c9a-b592-46e6-b681-b90788e4e1f2", "value": 43520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649256858, "uuid": "62510895-ddc8-49e9-997e-a45c03bf212e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256858, "uuid": "6dbbacea-419c-4531-8118-7464146310de", "value": "09823456789098765432345678922345678008765.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da28231b-b5c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649260044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260044, "uuid": "f85ef352-f4c7-4077-abb5-20a257b33bec", "comment": "Malware payload (Formbook)", "value": "f73ab7df3c255fc1634f623d0ab2c09b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260044, "uuid": "1b36de8e-57a3-47db-879e-d3a1003e8833", "comment": "Malware payload (Formbook)", "value": "6aecf2a84c05d52c3789b9b22ef5c046eed5dee698e2d94d61cda7219d32bb00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260044, "uuid": "f8bba3df-ceed-4c02-a868-3cb43bb68f77", "comment": "Malware payload (Formbook)", "value": "9a695bc5f0d99c6906f48151a8ebb15643956f75", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260044, "uuid": "4e26bf78-9390-4d24-9938-0e0430a6000e", "comment": "Malware payload (Formbook)", "value": "a2dfbc7dde1c5aa7d02cf70d1d26628e05dfca3354e1a79506bf64c55fea260b5117e841c5d1ce7eb75923a42170b65e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260044, "uuid": "5f1eec5e-b7cd-4751-9f81-422b9cf5cf78", "value": "T100B40218F3BBDA26D5BC967390E695060370AB13E5A3EA4E17CC22D746077D50A42FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260044, "uuid": "d0554d3d-1fad-4139-8a3f-0d696358257b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260044, "uuid": "74962848-f48c-41ac-917b-24f53f6801b0", "value": "12288:dfXQwhlE8hFLBx/lhInMg5f/0BTpZbrWIczHVL5fxxkFksbupF:9lE8TLBxdeVeBTzWIcH5JxxkGsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649260044, "uuid": "f4dd6bd5-5505-496b-939a-ad92fd583671", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649260044, "uuid": "9dbfcfd2-dd70-458a-bc2f-da7a7cb25be9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260044, "uuid": "f6ac16c6-1a6e-4b72-9cf2-c513cf732e8e", "value": "f73ab7df3c255fc1634f623d0ab2c09b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad0b2a0-b5b5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649255213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649255213, "uuid": "3085b5a7-2b43-4d88-b779-bda6e59351bf", "comment": "Malware payload", "value": "fdab3f4a3e2821134b9922a594f591bd", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649255213, "uuid": "433d746d-40be-4eab-9a28-58457441eae0", "comment": "Malware payload", "value": "6af7f3b096f4caa95bb448c11b97bfa20c65098ae60008d027c008e7a85e1b55", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649255213, "uuid": "99bd9e3e-812e-4182-af34-e1933f775b5d", "comment": "Malware payload", "value": "bc4c3b0df9f32c8d59f915c8a2a5f7b3e7482975", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649255213, "uuid": "571682a4-df16-438f-a083-f070a653bff6", "comment": "Malware payload", "value": "817060a062f7965ca00a2b8460d95544d75165e0ffd7f7ca96be034af0b2371714dabd9297e12b8fac01ff160e8aa5d1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649255213, "uuid": "f82238fd-0058-4b41-b8de-9ed17f969129", "value": "T19292B02DDA42B838F1A6873D515B16F1F30931469B26A1EE1971B2DCCB805CB4F035DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649255213, "uuid": "dcfcf899-756f-4e03-85c2-094ad4eeb9e1", "value": "384:eOPvQy3iPd6/MfvHq/fwJVVPcZy/OF/QccG2NKVY8ehQJvtNkbKbR6kn:RvwIEffifw5UoOthJ7VY1QJvt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649255213, "uuid": "45b9f290-f6a6-40dc-bc4d-dac598e94d79", "value": 19920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649255213, "uuid": "c6b3643f-83f9-4def-a77a-5b4718ffd541", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649255213, "uuid": "e39caee9-6856-4a15-a5d4-820b2f76793a", "value": "open.dotm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bbde0cf-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277951, "uuid": "60bfe3e6-eb41-41e1-ab26-4af2374f6645", "comment": "Malware payload", "value": "918f18e3cf28f2331a76a7ae33bcae50", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277951, "uuid": "58a38040-e5dc-4e1b-9703-5813d75a06f8", "comment": "Malware payload", "value": "6b7264b33c60c5d414d2acdf44f84da5cb51d1704187abf21ec884cadcfe3070", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277951, "uuid": "cba513f3-6ab0-4167-b9bc-b4b5e15d5b80", "comment": "Malware payload", "value": "a7d8d48dd05478c68165b641c4e89ddc5cf3496e", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277951, "uuid": "e4dd8126-e9aa-485d-9539-cc7b46d2f164", "comment": "Malware payload", "value": "96659bc74514391c37b14e67870f2db70db7b08ec9a9feaa0101ea0ae013b00334172684b30509c1d7563fb60f1407c1", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277951, "uuid": "a750a31b-4e93-4c7a-9661-075cf6e30076", "value": "T175F5330C63AEB8FDB8994539376348E1C5E852F1988261F2D77C19980C3F57D0B9FA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277951, "uuid": "155d67f7-f1c4-48e5-aeaf-0f36afcaee15", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwX4:0XSxVJG2fLAqFOfT9sMYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277951, "uuid": "6ca87605-f44b-4c21-a57b-4f90cb4ddf0a", "value": 3358720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277951, "uuid": "d1d1175b-a8c6-416b-ba5e-f4db6780d0de", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277951, "uuid": "0ec72009-4b41-4d03-bc96-a3c7e5407b3e", "value": "6b7264b33c60c5d414d2acdf44f84da5cb51d1704187abf21ec884cadcfe3070", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63479fab-b5e0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649273588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649273588, "uuid": "334cad2f-7206-4d6f-ba5d-b8598c46b40e", "comment": "Malware payload (AgentTesla)", "value": "acfc654b439eb4c1137190e50b400317", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649273588, "uuid": "e57c6e6d-c90f-4745-9749-8def16285cd7", "comment": "Malware payload (AgentTesla)", "value": "6bb7b6c331af0d1b959bfdaeb261e66f4564eb94e8921e771bd60379720dbe4e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649273588, "uuid": "d47d61a8-e979-4394-99c1-6d580dd3dc51", "comment": "Malware payload (AgentTesla)", "value": "bb3be17aa72deb0f8f217ae9447fe761027cb6c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649273588, "uuid": "cdfe1820-3a9f-4a37-a96b-922449f499bc", "comment": "Malware payload (AgentTesla)", "value": "0c1b37ce086380864402136e41d88ae026b37dcbaa098b546a58dc4055a2d4aa31818f291c5702c1f9994bcd35aac247", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649273588, "uuid": "a5f0791e-5d3c-435b-b259-f8a736dc21e8", "value": "T1AAB4BEDCFF94EE94D11B46F8C86D9984827678169B47EF2230C62BBA157139CDCC12E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649273588, "uuid": "a59ee477-781a-4a25-b85e-11dc4240e26d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649273588, "uuid": "fb8c20b6-1471-4c49-a1b1-668ba1a7aebb", "value": "6144:iz73RJMJOzZln1zj4NoZjJ+i7s/HsXw/tbp1CSLuK4CebWX:2pzZlnZj4qSHsXKbpM0uqeb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649273588, "uuid": "93193c46-b637-4ab3-a196-bac4b0526a4e", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649273588, "uuid": "1b55df63-e23b-4f5d-9a00-904a892df96e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649273588, "uuid": "f2e3bbc6-7a18-4dc1-8bf1-8def5064f4f8", "value": "acfc654b439eb4c1137190e50b400317", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c15884c8-b5e2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649274605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274605, "uuid": "d010480c-f9fd-4bad-ab6d-7651965707c8", "comment": "Malware payload (Mirai)", "value": "5cede5e418c9dce46c4e54ce09fa5ee1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274605, "uuid": "7a501085-6266-41ee-81fe-c8566dc7dfea", "comment": "Malware payload (Mirai)", "value": "6c0a3619ca766e0198303319ddd4187a0d506a498a0f9de4fea5ccc62ad9930d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274605, "uuid": "49969821-4d25-4118-a656-4f7c1ff98573", "comment": "Malware payload (Mirai)", "value": "47dbf1686c45929ef76d782c616dfe8fbb7c7cce", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274605, "uuid": "6175cbdb-4fa0-4400-a534-a24863eb39c6", "comment": "Malware payload (Mirai)", "value": "86cb6577dc0bb5a6d76571bd14be98c29a7c51b562d47edf815d9bff17796716a4f4bb16860b3351821b393040a1a3e5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274605, "uuid": "14f927a8-ae30-4121-8ac2-64a0b3de8281", "value": "T144D2F190B6AFC764CB0D833BB18E0F2B5060259993DD94C298419CBF9FB717B2612E48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274605, "uuid": "fa7d3135-851f-42be-99e2-d036d5a5d9c1", "value": "768:g930DyeJXHXBJbmMU0HDatAm+/kRWmyDveoyr13W54J:g93SyeZ3BJbNU0H2A7XmW5yr13W8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274605, "uuid": "96f5fc49-afc3-4f37-a697-2beebd896917", "value": 30844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274605, "uuid": "f4b4fe9c-da89-4044-9496-225a13bf7ac2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274605, "uuid": "3c9e9470-eb8d-4d85-ac79-29ba0ef46a2e", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ca30bc-b5f3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649281803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649281803, "uuid": "2ae0829d-4ed0-46a8-b5bc-5c02c11d0b4b", "comment": "Malware payload (Mirai)", "value": "9e386789f436e2480c63532e774d8659", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649281803, "uuid": "67c67dad-73ca-465b-8f56-71c73ce507c4", "comment": "Malware payload (Mirai)", "value": "6c1ecde2d6be80da5c407730a0b68307a0045e5e4b899118931e8913b44b213e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649281803, "uuid": "073e8f44-d7df-4133-a4c5-0fcd4dea0a94", "comment": "Malware payload (Mirai)", "value": "db9b0f4bd92f9ca84670dce50d273a345032db68", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649281803, "uuid": "45d88a1d-9525-4a56-8202-9ce8658de6c6", "comment": "Malware payload (Mirai)", "value": "27a1568620cb07cd6b4b06ae0eab773dc7192918c563d59bc8de4e9cbecc491ba7b7edf8b0b089f06e05304fa44ac818", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649281803, "uuid": "40ef6655-8acf-4d6e-848e-6b2552b054ff", "value": "T12CE2D012E6A40344F99493334CEF6A5E0053D62D978EE1DA5DF8217BCCB4D33A628B93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649281803, "uuid": "3e84f7a7-ab6f-486d-86fc-cf93bf60a648", "value": "768:y5ruu5lx/Fru7hTvRat8u6KyRWXG8nbcuyD7UHQRjL:8Rrx/FrulTvot6BWW8nouy8Hy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649281803, "uuid": "27257ecb-b113-47b8-88e7-c0e0b5368bc2", "value": 32052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649281803, "uuid": "f3cc6878-cfff-4f0e-af43-ad2a80cf66d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649281803, "uuid": "634bd581-d68b-45ce-85bd-4f208c4217a4", "value": "scorp.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c388f6e-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277952, "uuid": "63c34025-606c-444b-80e9-db6b40ce8151", "comment": "Malware payload", "value": "2d02b07789917c8cdd38126330006da3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277952, "uuid": "b97d7a16-f116-4e09-a520-a4514fd799f6", "comment": "Malware payload", "value": "6c220988e317111e680ef756ec2279cf6ba96058228bdf9f91560be3baafbead", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277952, "uuid": "5a5bbe42-6df4-4e2f-a0f0-bba0937ed179", "comment": "Malware payload", "value": "6be50eba1e6c757402bdb108efb93df25e70d901", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277952, "uuid": "681c7fe8-700c-430a-b0e4-a86e8f82fe29", "comment": "Malware payload", "value": "15a55837e88192fe826506e627dad0ebb76ef02863c2ccfa2ac50d8c91a44d82895de64142ceec449923da425fea7257", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277952, "uuid": "05289eae-cb51-430d-9860-1fbad3862850", "value": "T1A1A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277952, "uuid": "e1c7ec74-f296-4ba1-bef1-7f563c417645", "value": "96:BRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:BRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277952, "uuid": "e7606ad2-568e-4e6b-9ab3-b95615016451", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277952, "uuid": "2b7f1656-c146-4d8c-810a-ba51dddd2185", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277952, "uuid": "1b2be108-973b-48c1-9f23-5bfe041b0567", "value": "6c220988e317111e680ef756ec2279cf6ba96058228bdf9f91560be3baafbead", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "283b1696-b5a3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649247290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649247290, "uuid": "f9d1397b-cb6f-4673-b60f-342575bcd02f", "comment": "Malware payload (Formbook)", "value": "87e493380c0b867f378f84d9c300f29d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649247290, "uuid": "5aea6c9e-1ba3-4e71-b001-d01cf9057bc2", "comment": "Malware payload (Formbook)", "value": "6e14859642862aa879cc5b6913e74317121f51c9560499e0a94ed59b95202022", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649247290, "uuid": "5ac4e9db-8ac2-4358-acd5-6275bdb5af22", "comment": "Malware payload (Formbook)", "value": "1dde2ee6131180d57ab8a0b19b66b59bcb3a03bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649247290, "uuid": "1dc843ac-8600-40c4-99d4-532f523cb737", "comment": "Malware payload (Formbook)", "value": "276f0628ea986bcee9367738f824fc066d1480d322a8878a6f34c9c1c299a7cd516952923afba132ab07b23ebaf5f799", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649247290, "uuid": "146a3891-7ecb-4f94-98c5-39a1cbd88a48", "value": "T1E3C4024922882716DC3C67F694360DB40771AF3B7D22F5ED5EC1B6EA28337D84912A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649247290, "uuid": "cd7a3edf-56a3-47b1-a6df-837493a17dda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649247290, "uuid": "f8b6ea3e-4405-455d-97b8-0f15756f022f", "value": "6144:HejULv+NqJ0BBnyWtXGB1KumK86GrUq74I9zxsnrhXwWCUAFMqFnIHgHIyproPDS:He4+N6WdGBcE86Grv0VU1IHiryxaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649247290, "uuid": "b63aa21b-2efd-4fd8-8fd5-30fa2823ef69", "value": 558080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649247290, "uuid": "1ffdb1d6-eeb2-438a-be74-0d02481886cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649247290, "uuid": "09aeb279-82a3-4adc-b48d-8eafdf23c277", "value": "Purchas.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22158de6-b5b0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649252863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252863, "uuid": "3dec9fd3-4793-40fa-a1ba-61b831b19689", "comment": "Malware payload", "value": "a26c68e3da5f127518f7520bb2e501bf", "object_relation": "md5", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252863, "uuid": "d2371ad1-6a4d-4de6-8e8c-c3275e474632", "comment": "Malware payload", "value": "6e50aff23a6cb51efba336e8565893734dab22e820ddcf0cf60569195b43ef9c", "object_relation": "sha256", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252863, "uuid": "8605587c-2c69-4468-b305-0efde1bc440e", "comment": "Malware payload", "value": "7f8327edae58bf6a5a532d39197039bd7eebdce4", "object_relation": "sha1", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252863, "uuid": "0a1518a3-992c-462c-8eb4-52b45fd8c95e", "comment": "Malware payload", "value": "58adc17badd1754ffd7005f350249ee360858f87ef5bc6e97058c791c46302b14bb98fc30892b9ad12d460d512c8d56c", "object_relation": "sha3-384", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252863, "uuid": "53a75adf-9e1f-43d3-8047-82e0ac07bd09", "value": "T10BA63360F15F865AC030EB7CF89B4EB67F60A1DF32511317D8A848B9260B393AB17759", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252863, "uuid": "7ae0d324-1855-4c55-bfda-49749609472c", "value": "196608:rYaD7Xi5IVmMdSaTSx3ocRIjMjSl75bXzIyFVQMkIzboERNxulMx0Qz:rD7WumMJSxY5MYtDGMkS9LxulMx0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649252863, "uuid": "e0bdb50e-66b3-44b9-9f8b-5c4b54df3073", "value": 10380152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649252863, "uuid": "6296744c-9b9c-47ca-80ef-e33693b91d39", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252863, "uuid": "5d24e9a9-afeb-47b4-b390-180667f74c9a", "value": "PDXz1_.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d399ef2-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277953, "uuid": "111391ec-4818-482f-9bf9-9436278fb466", "comment": "Malware payload", "value": "2c1b97c5cd7c97297eb69ca0061e2ced", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277953, "uuid": "11101b32-351f-4629-8a87-6b894f5d159e", "comment": "Malware payload", "value": "6e95e12d656e97c04c460d2918acdafde3bdb5a82cd12a207f48b1d5eb60da1c", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277953, "uuid": "4d69d610-b924-470e-96db-3e0f470445d2", "comment": "Malware payload", "value": "7dea2e981f41b331095a14b9c9e0c492281c3da7", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277953, "uuid": "260987d2-2a77-43db-a56d-23bed5bda94b", "comment": "Malware payload", "value": "351eb153d0df8c209531c1becda2c1a4bc5ee25be9a95877ca39405f4b64b84bdabaacb3092b2a12999ef380da5f7dae", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277953, "uuid": "af238c32-8805-45f0-9b0f-af0cba17f0f1", "value": "T17DD533BDB1DD28BE82E8B772B7EFD9243016A58D602183906DB391CE1C17131D9E9E1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277953, "uuid": "7d48710d-ccb3-468a-bbbb-b7fd2ae0a6bb", "value": "49152:tT0+oOBiXLUNaRHKmjsbS21i2F/ecE+0n9aFctnpbbTruN3MKQexlwLE5Ig+M4hk:tos909Qg6ecEZHyEexmLaI9MYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277953, "uuid": "2ea4aab6-7fcd-4fa0-add3-f23f32f9f309", "value": 2785280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277953, "uuid": "a45a192c-0848-486e-a9a2-1abb15f6b58c", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277953, "uuid": "81b61a78-8f03-4d9d-bc53-0a6abf32d737", "value": "6e95e12d656e97c04c460d2918acdafde3bdb5a82cd12a207f48b1d5eb60da1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66bf13ca-b5bb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649257702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257702, "uuid": "32e3b8e4-05db-441b-a259-098076add75b", "comment": "Malware payload", "value": "9cc1b098591b916e0362cf90736a411e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257702, "uuid": "ff30c711-0aea-440a-ad8f-68c59a71f06f", "comment": "Malware payload", "value": "6e9bb38b6212b11ad5cb903328e67c6798ee6a51081989ca21bd150bd43c536b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257702, "uuid": "9dc777e5-5153-4f5e-a52c-534c8c4b6dd4", "comment": "Malware payload", "value": "3a47fe68c502f3371d8dd608e116bcbedf81c286", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257702, "uuid": "57ce9543-6cda-42b8-ba29-5ae1a46b8a30", "comment": "Malware payload", "value": "f308c32fdb207e9d048af08999f3e4778c0b83f77fb5c3b482ac9dccb29385da8a891d08ea7793ea4b6880f78fa65962", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257702, "uuid": "3c78601c-b040-457f-8cc4-90e835975483", "value": "T1A00612ACA1543628C41AC4309533BD09F2B5D44E0FE5CA7AB3EFA7C06BB7961D606F19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257702, "uuid": "04ebfa09-d487-4618-8a4c-0f2a45c726cf", "value": "bb46f1abb2c1ede95f964a725f9d1284", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257702, "uuid": "2c249afe-7106-425d-a60b-c69b1389fdf9", "value": "98304:5ve37yToQpOzhr/hxucqYPSiyNyOdavtA:pkb+Oz9hxuZYqHNfdavtA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257702, "uuid": "fc403d7b-c587-49f5-99f3-7c2a79b1ab6e", "value": 3854336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257702, "uuid": "cfa58c48-8bef-4eee-bcb9-0ca318ec2479", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257702, "uuid": "dfed825a-8926-4bd1-ae9f-f7a7e4201646", "value": "9cc1b098591b916e0362cf90736a411e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffca2308-b5ce-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649266120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649266120, "uuid": "223c9c64-c086-44b3-8f55-dc1087e14373", "comment": "Malware payload (Formbook)", "value": "f64091afa6b55d4499ac72fa717ed882", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649266120, "uuid": "fee9ce67-4b4e-4a5f-8315-d291a206e046", "comment": "Malware payload (Formbook)", "value": "6ef2ea041f80bf832a51dcd24a4b42a16827176e7c677d479055de3c994793e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649266120, "uuid": "cb86ea67-0dd0-43d4-a09f-baeb0e4d6c5e", "comment": "Malware payload (Formbook)", "value": "4a0081401f983af833ce16ee99f0e49f4c729238", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649266120, "uuid": "c6fa75e2-6772-446d-95ca-624d07fc918f", "comment": "Malware payload (Formbook)", "value": "73f480c445a675c12351b720962eb456ffe9ab772d2f5e574aa704e7cd5a5fd4c46cb54a1d0bcdece18109f25abd9a00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649266120, "uuid": "9306af87-229d-454a-ad80-64181a4271b9", "value": "T164540160A798A060C4524E70D52B1AF349AB1E2310E9295FABCC3F3D7531D64EF4DBB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649266120, "uuid": "146272ec-6dcc-4d97-a155-a10bb500379b", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649266120, "uuid": "561802c4-8a6d-4def-a05b-e08ca4150fea", "value": "6144:ONeZ3uCZW5zRV6cozJQla1hIhJ47U2clxvZQUS:ON0uKWxH6blQlYhEJ47M/vZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649266120, "uuid": "e72775c2-c1ed-4bab-b603-199e691c9d05", "value": 281173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649266120, "uuid": "1ff3a9d4-36b4-42ca-b19d-d41d34cd8a91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649266120, "uuid": "b74c022d-93d1-4dbf-9a56-0ea58dfb78a9", "value": "IRQ2107799_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "682f3f05-b5c1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649260282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260282, "uuid": "81aad41c-ad46-45de-9652-7f2266adeba2", "comment": "Malware payload (Formbook)", "value": "cad1372bec0494e2a02dfc24ad3a2581", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260282, "uuid": "f2a0e12e-307e-46e8-b2ff-9318f5b284a7", "comment": "Malware payload (Formbook)", "value": "701f59778fe938ff06ceff39c9c957a7479e1db559d2996adefe8e09edd46d71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260282, "uuid": "e8ff00d7-446c-451e-aa09-39e479349809", "comment": "Malware payload (Formbook)", "value": "affc5b3a8934ec9eb8859a9cc210d20fee1d71cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260282, "uuid": "cd1d17da-df90-4c85-bdb6-71a059b1298e", "comment": "Malware payload (Formbook)", "value": "cf67da95cc4974e963af6cdedd7333ce5fbe531764503e9aa6447d390a30f049d529a6ca30df7514763d7f479cabbc7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260282, "uuid": "ea1622eb-1472-4c06-bd51-f323505e3d81", "value": "T1A4341205175AC263C2531B335DBB0E673BA9981A0462CB0BBB31E3EE76B5612D93F315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260282, "uuid": "2a5e88e3-7da0-47d7-a82b-a848cfa6c7ba", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260282, "uuid": "447ab44b-cb77-4495-868d-070617914ae7", "value": "6144:HNeZmR+qORNf7VU0okyiiOcCC1svUNo1bxh:HNlX29+0ogcCcNAbxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649260282, "uuid": "75f309b0-5d3d-4238-a83f-097e1809074d", "value": 249275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649260282, "uuid": "969dbd4f-05ce-4c26-a50e-d0dfeba45e71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260282, "uuid": "91c37d07-6c9d-4b68-9120-d6ed360d4720", "value": "SIPARIS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fcfe98c-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277958, "uuid": "3669c174-d87a-49a2-9d33-63f211fc3dba", "comment": "Malware payload", "value": "5fda5766233f99a04a2467e854693611", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277958, "uuid": "898f4e4c-1026-4e6d-9216-92ff116a88b4", "comment": "Malware payload", "value": "7026b6632cda4c5e615b2eb877fbd76e36cbdf4aa567580903cca0a91b414d54", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277958, "uuid": "8f8a435b-4a5f-40b9-924f-4248c83b9b4c", "comment": "Malware payload", "value": "9bcf0d160fd376fb52f0d215bd405139a9d5a35d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277958, "uuid": "5edbbc6f-def8-4623-9171-a0c1630d9a8a", "comment": "Malware payload", "value": "2ec86532ea993889424993c903e7d65d407e3ac8b74ddab2dcf73bc0dfdd208630e73bd5ba0a5e0b2d0b18c7c6359e42", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277958, "uuid": "1fca0cd5-7e8a-4171-b9d5-022c9005eb1d", "value": "T1B1A1F750112C1AB07246697ED26FFA52B80ECC1B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277958, "uuid": "4fb00fcf-4391-4568-bd44-89081a812ac2", "value": "96:tRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:tRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277958, "uuid": "32552ea6-f92d-4f18-8e06-b386f4a2e971", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277958, "uuid": "c4f153c0-2330-4145-a217-0dee97fd0713", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277958, "uuid": "42eef285-ae8f-4069-b027-e6b640627bc3", "value": "7026b6632cda4c5e615b2eb877fbd76e36cbdf4aa567580903cca0a91b414d54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904d2766-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277958, "uuid": "af60ea4e-4812-4c46-8a86-7d43a95178e1", "comment": "Malware payload", "value": "80ea3764716b9cae84214fbfaefd200c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277958, "uuid": "1c5436b3-d5cf-4c8d-ac6a-518b17ac9383", "comment": "Malware payload", "value": "7028bc8ea0dcdb93344da190453215d8b8b52cc1c2c38c7959ff46e058a3cffb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277958, "uuid": "fc1c8ad5-5c3c-4c10-b1fd-4d81336340ea", "comment": "Malware payload", "value": "b0da147f2ce5560d928c2037604a5441780e03d9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277958, "uuid": "991c6b97-5870-43bd-8ef7-b43243dedb8a", "comment": "Malware payload", "value": "935bca934dd9f58424c18520547f8d3be56ac6d23c07fbf8194f64dc3d9d15c33e310adac4d07d8e9ad2f10f6b1b1ab5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277958, "uuid": "d0202d93-fc1b-4721-8bf5-87ff4699aeee", "value": "T13EA1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277958, "uuid": "e303ee27-ceb4-4de5-b591-3b27d52740b8", "value": "96:qRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:qRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277958, "uuid": "07d4dc25-4965-4e25-a434-b72140791fab", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277958, "uuid": "afd74917-0fd4-44d2-afbd-736848e28321", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277958, "uuid": "3bafafcd-5f5a-4d0e-8617-ea74f332e7de", "value": "7028bc8ea0dcdb93344da190453215d8b8b52cc1c2c38c7959ff46e058a3cffb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c6a075-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277959, "uuid": "318b4739-bc43-4f89-8213-235e07738e60", "comment": "Malware payload", "value": "52e0b0a2afcb9a141805a8a711858c77", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277959, "uuid": "6886195f-ab9e-42a7-8f17-deb30c5870da", "comment": "Malware payload", "value": "703b1ff871bf31c42340322b62c5ef31d9712376f7f4ef28444fbd826318e95d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277959, "uuid": "ea2d9f64-61c8-4bdb-8049-cb907958522d", "comment": "Malware payload", "value": "8ca5648484ba8a40559af904ab213d86e7da5d2f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277959, "uuid": "cf32a515-c77e-4fb2-8da2-c0a6d5dcee65", "comment": "Malware payload", "value": "e737ae6de454ea4c0efabf20f7f66768d4ab73e8ee9d8fe311d79c02d0d737d5e6e569aa3986d0c2d4e02d1ef0441b59", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277959, "uuid": "69a0c4a3-0056-4bf3-ba40-f955962e3117", "value": "T198A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277959, "uuid": "faf3cb84-915e-43f9-84ae-71b7f9de4bc6", "value": "96:eRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:eRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277959, "uuid": "52046c2b-4acd-4559-abd6-5b50e53dbe32", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277959, "uuid": "438559b6-e184-4180-a598-c80a2005c40b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277959, "uuid": "969d7536-d200-4173-87cf-738eee6abb22", "value": "703b1ff871bf31c42340322b62c5ef31d9712376f7f4ef28444fbd826318e95d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "916a6d2b-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649277960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277960, "uuid": "787f234b-3db5-45f8-946a-dbcfccee46fc", "comment": "Malware payload (Mirai)", "value": "5672b20db3d30fb70b3e379687139e19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277960, "uuid": "fde83085-f1fa-4f42-ba82-bad460ff9f6a", "comment": "Malware payload (Mirai)", "value": "70d204bf1e149c8a323f61b06d569b2edbcba8bf82cc9cb91c92647e3b7d98a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277960, "uuid": "b750c4bf-d30d-44a0-a267-3507e148543d", "comment": "Malware payload (Mirai)", "value": "d19f530b8286c3722e8228bed50fbf7cbfeb773d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277960, "uuid": "9cf8d94d-cd62-41dd-bb4f-c315e38fa35f", "comment": "Malware payload (Mirai)", "value": "240f6c773b91cfdfcc7bc27a465e41050313f7eb28379523e7aa86ee69c7a638c87e8e2e33eaf99667e692bf3db7045e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277960, "uuid": "c07a8589-31a2-4dbe-9c30-577682462399", "value": "T113B3821E2E218F6DF76C833547B74F35F69863D626E1C684E15CE6011E6024EB81FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277960, "uuid": "fdf11fd1-02f0-4b25-8fbf-4e0f567294f9", "value": "3072:RDKS2SkPhu4oNi9B1WS0GWcUcjMwbZn43T:RDKS2S+hmil0pwR4j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277960, "uuid": "dbdcd292-c591-4d85-93c0-1c801b42b67b", "value": 109380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277960, "uuid": "1b73877f-22d2-4cf0-b5b7-4cc27f355e98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277960, "uuid": "05f43993-805d-4f17-b334-e19e1f3c8aef", "value": "70d204bf1e149c8a323f61b06d569b2edbcba8bf82cc9cb91c92647e3b7d98a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f7f400-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277961, "uuid": "04a9f376-89e0-4214-801d-12209ff82651", "comment": "Malware payload", "value": "d6df4a8b53e5b3034a0ab9dbf7e98586", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277961, "uuid": "c77856ed-613d-410a-8d75-8106e5e71529", "comment": "Malware payload", "value": "714f602d9eee81ed6c610308f49ada175fa7b9bfb5d5969ec1bcdeefbcc9067d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277961, "uuid": "d69ab445-d8ac-4d9c-b8c8-e8b4176576b2", "comment": "Malware payload", "value": "8832a1c3d1c261a6933ced0625f5f203a8f17429", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277961, "uuid": "1d394afb-1614-4060-a1ae-7a191a9486ec", "comment": "Malware payload", "value": "db5abe6d55a0f188ab9959efab8b7afaddf08771d7bb868bad5dd70b46cc1d7f26a914a923b5badccea7826951c64261", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277961, "uuid": "2abf7158-e3ce-4216-8f70-dbccf19a6deb", "value": "T13C416285B30049B1BFE25F6B72B58448F0D0B0A35ED5DA01D8EC74FA856DF483870A6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277961, "uuid": "58432e76-c6c5-4655-bb2b-4a9c69f1c2aa", "value": "24:vWRzOSW6PaIOSWxTdxkaUoOSWTmoOSW47OSWTdjOSWGzOSW6VOSWrXOSWFgVOl:vGR3Rg1R5oRZRsRvRbRqRne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277961, "uuid": "ef6cf3a3-9b75-43a7-8c98-94c98cf0b58e", "value": 1933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277961, "uuid": "c4f28835-5720-4afc-96c5-245d327524d5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277961, "uuid": "4aad13f7-61a9-43ad-8770-a513641f5728", "value": "714f602d9eee81ed6c610308f49ada175fa7b9bfb5d5969ec1bcdeefbcc9067d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9273a930-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277962, "uuid": "97e9446e-bd42-4be8-90d3-fb858d51455f", "comment": "Malware payload", "value": "c2965146a29fd52a27ed84d44eba257c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277962, "uuid": "baa0157d-8e0c-4ef4-878a-e930a0e394a4", "comment": "Malware payload", "value": "71659094e6624cb10e4ba299b35f1e7222055100067051166bed90e806d38ce7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277962, "uuid": "b4b7226a-ed1d-465c-8e54-3f97c9313bc1", "comment": "Malware payload", "value": "839220eba6404a806e5f4490ddbe253bda66b796", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277962, "uuid": "d85a118b-b9ae-4751-9747-451c888b26fa", "comment": "Malware payload", "value": "4e3f7dee1861cefa11ce8abfb90d1f1dd6398213782cad881057303623a9ac4e930dbf60589f16b2c1dbe729930a84ec", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277962, "uuid": "1b5edcd5-f3cd-49d1-8ea6-23982507b1e4", "value": "T1C7A1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277962, "uuid": "e781668b-8d96-41eb-ade3-8caea430e340", "value": "96:mRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:mRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277962, "uuid": "4fbc7d75-d4df-4eb5-ad75-d761db976786", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277962, "uuid": "42db0b09-846b-4440-8ccf-b3ed4af3418d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277962, "uuid": "039a1e23-7f41-4beb-931f-1ddbc95f230f", "value": "71659094e6624cb10e4ba299b35f1e7222055100067051166bed90e806d38ce7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b92d297a-b569-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649222622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222622, "uuid": "0257aded-910f-482d-8cc9-0ee8db308d07", "comment": "Malware payload (Loki)", "value": "a536c9f46932de25edec9757e39594dc", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222622, "uuid": "65b7df92-02a2-4bf0-8574-085256326bbc", "comment": "Malware payload (Loki)", "value": "71d576a15a8553d5ed484e137b16f9871bd47580c6c7db5255c45784da0847c3", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222622, "uuid": "f0565c44-792b-4173-905c-d7a5ab7b8f34", "comment": "Malware payload (Loki)", "value": "f4afbc7c1e1b5c05f3ca32716141eed14db773a7", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222622, "uuid": "8ba837e4-9b32-45a3-aa2a-2ad6213a5515", "comment": "Malware payload (Loki)", "value": "370411116883c459a4f2ec65b1d11776e53fcc3ffcf3f20fd9c9bb578eb5869b823aaef37a6295521b91fbd8d2c25b4e", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222622, "uuid": "b91471ca-9731-4287-b5dc-64038c21e1e3", "value": "T1381412A67AD09B84F6DB333A149B211D621EDEDC6A009FCF94703DCC2E786D0AC55931", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222622, "uuid": "2e2ddbd7-be2a-4445-889e-aed6565b0c9d", "value": "3072:+W6g12NOJ2DBv566D/fBJNGSZMIDQfs1cnxxwenoIWWYS8AXp2tfjT31YI88QFnc:cY2NpOOHxGSlQ02/DnoTWY1A52ZT35Gc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649222622, "uuid": "5b2f6117-442b-4b5b-bc6f-66f738b5a654", "value": 191928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649222622, "uuid": "748eba93-5030-4ac2-8377-54675845425a", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222622, "uuid": "14cc8064-5a99-4454-b40a-d01dcb4d329b", "value": "M-VDT83994836627_INV22.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92edf8e8-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277963, "uuid": "da0bb42b-bcc8-4e35-bcc2-e30bc10cd1f5", "comment": "Malware payload", "value": "27d62ca8f2e7257916935837505ac0a6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277963, "uuid": "5f51ac7f-bfbf-40f5-8684-dae6b00b8812", "comment": "Malware payload", "value": "721c3f90d281a6ab1f0b3abe11860b48f93a47ece83493187a4b28730d8bcda1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277963, "uuid": "3fd0ae7b-e0b1-4862-9873-4f3c8ffc7c1f", "comment": "Malware payload", "value": "2d6081feff04e2b8f85a70725eed732a3eb3ab48", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277963, "uuid": "05bff07f-5186-44b9-825b-61cef34af5f4", "comment": "Malware payload", "value": "3f13c969b246cab64a6d6981653f529814b05b80c9e1ace41cc7db35d23a988f4f3281bd57c1b6992c825d9b789ac856", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277963, "uuid": "58613706-dff0-402f-bb43-e5c56327465e", "value": "T1F7A1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277963, "uuid": "1513785c-8b38-4939-8cfd-cb9a70b38c2e", "value": "96:EeRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:EeRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277963, "uuid": "b8776c36-2969-4622-b78c-ad9635e6913a", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277963, "uuid": "682187d2-a9eb-4d26-93f1-c6672a0b2d58", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277963, "uuid": "a54029f7-ead2-4e15-952b-897b40945610", "value": "721c3f90d281a6ab1f0b3abe11860b48f93a47ece83493187a4b28730d8bcda1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0dc7f2-b5eb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278463, "uuid": "dcc5ebef-c1d0-45ff-8d1d-651301d64e0f", "comment": "Malware payload", "value": "8837aa300bd5c17adc74c69897b2377d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278463, "uuid": "2f64a55b-7d5b-4c93-b87c-d82698643afb", "comment": "Malware payload", "value": "721c6cd41fa38ac1ac3ef3c20f00d942dbf7299ac4ab0f0ad7325a4c006824c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278463, "uuid": "a69c282d-aa9e-4e7d-b5c4-f4cee17bbd30", "comment": "Malware payload", "value": "db945ae40c1df301729bfee7df116eae85c87725", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278463, "uuid": "f1ca558a-fb93-4263-a6c5-3cb3ff99c26d", "comment": "Malware payload", "value": "964b730edbfe2ba6d725d011431a486bc5c234c9d1b4d86d40b59c9b7deeee20eecfa1a2fcbac11c6c8edf5aab57c319", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278463, "uuid": "72fc5eb1-48ce-48c9-8e85-2d30511f458d", "value": "T153455A456FAE1B83CE42AE70E0E7E13107322D185A7901AEBDE47DE77834B18DA9445F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278463, "uuid": "312648df-1a37-4d97-8016-b338dec9cb27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278463, "uuid": "28d087df-f863-4d72-8b46-b09adda94665", "value": "24576:wvRs7KFMFDBH3QdgjXouK4iUrz0GifjN5TI:wvq7UMgCj0lUrz6fB5TI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278463, "uuid": "0fc0dad1-a39f-4416-b58b-801fe3ff4ca8", "value": 1229312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278463, "uuid": "11bb78dc-51da-4ffc-a69b-6f16f19c0d49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278463, "uuid": "f84dcbd4-4189-4c2a-b2f0-50f7cad5664d", "value": "8837aa300bd5c17adc74c69897b2377d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d4c30ea-b5bc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649258062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258062, "uuid": "95c02e5d-1e07-4f08-827c-1619ee53b243", "comment": "Malware payload (Loki)", "value": "3448dbc149b2276df74903a0d5d798e0", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258062, "uuid": "9accdec4-7aaa-4734-8a3c-b59eb3b2fa04", "comment": "Malware payload (Loki)", "value": "728347992eac6acdedc12948a106681ce6eb524767161db249ead44c1b0c0c18", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258062, "uuid": "bfdb9c5c-fe38-4abe-9f8c-9fceabdb5a88", "comment": "Malware payload (Loki)", "value": "6f764d140558d58339c303421cfba89682f49b84", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258062, "uuid": "37cbe054-d0d5-4d3f-9e32-bd50404e888f", "comment": "Malware payload (Loki)", "value": "52254d2ca111036670abf1c69a16eaaeef3dd605948760ba1b1cf5d70c14ab24e8e308cf3433d2abc5fa2beacefb3fd5", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258062, "uuid": "293ce042-8b26-474b-b8ee-fa2d8b9e317e", "value": "T1B814128F72629385F2CEB7B6B5184442A814BD04CA9C7E0E883DF71A5C7C79F298416F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258062, "uuid": "af15a600-1513-4627-bc1f-2d1d46601845", "value": "3072:bjouE1Hm0bLF/N2FzZznpVDe9XMqdRGNoskjJVJwTcNWcBXh/IaXEKvR:Aux0iPq9dD4tOJbNVXFXp5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649258062, "uuid": "42a07903-24a5-428b-8879-8333a19ad604", "value": 192264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649258062, "uuid": "d4d9d8ca-dbd0-46b1-9047-707e38d2afde", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258062, "uuid": "ceecb03a-00b3-4113-813a-4d4ba0db9919", "value": "AP000052_ARM RE_INV-0249.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9385c91d-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277964, "uuid": "dcf1fd33-a92f-4fa4-9afd-382c2fd6c488", "comment": "Malware payload", "value": "01b68f558bf3537d0fe7ab2576c57bd5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277964, "uuid": "7672d4f0-e1fb-421e-bd25-7522620d6474", "comment": "Malware payload", "value": "72d7fb0dfb9a96c93b9f59b1cdd592fd5e051e4ef5053617e0dffa68fa42c6ca", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277964, "uuid": "2069edd3-15e6-4aa5-b6ad-f84ae6a0f428", "comment": "Malware payload", "value": "27ca5f410facfb385e4989761e0ec43a0fbe0646", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277964, "uuid": "ce15b59e-2b92-4117-bd45-02dfd55013ba", "comment": "Malware payload", "value": "8217b89420dbd0bb558527971ae8e1043d6b012a7ee758c9a42b2cb2efb03e22ea822f52864ddb8a2c5ef32708afa2a4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277964, "uuid": "31fddb56-2a4a-4f7e-b977-f300e39d444d", "value": "T1823196CA71B14E717CA6AE67366AC85470D5E5C725CE6F992CDC3CE9488EE04B002A93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277964, "uuid": "768fb9d5-4365-4d3e-b90d-6f7f5687425e", "value": "12:q0FmV0Fk0Fcc43fX0FheekX0F2+k0FMX0F61FZ0FjEX0Fuh0FGV8po0FRO0Fe:vm+tcc4khas1Ms6+jEsuC/Jde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277964, "uuid": "810805e8-9fa8-498a-bee3-3290ad2c9099", "value": 1540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277964, "uuid": "a31143f7-8048-4f9b-8ef2-02b2c9895c86", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277964, "uuid": "f70f9e34-28f9-4a03-a105-5dbd3799d4ec", "value": "72d7fb0dfb9a96c93b9f59b1cdd592fd5e051e4ef5053617e0dffa68fa42c6ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a5d9cd-b5c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649260088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260088, "uuid": "0b0f0cb4-f3d0-4d38-a7a2-c9d439191ac2", "comment": "Malware payload (AgentTesla)", "value": "86884abe2a97d3d0fd5f72a621659cd5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260088, "uuid": "bcf651b8-cbfc-411b-8cb3-f3d0ee0394ab", "comment": "Malware payload (AgentTesla)", "value": "72f31458925d45d9de0f448b159d683de009387ee36852a659a2f30d04b7216c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260088, "uuid": "af73da29-b198-47e8-ac90-82f389d2fd87", "comment": "Malware payload (AgentTesla)", "value": "dc79e8b9fba25a4bac676f6ca58c3217c955cd5e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260088, "uuid": "d10ce2dd-313f-467e-b11c-4604580392e8", "comment": "Malware payload (AgentTesla)", "value": "940a1fdaf3dfb3caaf684cffddf0f6dab7ff9502daaad09e76036e49b52c4fc9e53d8040b1a4a742e060ba0fc1e09fd4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260088, "uuid": "43d82789-7313-42d6-ad72-116ba9ebbb4e", "value": "T173925C19A395CB73D4BA4F329DF70B80A774D3A85A37870EA489123FCB233490A57761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260088, "uuid": "419691da-8a75-4a0e-ba56-ed92cd61ded6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260088, "uuid": "0df7fa8b-f75b-4504-bc6e-dc3facacbf13", "value": "384:o1n89IBv3+6wi71gVSUaepk0OOyd3zDzY/kY6:Kn8yJySUaq1LyJPzIkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649260088, "uuid": "ee8a52b8-8243-4207-86f8-5d7b3139ff58", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649260088, "uuid": "ecc4cce6-4168-4bef-b1d8-4c76d19fe440", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260088, "uuid": "add0ab4d-7073-4df0-87a6-3ad526a6acf2", "value": "MT101 Swift_ Remittance Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f566ca3-b5bc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649258119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258119, "uuid": "20632dfb-cf70-4de9-8377-61287d5d94d6", "comment": "Malware payload", "value": "2f0e628229d026b23476dcd0a9492aa6", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258119, "uuid": "d1b2fbe8-d2c1-428e-82a6-8fd1d0d83989", "comment": "Malware payload", "value": "731395531183c3613f5a60ee3c45be5138fbcb2bfb8f9d1564f2f5bcf0084168", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258119, "uuid": "c66c81cd-7a44-4f75-9845-883a3bc64f28", "comment": "Malware payload", "value": "df076aded4b0e76422332537d42945c6ae730b7e", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258119, "uuid": "a46b6d32-6f15-41c5-9cb3-dba7d3d01fa7", "comment": "Malware payload", "value": "69269bc807d25ea1b00575c2bf64145a4d1ec0aa21fee254265ca7727bba34d94605f98778c07782b03a6e51972554e7", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258119, "uuid": "1e64dd80-a517-40e4-95a1-da6b47fcdaed", "value": "T1A414125436FA483DF46E77BAD760A20FA89DED3E1C10F4AFA579788198714878CE8017", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258119, "uuid": "72bd2ff5-74fc-4d67-bdf5-ae78f203c15a", "value": "3072:6hkhvqfnlSbcqIMjOOS+xAT+qfbUCyt8X/ujsMLWcRjr2f91abYKMiKOY:dhyduccjKnJUpt8vEsAWrfwv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649258119, "uuid": "904f695a-0640-42a6-88dc-67ae7a8b909a", "value": 192568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649258119, "uuid": "c40ea9cd-7cd0-4db8-a836-5c1293c28818", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258119, "uuid": "e7517cb0-c909-41b8-aa96-e687feb05a07", "value": "Order 21001.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "941a9812-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277965, "uuid": "2e0f452f-3078-4aa6-aeba-f179c0e90793", "comment": "Malware payload", "value": "ff73606f7c195aa6146229fff9c14314", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277965, "uuid": "1a0fbde9-b93e-496e-821a-6837556459eb", "comment": "Malware payload", "value": "7350e54ec1aed6c8438f266e72696ee57ae435cd0f51f79acbebd69cb5cab4e9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277965, "uuid": "fb2aa27e-db70-4780-ba7d-7488d764123a", "comment": "Malware payload", "value": "a1d45ed41ff89cf0029ecaa34f02dd12bd389f2c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277965, "uuid": "ecfd7017-6c15-4bfa-bce7-aa74948618cf", "comment": "Malware payload", "value": "d5ba1fd47e6220b9c4de1f76117be3071ac6365239d24004a95100ce606d8ca6fc291defe194c444b57e12bbdac8b970", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277965, "uuid": "7d6670da-4d68-4684-9feb-91053e283c54", "value": "T1CE416586B31144B17FFA5E9771B48814B4CCA0767EC89E05D4ECB4E9C86CF48746B653", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277965, "uuid": "78762375-fa3b-451a-ac65-3332e3804e7b", "value": "24:vMOSzaIOSRTikaUoOShoOSJOSz8OSDOSpOSKOSlLOl:vMR7R1ERhoRJRIRDRpRKRte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277965, "uuid": "d7f49dc5-d28a-439d-bfb7-088836cfa266", "value": 1933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277965, "uuid": "0a4b85af-cf59-4c22-875f-5d996c80999d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277965, "uuid": "297360f4-b3b6-4167-874f-c37b836138bf", "value": "7350e54ec1aed6c8438f266e72696ee57ae435cd0f51f79acbebd69cb5cab4e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd534c6a-b549-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649208885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649208885, "uuid": "9921240c-6e45-44ef-ba6e-24683c42a960", "comment": "Malware payload (Heodo)", "value": "bca99e0a876decec0bb69aa1192a1abd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649208885, "uuid": "94efe3cf-fcb1-43b7-bd22-66897d627830", "comment": "Malware payload (Heodo)", "value": "74489bbbea156939a150d7d5d0e2c3497972a019ce674e7747781776f6f64e53", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649208885, "uuid": "94fd7009-24a5-440c-9520-e47ced78a821", "comment": "Malware payload (Heodo)", "value": "ac317f5518df824c388991d9683720aa19b9db01", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649208885, "uuid": "7155174d-42ed-49bc-8b8d-8eb30f3d602a", "comment": "Malware payload (Heodo)", "value": "98db6c414e16cd7c7b78b795bdbe08959fa092df42ebce8e077cba5414d16d709564d46a6da3cff94877d9f0eb972fea", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649208885, "uuid": "43477486-b71c-4dbc-a181-d8d7b856e5eb", "value": "T1F964977D0FAE00A2CC621770146C0FD991ABCA25BB1255FF64892E2E2EB57D74879F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649208885, "uuid": "0d31439b-8386-41f3-9426-6ed206c9d468", "value": "3072:rA5pcWyfJCALTQMLOuw80g4SY0sjHyKilL/:iKfJCALkjp1g4SbsLyKil7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649208885, "uuid": "3dc77c49-8cdb-4090-8b65-0c9f42338e93", "value": 335599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649208885, "uuid": "8e85e21b-9ce8-4e7d-b443-751344df48f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649208885, "uuid": "6f564833-8035-4b0a-b96e-9128c5d0ffe1", "value": "emotet_exe_e5_74489bbbea156939a150d7d5d0e2c3497972a019ce674e7747781776f6f64e53_2022-04-06__013441.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0025ca86-b56d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649224030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224030, "uuid": "fbf3c603-c3bb-4bdc-947a-fa4451cdca8b", "comment": "Malware payload (Formbook)", "value": "c2b9e04a6bfdaf8e365cdba301869817", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224030, "uuid": "28931259-5855-4848-a383-e8e6d9f240f7", "comment": "Malware payload (Formbook)", "value": "74629548435c5209dc523d8e9ae8de11527f646205937d7f645d7db4fe8dfbc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224030, "uuid": "137a24d2-889f-4943-8583-0ff2523439d8", "comment": "Malware payload (Formbook)", "value": "0237bbee71623518bda4bdb0380dae47efe4eef6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224030, "uuid": "41a2e577-c63d-4438-b687-9beeebffce6a", "comment": "Malware payload (Formbook)", "value": "54cf3355b8f7243122f3c90316958c99469b9307efa752d835c26a960915324ef179b2f4983440c46f67cc5225cbd0ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224030, "uuid": "4e50c604-24d5-439a-a5b0-2f030966e6b1", "value": "T19C3412A163F0C4B7D8B20A761DBF5A9BCFF79A041668829F27509F483E297C1491F352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224030, "uuid": "7d212236-1f0e-4436-9120-d600271a6403", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224030, "uuid": "e065d6ad-5eff-42cd-965f-423fd582882b", "value": "6144:HNeZmV5WGinEL4T3ERPkLX4qBvqOqki4QENw:HNlV5mnsm3ER85Bh3VNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649224030, "uuid": "12ed5f3b-5e90-4c77-a90c-c350a972b9fe", "value": 249404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649224030, "uuid": "5e5d5d52-f9d2-469f-a5ee-2af046f9a98c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224030, "uuid": "0d2febab-1a6f-4a91-ac4d-73f7299accea", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de8b3956-b5b9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649257044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257044, "uuid": "23e49743-56f0-41ef-8640-3a53956c52c6", "comment": "Malware payload (Formbook)", "value": "fdc2c7f825bbaf099a659ae229298d07", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257044, "uuid": "d4f941f5-d3bc-42e5-9340-376ee485f60e", "comment": "Malware payload (Formbook)", "value": "746ab51bb5f1563cd1c77cd6d7605fb82f076b5572f0a99439eee3b5d28852c1", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257044, "uuid": "3d9a47b7-817e-4a56-9fae-dcce7188ce9d", "comment": "Malware payload (Formbook)", "value": "fb06d05f25114b64b80e588a8bb12ef5699e4806", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257044, "uuid": "f8c178d6-ad00-4953-b4f9-dd34122ae8af", "comment": "Malware payload (Formbook)", "value": "c2acd692f4064a2aea76b6d0d1b966794d130d087828f978347b79e813968bd473bf06d739736e215721bcf20a3c8287", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257044, "uuid": "a2baba08-4416-4687-a37f-ca255b1ea40a", "value": "T153A423A98489E778264130065A74FB497E15F0879792353F8CE9E3009B8BFECE6B40D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257044, "uuid": "485858ae-7474-46f9-81f8-6430a5a18111", "value": "12288:Q6ual1hQOzTVjGGagANuBZ5klO+vVJH42Iwp57Ih/:Q4hTVjGqmlvrZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257044, "uuid": "730d02b4-5e05-4619-88fd-53f7a217f9cd", "value": 474293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257044, "uuid": "ee34e31f-fbad-4a7d-b660-c8a1040b9137", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257044, "uuid": "d1dad232-1709-40b5-9006-c3b827c57de1", "value": "PART SHIPMENT- FEDEX - Cargo Arrival Notification Import Track No 270962529096 MR V fKUMAR.pdf.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "864daef0-b5b0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649253031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253031, "uuid": "c041a4ee-8a4e-4534-9990-5991e9a5e7ee", "comment": "Malware payload (Formbook)", "value": "17ecfc75f755a65b13246086ff0232a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253031, "uuid": "33accd31-da1c-452f-ad54-0104b5eecbf0", "comment": "Malware payload (Formbook)", "value": "74a111edcc9ae39fa1a4b49701910af684e921c4bacaf90f004f6ee874d33884", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253031, "uuid": "f37aedfd-c659-4ba8-a26d-6a18540bc82c", "comment": "Malware payload (Formbook)", "value": "2b441e939ec5a351ff59b161dec3de4ae3b10670", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253031, "uuid": "6434d037-2367-413b-b6c5-6ec5a2d59b51", "comment": "Malware payload (Formbook)", "value": "ec999cf06a4cafb62d91253264165ff512438bdccc11b26163d7271c985b793190aec92106a5411442429aeb40fda2b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253031, "uuid": "d4abd666-6e52-4336-886a-305f2a2f78a0", "value": "T18EC48C32F3FC6B4BD2BD91314438501976F5E9033624C99EBE9A11DA99F2F418720B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253031, "uuid": "aeac0019-38af-476a-9788-8b38579d448d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253031, "uuid": "c939598d-d56f-4d88-adc4-490c6da8d5ef", "value": "12288:aSDR5LxK2VUmkeVKbT9ubwSzyXqwAbELpH3G9nNJ3/7LUSI:3RmEjzYd4ELUNNJP7FI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649253031, "uuid": "90c22ba0-45d8-4f60-99e1-2285a07004a9", "value": 567296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649253031, "uuid": "f9ac5a1c-1b30-4b01-9049-f4c9679db5db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253031, "uuid": "957143e1-5c20-4a3f-962a-7fe82b8ec3a3", "value": "SHIPMENT NOTIFICATION #0036284639.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de794c39-b5c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649262628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262628, "uuid": "4564125a-306b-4745-b6ea-cd3ddb88f8d8", "comment": "Malware payload (Loki)", "value": "29b6f7f3043b17847283b694e6eecffc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262628, "uuid": "8477a2b7-08af-4e5b-ab29-749b227ab3b3", "comment": "Malware payload (Loki)", "value": "7500469c4541e998741549c72877eeda8d52ef698155cc5042eff21ed2bf8581", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262628, "uuid": "504f69b1-a00e-419c-a626-80ebfa781688", "comment": "Malware payload (Loki)", "value": "2dc63f5052eb2dbfd6c0c9192b92e1f53b32ccd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262628, "uuid": "c73797c5-6e60-411f-8fcd-9d21e59b7aaa", "comment": "Malware payload (Loki)", "value": "2375149bd59cd62f45549ea33bb7d2bcfca415a38cd19d2be946c6a298b0cfd1723c35e2f5a1fe5bc39c3a22a8c7e06b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262628, "uuid": "7a96febd-50b9-403d-864c-6d63866e38fa", "value": "T1B694120023F4532AE8BD47F7E53910D50772A92B68A2F79C8EC1B4EF5452354AB42BDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262628, "uuid": "8a2e6071-4479-4c3b-b6f9-71cca8005e14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262628, "uuid": "815553dd-26e9-4657-bc23-5966c317555d", "value": "12288:Dp6Hg67Dy5dVoUSrcLM0bK5FMtm7+RslS:gRiHi3cwvnWQ+6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262628, "uuid": "030e18a2-f55f-4eac-b73c-5441e7ddbaf4", "value": 410624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262628, "uuid": "fdcf3d05-ca8c-49df-ada0-d9925658a600", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262628, "uuid": "85a03e10-b567-48ed-b4dc-d5a53059da53", "value": "29b6f7f3043b17847283b694e6eecffc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86c2cd3-b5aa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1649250538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250538, "uuid": "26cef1b2-57b4-427f-91a2-df52b2fb9969", "comment": "Malware payload (Quakbot)", "value": "01a35155b27e3daaea2faf37f7d03261", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250538, "uuid": "ebae9568-3534-4396-97b6-51d58cd4c49f", "comment": "Malware payload (Quakbot)", "value": "754f7ccfe7f6453751317e3b1a753a9b6b5fce540f320919a035e9559e406497", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250538, "uuid": "93a56e83-7023-4409-8d8b-7b4433aa3084", "comment": "Malware payload (Quakbot)", "value": "be798ba62234fb89a2a11f34d9525042c750a771", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250538, "uuid": "183ec639-c467-476b-be6f-10386ed6571d", "comment": "Malware payload (Quakbot)", "value": "30f34592655c4d6106e913f22adeead07c8c70ae8d4e572a884c83c3c12fd27e062ec945ef6c06b44f54847a84daf088", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250538, "uuid": "f7b8f6c4-a249-4ab5-b4b7-907594f8f537", "value": "T11765AFBC75046CDAE66F06BBDE96ACDD13B6262299C794CD807577C309A3372EE02C05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250538, "uuid": "63ab7b5b-373c-494f-a129-79da8a254bb2", "value": "1538717eb64bec210d6f84c7331143bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250538, "uuid": "93967554-0901-4a90-8248-50b45b7ac874", "value": "24576:OY3YrrLEaF0tTHMjuX5PmnKUz3NL3BAYJWDJnh+idFsv3YgPmHF/U:OT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649250538, "uuid": "b5ab497c-8988-4bc2-bf11-3d5067032003", "value": 1427464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649250538, "uuid": "54f9ddd0-6f73-435b-81d8-ef7eee258221", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250538, "uuid": "6315d31e-da73-4a34-96ae-921bbbfdd6fa", "value": "7790983516.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7671974f-b5a1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649246562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246562, "uuid": "19970b4c-08a6-4f6d-940c-f4ca93752949", "comment": "Malware payload (Formbook)", "value": "8ba2925631a028c24e11ad40dd87a1b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246562, "uuid": "2cffd3f3-494b-4464-994c-350dbdbab3a0", "comment": "Malware payload (Formbook)", "value": "75563869f37196a473d163e40a4f393ba74b4c5feac4e178c83f670da5dd2762", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246562, "uuid": "c8936c66-50e0-4573-bc92-b3a13122a8ff", "comment": "Malware payload (Formbook)", "value": "05c6aa50be7bd358ad5127791b156618e5e7b25f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246562, "uuid": "3c6712a3-af43-431a-83c0-f64944730020", "comment": "Malware payload (Formbook)", "value": "acb51336c6f6e9125a9f0f8f4aead3c7e85311dfbd5289da8dac60c580283ba7d386295ab24e017c4c6ef97e85f10fbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246562, "uuid": "19298694-e94d-4ca5-966a-b0a10e271bd4", "value": "T12734121067A5D42BD9E367339D3A67672BF5FA032598878F4B602F817C396E1E20CB41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246562, "uuid": "141446a8-b64e-467e-86b5-86d7039993c3", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246562, "uuid": "bf3f0bb4-80f1-474b-9ce4-2144e603ecca", "value": "6144:HNeZmhMDxTrb3bML3oic6o2t+D1IxjuAIAFyA5hnU:HNlhMDJMrm+weF99nnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246562, "uuid": "be970f55-4206-4d86-b500-da7ddfd68bbd", "value": 244702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246562, "uuid": "e0bbcbad-ffba-4819-826c-460df92142bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246562, "uuid": "f5a20e72-8968-4a5a-b66b-7b41a5da9e5e", "value": "issu 06042022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94985203-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277966, "uuid": "3ad62318-5705-4a01-91f9-206e2265ff84", "comment": "Malware payload", "value": "a1d8ab243fb14ce3516ad5de1ad01db7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277966, "uuid": "441c8eb9-a3f2-469f-bd06-4523152ef171", "comment": "Malware payload", "value": "75704dbe14fae0de504a9226a7854a9a43faa32afaaa39226bdcbe9209f9d792", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277966, "uuid": "05d705d8-033c-4810-b1a8-801cc7afcff6", "comment": "Malware payload", "value": "ef496070052ff4f9fc7b190608cac7593f739870", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277966, "uuid": "97492760-23ef-4949-b93b-5de43c39de77", "comment": "Malware payload", "value": "62a30ad2c7974fa68c3e1f7c52f45ab0b22a7d74fb380f2467be193b78f0d96f8496a8910686306c3e97f9ccf944bfa9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277966, "uuid": "35f8c31e-58eb-4c3e-8625-17e2f2351431", "value": "T152A1F750112C1AB07246697AD26FFA52B80ECC1B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277966, "uuid": "06d6321d-7434-4d54-a2e6-b2c60c625592", "value": "96:ORYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ORJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277966, "uuid": "83c39518-90c0-4a4a-b29b-8bc5dfdccd98", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277966, "uuid": "fbf630aa-2308-486d-b6d0-951727430ea1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277966, "uuid": "9cd26979-c2ca-40b2-9a33-37a88514f0a3", "value": "75704dbe14fae0de504a9226a7854a9a43faa32afaaa39226bdcbe9209f9d792", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9512ad65-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277966, "uuid": "922309d0-e490-4165-8f57-100fdee07671", "comment": "Malware payload", "value": "1c0770e06bb1f411dc796e1eb60dad23", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277966, "uuid": "b2c5a083-17bf-4024-87c4-a57397def610", "comment": "Malware payload", "value": "75e547b0d0247b01bead28267c59b028bcb7b390b6f27ce77a77069ff8fb583a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277966, "uuid": "77b3dcf7-a958-4262-b2ca-6629d21eb4d8", "comment": "Malware payload", "value": "d79b7818687b3d5f4a44bb722df1a451bcf0a379", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277966, "uuid": "74bdafff-5af0-4b62-aa03-40e4e113ade3", "comment": "Malware payload", "value": "ba7193d041de35b9f3d136b1e815bcd9037d4ae015f73c105c21fdfe6ecec10a9fed0b1a11d5e170268cd3a24d45753f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277966, "uuid": "e8cf8e3a-7df6-4655-8bc3-efff69032774", "value": "T181A1E850112C1AB17246597AD26FFB52B50EC81B09777B358473A63C74F5DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277966, "uuid": "1f8b122d-d334-4fa6-a927-cb65246a4dad", "value": "96:4cRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:xRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277966, "uuid": "77810327-7a22-40bd-9871-0003aa60eae3", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277966, "uuid": "fe4fd2f3-f556-4a30-b69a-781e660c0719", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277966, "uuid": "ebe185b8-2a75-4362-8975-60d9be3cdd08", "value": "75e547b0d0247b01bead28267c59b028bcb7b390b6f27ce77a77069ff8fb583a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959c17fe-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277967, "uuid": "071611e3-1983-4a08-a6b6-65abb4aaf3fe", "comment": "Malware payload", "value": "5555f84647953fbc3f4a784c3a571a0c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277967, "uuid": "1a528ca3-cb5d-40d1-8704-9031393c7d01", "comment": "Malware payload", "value": "76913b41a39f3a70c164db5cad44367b4bd5fa41dfdbedba8cc4204fe96ba44e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277967, "uuid": "ecaa9436-9851-4079-8b1e-624d50af8ba8", "comment": "Malware payload", "value": "589ba67af326c17567a29c1d172a629b8a412694", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277967, "uuid": "6143726f-4262-4085-9f9d-bcbe9515273b", "comment": "Malware payload", "value": "1abdaa8371954716da23d603e6e835a606a77695c8a571376acc3f651be405de9cff194b3ec16f2eeeac36ce270a5633", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277967, "uuid": "69a5963f-618c-4513-bc37-1dcd36068764", "value": "T1A672F937F3E166FB4662FEA9617BBA0CE070D496BD2D6094A0784CBE7C61E451038B4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277967, "uuid": "8475fa90-f42c-4f08-b6b2-2a95bc82a207", "value": "192:aARXKRcd5zoVoOsKRoCEW1nWmHGLIK0xfJTr5hliVPPK7FzWt0Ja2tvLS0B:IRU5zoVoOsKbpW2GLEt5hoHK79/a2cw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277967, "uuid": "dd0c3267-d0bd-41e8-86f8-f5b9b3276dcb", "value": 16952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277967, "uuid": "c4e22300-2216-4e6b-94d6-4e1f6ea7f198", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277967, "uuid": "d8ad66fa-7fa1-4375-9066-3ad336d3eba4", "value": "76913b41a39f3a70c164db5cad44367b4bd5fa41dfdbedba8cc4204fe96ba44e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96bb0088-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277969, "uuid": "92edd80f-ce08-4287-8b1a-62984871bdaa", "comment": "Malware payload", "value": "a8a4a73fc0a8fc5b2a0a2af598cfd848", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277969, "uuid": "94673152-16a5-402c-bfe2-f55c2403e5e0", "comment": "Malware payload", "value": "7696cfd85d8ed4132c65528c5bba280542f79faf5cbf405de764265d1b482731", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277969, "uuid": "20554f20-25d3-418f-844c-a4c3c3467a5d", "comment": "Malware payload", "value": "66825d3bcabfe96934a3199faae32b2a0900e632", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277969, "uuid": "036d4fe9-1266-4aed-af2f-7c756c83e756", "comment": "Malware payload", "value": "597acec675efaf22f80678894332a032a60158a8831c901c9516f6e9df0fe58b58155a3871d01c65ccbc3afc408411ef", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277969, "uuid": "71fca03a-100d-4eb3-98f1-255a3e1a2a21", "value": "T11D314ECA32D21B716CA7DE7A776B4508B5A580EB58D79F1968DC38FC808EF48B041687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277969, "uuid": "14388012-b44d-4fa0-948a-0c9a740669fd", "value": "24:vWIiWVGeWGJWWwUfW/RfWgJAWN7XWTpWEiWeg9c4+B:vUne9EMfOfG++yd4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277969, "uuid": "9198ceca-00a4-4e49-b381-019055c4da12", "value": 1741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277969, "uuid": "1a4f1c0e-ba53-4c05-b4c5-f4c192d94c0b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277969, "uuid": "80dee35f-8910-46c8-a237-2005280903a0", "value": "7696cfd85d8ed4132c65528c5bba280542f79faf5cbf405de764265d1b482731", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973ae1b2-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277970, "uuid": "82228ff2-0677-42c7-acab-ca7bd32cfd57", "comment": "Malware payload", "value": "8e34f581133d46c4eb629c9cdd1c4277", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277970, "uuid": "4b28db13-eff2-490c-afa2-09d04bcec256", "comment": "Malware payload", "value": "7699152714f289777d25daff4ce706bca29932563989f88a229cdb20b6219eaf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277970, "uuid": "37a5514c-bfd3-4b4c-a247-9f3e46700f42", "comment": "Malware payload", "value": "33cdccf4f9a35de667705797d4008e79995df9bf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277970, "uuid": "d1a08f3e-c6b6-411c-b694-220491d7a9d4", "comment": "Malware payload", "value": "70efc2e931395569020821902880d3968506f77772846158f84f7628d1631545b13a97362ed66946af90a82dbeb71038", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277970, "uuid": "1073cd0a-3fec-425e-a055-4a971270796b", "value": "T124513D8570A128703E6294DF23251CD035C0D0A57C959FF92CF8F4B44AAEF9975A53EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277970, "uuid": "520985a5-1138-41ba-b120-83448947206c", "value": "24:cn8MhM4MSbMSMvn8LpoJee7HnPsn60nPNI2k0nF0nrEndZmowd0n8FUOurnr+Hnz:NObxh9LpoJeeLcELFUOu3+05JoX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277970, "uuid": "88ae451e-a848-4795-ba82-82035afcd2a8", "value": 2866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277970, "uuid": "45546199-f53d-4e91-87f1-86dbdfc0ca10", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277970, "uuid": "fabc53d9-2070-48ce-85cf-136d99f71036", "value": "7699152714f289777d25daff4ce706bca29932563989f88a229cdb20b6219eaf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "660bd51a-b5de-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649272734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649272734, "uuid": "61559554-25b9-4f3a-8a53-811bac4e9fd9", "comment": "Malware payload (RedLineStealer)", "value": "e236d86b634d4576f2f8b9743ca1872c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649272734, "uuid": "f4baa81a-6034-44b9-b932-ec8655822c73", "comment": "Malware payload (RedLineStealer)", "value": "76ac5f1a68ed41db9f67fab59f4a897b641dc2d4df592830c8f8de4707846f5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649272734, "uuid": "53d5b3cf-5aa5-4648-b33b-54ad1260f9be", "comment": "Malware payload (RedLineStealer)", "value": "92fc5b31922d70e69a79cd15828705cde9adbdc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649272734, "uuid": "98aea129-8818-4479-bede-dddf60b385ad", "comment": "Malware payload (RedLineStealer)", "value": "c50b0e24f02a6f24ebdf7e1496de514ea564bc3fe0a7a8d3cca885c245f967b9e00977e4fd7ab438a735aec43cfe4604", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649272734, "uuid": "a05d4979-9d73-44d2-a838-411ea5498fa5", "value": "T15DD32C6C77DD4A28E5FF8F7068B1119547F0B493AC02D75F4EC4A09A0E66B80EB12BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649272734, "uuid": "a9c203c6-a435-4b24-b283-0e26698bced5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649272734, "uuid": "de550acb-d4e9-419c-a61c-ccbc57e292c9", "value": "1536:3Rx8kCrJQ2IlA5cGbhXynt78xOez6wf8HigVVKXav+buZEx2RpJ0wuei6sLG:bCrJQa/c7U6wf8HigKqi/upJhW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649272734, "uuid": "227aa6f4-e71a-4f7c-a2e3-6a86d9c8de45", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649272734, "uuid": "149d80f2-6b5b-4fc4-86f9-b8a5db210d44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649272734, "uuid": "29b42a9f-66ad-4def-94c6-07c3c888ea0c", "value": "76ac5f1a68ed41db9f67fab59f4a897b641dc2d4df592830c8f8de4707846f5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1f45dc1-b5dc-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649272109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649272109, "uuid": "f729166c-6a2d-4410-8ad3-f26eafc6b67d", "comment": "Malware payload (AgentTesla)", "value": "705301b3715265ec19a6184f50456496", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649272109, "uuid": "6191fb36-8f8d-41e6-bf18-bbe9f904fce2", "comment": "Malware payload (AgentTesla)", "value": "76d9b118aa02543347017e4ce81d855c0533e27afa49d10b02b799a80b47fc79", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649272109, "uuid": "c79211a8-4683-4312-aa07-be7a0f6c4093", "comment": "Malware payload (AgentTesla)", "value": "7a003647ec22fac2fe4ef0de6c13aa7be18e5753", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649272109, "uuid": "e242ee33-46b2-46d9-afeb-788b4485a1e4", "comment": "Malware payload (AgentTesla)", "value": "044e0f882bfa05330a29f3b5f5140459fbac90148e9306d00e0eda42d7176021304ee8bb9481d79ef9ac4aa7e52b17ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649272109, "uuid": "cb39e6bf-0e55-44b4-96e3-8e9eff9cf214", "value": "T101441244BBE9D063F4E61EB72EFA6393BBD6451663B1121F1B10AF0979722C0964F701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649272109, "uuid": "059a9079-6156-4d5f-a850-5b491c212eb2", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649272109, "uuid": "6d1b5556-2506-4938-85f6-35e5d843b9fa", "value": "6144:HNeZm9tOpj4i7Wb8ytFnZiceiaWXPOaGGaftXk4dsVsvU+:HNlW17Wb8y/81pW8RjaOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649272109, "uuid": "f67d259e-474e-491a-87d6-b35647286785", "value": 270702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649272109, "uuid": "d6794cce-9987-4b25-b4d1-f5ebdcd96b4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649272109, "uuid": "c28d745c-45fd-4823-ac76-94657bcce30c", "value": "Form Bank Details_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b08bc8-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277971, "uuid": "40e274bb-3ea5-49fe-beaa-580cbf6c95dd", "comment": "Malware payload", "value": "e10725008ed57498effafd8a183fd52c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277971, "uuid": "2a362ca4-27d1-417e-946d-749b9f56dea6", "comment": "Malware payload", "value": "770a2584ad11858cd747646fde2184791cb5bb5b20399c882921215d7bf335dc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277971, "uuid": "57533e01-8066-4063-b97b-302591bf1f67", "comment": "Malware payload", "value": "90d7c946055236f280b11f2f4b4e24cffb43ee9b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277971, "uuid": "2e6c21f8-77b6-490e-bec1-83b7e4dee969", "comment": "Malware payload", "value": "57338abd1e6e1417ff989ff5b4a850cbe1e02094ad6a792f57d074b6987c4b4d10a90549febd2eb581561f2ca333f7b4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277971, "uuid": "2723871f-67db-4098-bdab-a0cddda24125", "value": "T11A11D31E37D1FCBC79A7BA50470EC024E540D79B907B6BA27A5A45EE7890484822C43C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277971, "uuid": "08b4ed64-8a8a-4828-847b-ddc31436b8f9", "value": "24:rWnSlPPPmBePxSJo3ys4Iad9YYIBYI8u0aNP1FzqoA5:rQgnuBeUJo3y+adCYQYyP1FGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277971, "uuid": "b008576b-1ae8-40b4-9ffa-af6f37a28fd2", "value": 1090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277971, "uuid": "be2ecd4b-2133-4bb9-bfcf-808195b0772a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277971, "uuid": "8d38bc65-3f1a-4b02-be23-78b49acbf496", "value": "770a2584ad11858cd747646fde2184791cb5bb5b20399c882921215d7bf335dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "984ec198-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277972, "uuid": "0cefe502-a599-4f22-95a6-98422cdd44d6", "comment": "Malware payload", "value": "86fcea81c08b72acb674fdde8b18e793", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277972, "uuid": "c1ad8143-2d7b-472d-9e83-f937917f580a", "comment": "Malware payload", "value": "774923307e428653a02035c08eba1cf89e9246d1c004853a17bc6e819c9f64a1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277972, "uuid": "a3bec86d-6e5b-4bd4-b626-278839a20bac", "comment": "Malware payload", "value": "b378723e36126c22e4c120a2d55742a36c840727", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277972, "uuid": "c6bc0ea7-d1f1-4881-8f44-2848006bd8ab", "comment": "Malware payload", "value": "9b5071171ac5fc88816059306af6af098fe38bae68ae156752f1a57dea0f28e05bed361de5049e056916b2e44823307e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277972, "uuid": "f772a959-65b9-49ef-8045-01125e998812", "value": "T12DA1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277972, "uuid": "9ac9bc9b-cad6-4b30-8702-6b0a67a27547", "value": "96:9RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:9RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277972, "uuid": "ea8cc269-9b46-4d05-9e99-713169a4ab7e", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277972, "uuid": "105e1620-a594-4ccf-8f87-1312a9342da0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277972, "uuid": "a866652c-b5ea-402c-a533-faf4f2a9fc9f", "value": "774923307e428653a02035c08eba1cf89e9246d1c004853a17bc6e819c9f64a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99334c1c-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277973, "uuid": "c16e88fe-9372-4461-bbf0-abb38afead6d", "comment": "Malware payload", "value": "837fe092642978f0a43055436792a612", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277973, "uuid": "4c2baca9-ccf2-46e3-8f5e-57aab083142e", "comment": "Malware payload", "value": "77ae466636b520b65ae04061a9d2858ae7c4a05b727c05966e95acc834090095", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277973, "uuid": "73f9a820-8788-45f4-b904-8cc7b7793948", "comment": "Malware payload", "value": "93dd0f2ad94fea7c071cb2e5299e3f3298f3cb5c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277973, "uuid": "c3b72076-d256-4f46-8f89-941438274ed3", "comment": "Malware payload", "value": "2fe8cd3da907e8d97985c879a9b89b60f703c1d67320684d3eefea89a30f525e367c037e7c9c43974a3103e84d8decd1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277973, "uuid": "97f773a5-4dcd-4d55-8008-ae777e7fb1a9", "value": "T184A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277973, "uuid": "3db4f15e-9bf4-47b0-b846-96956ea4d01b", "value": "96:sRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:sRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277973, "uuid": "cef705c9-946e-46b7-bd7d-98b3c7e09783", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277973, "uuid": "4da36c6f-0f9d-45c5-a8b4-4ea67c05b0f8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277973, "uuid": "b29c7760-b13f-47a1-9911-054414e7ce6c", "value": "77ae466636b520b65ae04061a9d2858ae7c4a05b727c05966e95acc834090095", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee3c8fc4-b5cf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649266520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649266520, "uuid": "77ff5580-744d-4ba6-b105-ae8ec4c2dfe1", "comment": "Malware payload (Formbook)", "value": "045853755fb9b136531a4aba986c7249", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649266520, "uuid": "fcd87092-3c91-40b9-a2b8-73b74f31c8f7", "comment": "Malware payload (Formbook)", "value": "77c4b075e649411ca5da7f37be04f957e7e4ebb6d58b3eecdb7facf1033be81a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649266520, "uuid": "2117ed10-0464-4052-a9b5-db410d3dad87", "comment": "Malware payload (Formbook)", "value": "cb19a3d21f50800dbb3bfc0778152afe739fa9bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649266520, "uuid": "7871bbbb-4655-4026-83d6-2ceee4d5d8a7", "comment": "Malware payload (Formbook)", "value": "783dd1bcd79b521f041e4f38bd675d85ac6080f847809e31762d9d046a90e7eae69ccda15d63da890d2e4baf4527ce3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649266520, "uuid": "a52fbe1c-8c61-48c1-9d34-e50be548aff7", "value": "T1CDA4F1293E98DC1BC59946B21EB9E269EBB1814074B443537B20ABCD7F78AE43D087C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649266520, "uuid": "bd9aff8e-47e5-4d04-94ca-44068d2a3221", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649266520, "uuid": "6b739861-a1de-4224-83be-a610bca63dec", "value": "12288:8NXrgsb6U1V72du6FDC28Ao4u0pCs/3nKERsN3:8NXrcW6du6FDWlp0pCo3nKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649266520, "uuid": "828906cb-e350-4850-978a-e10923fbfc61", "value": 487090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649266520, "uuid": "15ee61e6-d379-4959-adc4-463159df4d63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649266520, "uuid": "599be8fe-47b5-4c12-ac0c-9fec0e538c83", "value": "Purchase Order No. I20220052.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99be1fde-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277974, "uuid": "7c465945-f884-4ced-94a0-0c40cb9b3298", "comment": "Malware payload", "value": "faf25f1631a5f5cff939d0b91119d2e2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277974, "uuid": "0d80e86c-bbb0-493c-91a7-c7a65b91f038", "comment": "Malware payload", "value": "78015842f2e9745164fcd7e98bc2bb4b388345f4a474baab380bdbe1f59b8ee2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277974, "uuid": "4fba898e-8b09-4411-b9cb-d086760c5c8f", "comment": "Malware payload", "value": "b979caabaa2f426b4aa8afdce1c5b6f3faf426fc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277974, "uuid": "de786446-98e5-4087-8f4e-4adb4d64ce0a", "comment": "Malware payload", "value": "1b84f35709d13cdbd031a4d221d1fb06c8ec2f7c54bee0b08769af8138b5e3c0885bb7ae77db2bb598bcadbac1b2152a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277974, "uuid": "317a6906-dd1b-4c6f-a87c-4843400087b1", "value": "T163A1E850112C1AB17246597AD26FFA52B50ECC1B097B7B358473A63C74F5DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277974, "uuid": "e8d43d67-8ed0-47aa-af03-f565a2f64d31", "value": "96:iRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:iRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277974, "uuid": "9dcf8a82-a4da-4fbd-862a-a3a63e3821d2", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277974, "uuid": "f3e209ef-6dde-43ac-b9cd-5e71d5115d29", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277974, "uuid": "7abaad9e-7e41-4bb2-938c-06b04afbdd30", "value": "78015842f2e9745164fcd7e98bc2bb4b388345f4a474baab380bdbe1f59b8ee2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a35a71c-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277975, "uuid": "75452d8b-2099-408c-a4c2-59012c49cced", "comment": "Malware payload", "value": "53e10d26ceaec58836ec8958570b7f4e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277975, "uuid": "de5658d5-f358-4fbf-852d-0bd755b389f3", "comment": "Malware payload", "value": "783565adc1ddbf9dab030a11f90d0c5897949504140a4c52458a3b7236f10486", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277975, "uuid": "92d14811-e2c7-470b-a589-ebf1277dfcfd", "comment": "Malware payload", "value": "dd3bcc892465b705e3d7f8a8b5404067d6a62846", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277975, "uuid": "2dfe9d52-cf2f-4b47-870a-b1bdbf4e5489", "comment": "Malware payload", "value": "8ffac2f6ca8b123d005070d7be7e242a03ebaa685af865ab79506b5eec19ede7240174c90b9a3a82b4470600d1dc576f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277975, "uuid": "17d6b9b3-30cf-4eed-8b05-baa9297bf65f", "value": "T106A1E750112C1AB17246697AD26FFB52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277975, "uuid": "e156b719-20c1-4803-8697-890d71b61253", "value": "96:1RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:1RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277975, "uuid": "70ba3c13-cc4f-4956-8912-da8b24a5870c", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277975, "uuid": "6639ff93-1712-48e5-9acb-ab3d4b10def0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277975, "uuid": "405dd668-6b39-4562-a7c7-126fec8a279e", "value": "783565adc1ddbf9dab030a11f90d0c5897949504140a4c52458a3b7236f10486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "592bfe88-b567-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649221602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221602, "uuid": "05298dce-1010-4d10-9b28-1af700cc0acd", "comment": "Malware payload", "value": "f29eb4b2a37f814bde86b38e7854343e", "object_relation": "md5", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221602, "uuid": "7ecbad93-4acb-45fa-b4dc-8c7d2bab601d", "comment": "Malware payload", "value": "7841fc85bcbe8a44c9fd00700d2b08399fd6cc8ebfde0d98b9bf2d9bf12f551d", "object_relation": "sha256", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221602, "uuid": "55fd5713-16ab-4867-a2f3-dc679cd7488c", "comment": "Malware payload", "value": "cd89fdc3ef5bb4c710c228281ab12d02f24950f1", "object_relation": "sha1", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221602, "uuid": "65fec262-af1b-4102-b2df-0d016a475f1e", "comment": "Malware payload", "value": "2d4dcd4df0acee94f7464ad5148d8118297e5d04167e726c59ee1774d30f670a37565e108bcf22a76a8b080684f8ed0e", "object_relation": "sha3-384", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221602, "uuid": "0c43d51f-d51f-4c64-95cb-5c74833f4072", "value": "T10AA633A5E05A4756D063CB7CBC9B8DD97B10135E6123032FF8E684E8E60D7C6E707A86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221602, "uuid": "30e64fd0-c989-437b-ade4-ace4ff11f5a3", "value": "196608:oYaF7XiFIVmMdma1Sx3ocRIjMjSl75bXzIyFVQMkIz9UqtNxulMx0QT:oF7yumMvSxY5MYtDGMkkvHxulMx0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649221602, "uuid": "051b945a-d10c-46e2-9983-94d7992cf16f", "value": 10390064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649221602, "uuid": "a3eb32fd-723e-4855-90e7-93301dfbc192", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221602, "uuid": "747825b3-f460-4e5c-bc4c-30c1a1442888", "value": "PVGfsc pw 123456ze.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b6987e-b5a2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1649246936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246936, "uuid": "858bdc41-e6f9-442b-a97f-c7b0d564d6e1", "comment": "Malware payload (Stop)", "value": "41fac658f95570946c7f4c19fd31e745", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246936, "uuid": "f0c26113-894c-4e5e-96ae-c3280ba9fa09", "comment": "Malware payload (Stop)", "value": "7885e6bc9751165bdf49b2b176e88cfd036f80456e415ba0d5c144be81f02278", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246936, "uuid": "8df2f4b0-97b5-4db2-b618-06935721b937", "comment": "Malware payload (Stop)", "value": "69886dc131d6021bfa8e646fd81b005518f0c607", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246936, "uuid": "bed3704c-82bb-4b27-8ef5-49453bdeb1f3", "comment": "Malware payload (Stop)", "value": "a20498b2233c81c57c5b4f67fb742dfa7607809a9a927498312e217816cd3f123ef65650ccc9b8d3f94066561ad6bb7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246936, "uuid": "e3579531-edc1-427e-bccc-9ce102480257", "value": "T17B0512D2F6929070D8A17D31A824EBB0523F75A6D874320BF778A73F2E303D05265B96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246936, "uuid": "b15157f6-3ea4-404e-9834-5310ab3af0a3", "value": "3e1371bce2a7dabfc48c6aff7cfba706", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246936, "uuid": "d59e62f4-d0fb-4812-89b7-3040e62557fb", "value": "12288:m7IqhJHBhXIYXQwsR1+ZayN1oHN8ZYcmWVHW2/KRmve2C1QpMQ79g:m7nHTXI+zsRAtN1FY/8tmGpMag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246936, "uuid": "534df0e1-a910-44e3-b0e2-18163649fbe2", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246936, "uuid": "2097c22f-ff55-43ba-9b25-5f1f2c655ed4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246936, "uuid": "6d3edd09-d6f7-4c2c-8ef3-9fea7de8ae24", "value": "7885e6bc9751165bdf49b2b176e88cfd036f80456e415ba0d5c144be81f02278", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bb5ab01-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277978, "uuid": "827bb5e4-9191-45fc-93f1-1d559ee579cd", "comment": "Malware payload", "value": "4f5b92202dc704b6d499688bdddc66d0", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277978, "uuid": "6f916b3b-d728-4fa9-8300-b45e3be672c4", "comment": "Malware payload", "value": "78a8af16d1398f4dfd4db52a35197bd20c62c958b713c028c1b90fa8909cc275", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277978, "uuid": "82b59104-4197-4994-b1ad-43d60c53be2e", "comment": "Malware payload", "value": "b4f3ee45f9879588e0c5220d9549681ad858b72b", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277978, "uuid": "2d9ece6e-d590-4feb-955d-60f390c7445b", "comment": "Malware payload", "value": "58ef56940588c3657a3ee27422245f8e8b6481cadc53af3b4ace29fb1b6ab5ec131add451a117a6ac12b298fd88869f8", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277978, "uuid": "0bc95792-4b19-442e-a7fe-0bc9e96411f3", "value": "T16E5633476322A5738CB7530FA48778AB3AB67BDC717A4C734CC1B7C20948236B7496A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277978, "uuid": "c8f5045f-ef00-4a96-a268-23d4ef13ebfb", "value": "98304:q13V3a0rqRIZ+wrvNoGRtKzIVLplxsVmHOx+IK4Wpi5WVHpC/tBYVZpaLEItyfAI:q13V3HrqR4NlEzIJprsVmHUWkQJC4Hpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277978, "uuid": "354082a2-fcb9-46ee-a88c-daf97a4c9c4f", "value": 6406144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277978, "uuid": "f905e4c9-6c6f-46f5-ae67-84b0507ed988", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277978, "uuid": "911c783c-a4d3-4353-ae53-2748e2214136", "value": "78a8af16d1398f4dfd4db52a35197bd20c62c958b713c028c1b90fa8909cc275", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ae1d53f-b5a0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649246032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246032, "uuid": "9610039d-91e1-47d7-b244-90188f6f78eb", "comment": "Malware payload (Formbook)", "value": "175b04ff5e68e2e5b96763e1856f8cbb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246032, "uuid": "d0a36c10-6f83-4b98-a94b-e1913a2d265c", "comment": "Malware payload (Formbook)", "value": "78df2cfa00a02fb241dba205fb97b2ea20679c4aca878b971014f16bcb1cb51b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246032, "uuid": "312de7bb-b71c-44dc-a903-4f488c379095", "comment": "Malware payload (Formbook)", "value": "ea5f3d1f2711b4dc76224a4a8fcc262a20dbfa10", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246032, "uuid": "448bbf29-8a86-4966-8d49-02b9b6dfca69", "comment": "Malware payload (Formbook)", "value": "51b688d49b792d8518e8111949623c64397d50a1de8b2f18c472b27227f558156c093ffa7d6f78424683067021be99bd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246032, "uuid": "ee507ccf-93a2-48cd-adef-96616aab44d5", "value": "T1E752D13D44AD8201EC96F438700E773785ECDFC82E8D9A7E52EB65BC101062312726BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246032, "uuid": "dfba4784-ad8c-4647-a7d8-385e9330423b", "value": "384:HuJ7lF+PSZFQtD7FvNU5v5H/SDwNUDz3QJBZ:E44F0XFV0sDwNUg7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246032, "uuid": "1538849f-9822-4a28-bf27-b519e2f1318e", "value": 13844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246032, "uuid": "f921c4ce-91c6-4026-88eb-997c43ce337e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246032, "uuid": "7fe8c0c2-9c1a-4d4f-bdec-38c19e4bf772", "value": "SKM_C3350191107102300.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c95b0496-b601-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649287933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649287933, "uuid": "42244cdb-4926-47c1-a0c8-6f65dc9648e4", "comment": "Malware payload", "value": "da5fe6e532462ef1fbd4555fc0fe16f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649287933, "uuid": "0888fecf-824e-480c-a256-f14d9b55e71f", "comment": "Malware payload", "value": "78ec3b20f07ff6eb7365469840a4059f276cee17061a3f551d1bbd8aab85c725", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649287933, "uuid": "df1b42c0-b37c-474c-9e2c-8987f5bfa2af", "comment": "Malware payload", "value": "5fcb3d5bc4437f55acf9a3b95971d6135ea3b695", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649287933, "uuid": "669d83b8-dc1c-40dc-b1af-48323c0a3ce0", "comment": "Malware payload", "value": "12080cd6c1a63e87721f876ca3ef4eb022f76540726f2ee170ec10f0eb8c2398e1fad55e286305707769288642ea3541", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649287933, "uuid": "1b1cd6fb-fe03-4368-a582-ee9c49b90d70", "value": "T14EA4CE187ED79D06C4FBD67AACC25D304F387AC3A032D67E7ACCD25D56113820C6A69A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649287933, "uuid": "cdb5ad3c-116a-4203-83fb-6c9b6cc1f61e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649287933, "uuid": "a802b11c-f3f3-43cf-a4ad-757287a57cbc", "value": "12288:JQGNDOjyeBTVKBRSVau1MBu00tcvCmoo1:LNZePgRSVaubtkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649287933, "uuid": "5f3c42c4-63e5-4bd0-91d4-38f0b93664a9", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649287933, "uuid": "d6365a9f-717e-4182-b122-6bcc21955e56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649287933, "uuid": "208521e3-6be7-40c7-9b57-4ffb3c655fd6", "value": "SecuriteInfo.com.MachineLearning.Anomalous.96.8559.8491", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b1c5cd-b595-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649241306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649241306, "uuid": "ee2f9e00-c867-4f10-90e6-bf49e8fe9c52", "comment": "Malware payload (SnakeKeylogger)", "value": "ecee8788d0e67c20557b891b7baba459", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649241306, "uuid": "4b05dcdf-1e2e-4403-b910-04fe06c1f59e", "comment": "Malware payload (SnakeKeylogger)", "value": "7913494fc1737788b9ce2ddeff7790032f9e896cc91c0f370dd3fc2748c64591", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649241306, "uuid": "3808565f-b877-4c56-9d69-9127441c3514", "comment": "Malware payload (SnakeKeylogger)", "value": "35a3f2dd7ef67b3bc3c44acac4d856be658e0840", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649241306, "uuid": "1d7773fe-4201-4c50-84ec-1aadb6ce04f1", "comment": "Malware payload (SnakeKeylogger)", "value": "770a3a90133ca252bfecb51592203a393f05d4ea5257ad59c720ee595764b8389fbc86f3826be88a0cd78a3df77a2446", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649241306, "uuid": "7db55b9e-6a8c-4af0-a9ec-38c8a2113897", "value": "T114B4024A77A7CE56C56D067394D75A000770EE23F453C64E2AD932AB1F333A22A427E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649241306, "uuid": "e21c6d20-a763-46a9-99cd-474124904185", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649241306, "uuid": "85ee5a65-dccd-4507-ae47-7debef7a572f", "value": "12288:zhdPYwd3JBYU5MG2cw9kdl+zSNXHntUkjzpRWIApeQU7:NdPdd3/5WcSWXHntFjdRB4eZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649241306, "uuid": "2d6da5cf-8e26-4924-868a-8a1b60e107cb", "value": 531456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649241306, "uuid": "2b80f27c-2c47-4f05-a6ec-461b4ea91804", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649241306, "uuid": "209713eb-63c0-401b-94ab-3e38c478729f", "value": "RFQ11050202.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c3b0fe-b5bc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649258082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258082, "uuid": "e9a7141a-6ff0-4da6-a507-c0d0d07cb476", "comment": "Malware payload", "value": "1cdbfc318b9bd728d381ebfdf288e5a0", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258082, "uuid": "4cca61b3-b63e-4245-9460-ebc21a1a662f", "comment": "Malware payload", "value": "792979a8b81de3951133b24f454ff1d2bfdc12ae3464cfc547a6448874864a17", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258082, "uuid": "6b65dbcb-e649-4bb5-a521-0aa903d9df8a", "comment": "Malware payload", "value": "bf07c1b5d725827daf641bf9523fcd49e82dfa47", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258082, "uuid": "e6e11650-3f30-4c9c-9d8e-f7dffbf984a3", "comment": "Malware payload", "value": "467fcb8a356d0bed561f906457833d2792c6f22b8cb6a6429367f598e6cb4425f24c67ea7982ce5ed684e096040880f4", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258082, "uuid": "3768bf0a-b30d-4902-a0f0-66babcc6e8b5", "value": "T1E41402086078E16BE1C52735BC78E92C5F5ABC0BEDC86C845E2CB21A94BB1054ED5F6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258082, "uuid": "42e05663-8771-4cf9-a047-39f97f38f439", "value": "3072:zeney9vBCRud4nzrUqkgEt/xHJyGelVxO9ENZrf2UTlTpfatBWHSWv:uV3CQyzrfkVt/ZJREv2URstGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649258082, "uuid": "536a4a53-580c-4fa4-8692-67f7983c6084", "value": 192264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649258082, "uuid": "792153bd-bd63-461a-804b-c15cc11ac890", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258082, "uuid": "95b34f5b-eae7-43a3-b9ff-a6477eb0986d", "value": "1-7Q210.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f111b322-b59d-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649245050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245050, "uuid": "45a79a55-4a7f-4b94-a193-6fbf82b37a31", "comment": "Malware payload (SnakeKeylogger)", "value": "60276e8405898a766b49f68b9e7f4578", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245050, "uuid": "b7fa3fb6-d384-4763-9490-ba581826ef67", "comment": "Malware payload (SnakeKeylogger)", "value": "79fa9b8c5e79a3ef68b2cf1bb134bde625c65ff0a3e27593cfa0cc2860b11194", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245050, "uuid": "b5c21345-8ca8-4dcc-8941-1422fe628a5e", "comment": "Malware payload (SnakeKeylogger)", "value": "a0702e0b0f703f41a1652ded3d81af56a78b1032", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245050, "uuid": "1afda484-c903-4687-8125-6c9a348b8008", "comment": "Malware payload (SnakeKeylogger)", "value": "b88d771999d570c8fcd5721f0b735eb9932fbc9ac35614e1d0d61df40ff9b361759b527525cfd3a470865dcb48d4f1f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245050, "uuid": "71a41dc6-15b3-40f3-9321-cc394602bd5d", "value": "T169A40294776BCD23C96E9A7360DB66000372AB07A477D78E1BED21CB2A123C349527D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245050, "uuid": "e31d487b-aa0c-4504-b7fd-7d8d348ee48f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245050, "uuid": "0fc54fb3-49ae-4fff-bd23-b69f404ff6af", "value": "12288:fu2luOeJVBfuWACN4C0/zgrnrgFPHlmR0o3J+sAf0F:SBWrCn0UrnrKlaD3Qs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649245050, "uuid": "52f53c7c-3e32-4c71-9005-46521d76674a", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649245050, "uuid": "3bd0b7bd-76ad-4198-b7a3-efb425ed6846", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245050, "uuid": "33ccc6ca-c114-42a7-b94d-b49dd97c9614", "value": "Dekont_2022-04-06_8366635677352.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c5d5e53-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277979, "uuid": "0e46be76-bd06-4d4d-96f9-e739f753d09f", "comment": "Malware payload", "value": "455d32515168eababb737b61ec88fcd9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277979, "uuid": "665f82d4-7249-4d2c-94a4-bcd29c5f28bf", "comment": "Malware payload", "value": "79fd29eaec8f5265e9fc7e3b81e062a53dcdddedeed48a405374ace83db8ae20", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277979, "uuid": "5cfe3db5-fa02-4670-a28c-c7eb94a8b3bf", "comment": "Malware payload", "value": "1fc938da6890156b4c870a04980674346c82c222", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277979, "uuid": "7904ac05-89ef-4789-8b42-bc05c8ed4503", "comment": "Malware payload", "value": "e5c07977824ac98d63f0c1a08c99778d03d8c5a804a32336504177158ab5914fb1c7fd06a4b8145e9b4237beec96de52", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277979, "uuid": "17026c8c-8075-4b60-aa71-8c51f7664582", "value": "T18052A7B1B95127F5603C80B029872158734C264F16D53DB9F0ABB4B8356C7C49EFE9AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277979, "uuid": "7704b489-dbeb-43c1-8526-b18bfdf7efe2", "value": "384:XdEHebVBNfm1BjfeWBJfitbqTOu0mdxeApKlDU1uRiGf/TS4moGTl15D6/g:Xd4Q3O1FGWLKVqT3rpKlDQuRiGfL15G/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277979, "uuid": "2ab733ca-bb9d-4cc3-899c-84f6f90c98f1", "value": 13514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277979, "uuid": "84356efa-f0c2-4ce7-927d-3a77dd5f1f7a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277979, "uuid": "ac46d277-1bd9-4b99-96b5-accf16e395c4", "value": "79fd29eaec8f5265e9fc7e3b81e062a53dcdddedeed48a405374ace83db8ae20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "041c2fdc-b5ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1649257107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257107, "uuid": "e7d4196c-4e05-4fd4-b5d4-7411543be26e", "comment": "Malware payload (RemcosRAT)", "value": "645b39b61dda076bd4823d1243344bc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257107, "uuid": "7046d11f-2443-4f3e-9baa-d02e4fe7c5ae", "comment": "Malware payload (RemcosRAT)", "value": "7a49300906497c82da465159b20d5432d616af8d8d67ce8eb77c416bf42e45fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257107, "uuid": "c3900ab9-2cf2-4196-8119-2c4827d09c34", "comment": "Malware payload (RemcosRAT)", "value": "1291829e5a2b807090e15b62213924a166f36e41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257107, "uuid": "25d64c5f-c06b-4054-87ea-36a17e3b28dc", "comment": "Malware payload (RemcosRAT)", "value": "390c3d1d5d1a1463db66b88a1d830ea9ba67011e1ba5b5de6a7c74ce5cfd36bb51450ba0002e7fa7ca2189d11e1e39ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257107, "uuid": "39472439-e0a3-4c31-8981-401c05b062c2", "value": "T15784E001B2F2BF3BEA7D5BF12550601507FA26AF6835E3180EDAE1EB506AF114650F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257107, "uuid": "80dd4429-83eb-4b04-9d01-f0f3732fdf90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257107, "uuid": "081c4e2c-ae92-459a-9cd1-ec98da4efc8d", "value": "6144:jcBT0RYglQ5yr1w0hVU8UUqXNQ4K/eoAsIiVp/rO2Xfda7GJhMABC:uVgDR48UUqXN/K/BAzib62o6UABC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257107, "uuid": "5c937502-966a-4275-996b-ab745c371b98", "value": 392192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257107, "uuid": "ba42104c-e7b1-4590-bdbf-32fb6fd8a6ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257107, "uuid": "d0846406-556c-417c-87ee-66f65a7c1c4c", "value": "DOCUMENT.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a1ff358-b5c7-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649262701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262701, "uuid": "7930033b-8473-467e-91bd-e55f9a71fca9", "comment": "Malware payload (AgentTesla)", "value": "a51e8dfe9b216175acbc225de1ceb0f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262701, "uuid": "8a77a811-009c-4f85-aa72-2f55fd8d2408", "comment": "Malware payload (AgentTesla)", "value": "7b29b24825a35a5d19c29cc434143b3f2937acbb86b959f86a3945f13264e84e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262701, "uuid": "08dc2b6d-58aa-4640-9142-7a72218634a4", "comment": "Malware payload (AgentTesla)", "value": "36d347c6139c66656becec8bf698b1d6281b5b5f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262701, "uuid": "6abc6391-6987-4e4a-b180-f8bb490bc409", "comment": "Malware payload (AgentTesla)", "value": "52d80507bdb8510eb236906545122e139b33dd8c83558b3e4de77659d815e33b1f4c0b37002c57a4e473882e5ce96b2c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262701, "uuid": "2c271300-4720-40c5-852d-d3566bef7f75", "value": "T1F8B4121433F82326D8BD2BF3AC7904511BB0AA6F2861E68D8FD131EB5962740E557BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262701, "uuid": "6379f838-69e6-4c1e-afaf-61ae86346e75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262701, "uuid": "5d6838a3-60b1-48f6-baa9-f003b184fc98", "value": "12288:RDl5+/nZTmWdqA0Ic/GNnW4KAFLqdMvgembP7fdIbtF:D5+RD4lIc/kWJgqi3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262701, "uuid": "4552a78e-db90-46d0-8668-6c63fe52f0f3", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262701, "uuid": "3ea251c1-36e3-4352-8a61-a9b3c0535867", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262701, "uuid": "ac236443-f055-468e-8d80-215ffffb3704", "value": "a51e8dfe9b216175acbc225de1ceb0f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd53171-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277979, "uuid": "cbc02541-9d85-45f6-950e-ff0058100695", "comment": "Malware payload", "value": "3c71b9632cb3c3753b78948889e5b876", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277979, "uuid": "9513d6fb-d877-4326-b157-ab8b49e6f64d", "comment": "Malware payload", "value": "7b30eb832c192b7500c10562123650de5d163c1c6a8f009cbf8ad9825ea27dfc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277979, "uuid": "168c2fa4-8628-4013-bd23-7eb58d169f07", "comment": "Malware payload", "value": "9fcb5e6fe916e481f9cd01c0ce028e91495c922d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277979, "uuid": "b3b39b46-5b4e-4996-9237-e509745e22a9", "comment": "Malware payload", "value": "b30645624f428dd166768bacb65197e7b4ebe1e497af749b1a3b735e8ac871c2cdea400c9ff993b75c7e1270c7faf882", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277979, "uuid": "09e258a5-2718-4709-b555-de187b8c5647", "value": "T1D0A1E650112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277979, "uuid": "0c45df49-0dc9-4bcb-aa55-b4b1be658daa", "value": "96:FRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:FRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277979, "uuid": "edd3bf29-2aaa-46cd-bbf5-9287ef6c1a9a", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277979, "uuid": "fca9e07e-9f35-472d-bed8-ec94da59c65e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277979, "uuid": "b2ddb255-4f8b-493b-8a61-45b29a210e53", "value": "7b30eb832c192b7500c10562123650de5d163c1c6a8f009cbf8ad9825ea27dfc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d4d188b-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277980, "uuid": "9519978b-d195-4593-a491-b2186f948d71", "comment": "Malware payload", "value": "f362df64ff2a621f8016c66c5104af02", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277980, "uuid": "83551add-3e7e-43dc-bfef-bdecbcd58d0c", "comment": "Malware payload", "value": "7ba995469113feaabfba839bd9bcf89a31a173ec02b676cc87500594866915eb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277980, "uuid": "f88aa239-a982-4e05-a06c-a1e0060296f6", "comment": "Malware payload", "value": "475a480acc1b951f2df4aada2232e4d153febffc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277980, "uuid": "0445e5b5-063d-4fde-917b-57b63fb57fe1", "comment": "Malware payload", "value": "186cae54b982e4cf3f585a925e15051155d47911f9d0449556d7680929172077c950766f492d6f956ed2e48f5d61f6a2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277980, "uuid": "9342e849-1fff-45fc-b380-fb1cd3cfb5ef", "value": "T18BA1E750112C1AB17246697ED26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277980, "uuid": "4ef083cd-fa69-44f4-a400-79168429afcf", "value": "96:4RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:4RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277980, "uuid": "fef620fc-c4ba-4105-b253-40d32f7fb8bd", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277980, "uuid": "db6e1888-60d6-4d14-be37-18b0758815b3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277980, "uuid": "7a9df2bc-5e8a-48d4-89ee-fe3e9f148dfb", "value": "7ba995469113feaabfba839bd9bcf89a31a173ec02b676cc87500594866915eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad98972-b5ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649257360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257360, "uuid": "9c297a4b-21bb-40e5-be7b-4b6106770f2c", "comment": "Malware payload (SnakeKeylogger)", "value": "ab872435e38ceaa9e140449d277fc644", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257360, "uuid": "7adca86e-26cb-40d1-9631-642a32425e3c", "comment": "Malware payload (SnakeKeylogger)", "value": "7bedd64ae9177ce980420e56650c5b55bf6605161b1c5c9c4564da2208b93998", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257360, "uuid": "ebfb4dc6-0ed4-4562-9f96-30325cd95497", "comment": "Malware payload (SnakeKeylogger)", "value": "9a3d59739a2f32ce8383e3d1f58cd167e988958f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257360, "uuid": "072bfa6b-77d1-43fc-be7e-a1aa6f7d8fc3", "comment": "Malware payload (SnakeKeylogger)", "value": "30f42f27b570e9b617fc8bc2aecffa0f61de37bcf1845600452716399ad19e7fb47857948489b72337530d27e7544c68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257360, "uuid": "13f1b162-5137-400f-b5dc-68158728c1bd", "value": "T1E7A4126A73284785F6BC67F806825121A3BB3F35152AEB5D5C8800DD1A33F84C267FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257360, "uuid": "843d5829-e790-49d4-a028-3cbaa7a1d713", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257360, "uuid": "c5362e02-8c22-439b-be30-02e3dbc51e59", "value": "12288:ZzoeB3X0bmvSnjkiQU+846bJJP//rLZI5lIz3lID6CpyXXx2:lNX6mvQjyDmI5SSDL8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257360, "uuid": "700f04e1-e80c-4741-b5d3-944b6730d56a", "value": 463872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257360, "uuid": "7ffb7fa9-3f42-4592-94ed-5a6686721451", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257360, "uuid": "e438820d-5e8a-413a-bd38-cd12d02bb3cf", "value": "ab872435e38ceaa9e140449d277fc644.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4600a465-b5a2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1649246910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246910, "uuid": "868307cc-b66d-416e-b315-22ce4cfad775", "comment": "Malware payload (Stop)", "value": "5275adf96635f1661011a83c4f6ec9a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246910, "uuid": "cded6526-f7c7-4e11-8ee0-5a30764e668c", "comment": "Malware payload (Stop)", "value": "7c31ae17b7a7922d100fc9717a8927f2123a17e49c190dce9d8f1e29c434789b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246910, "uuid": "7489638c-0ade-4205-9375-6f9c11ad948b", "comment": "Malware payload (Stop)", "value": "e775badf903eefc7bef63b78e196175835e7e831", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246910, "uuid": "43557863-aae9-47b3-b980-6549d9fd65a8", "comment": "Malware payload (Stop)", "value": "4e7af49211386de7bf8f746df293d18b0c7ce843f29710f37ccb8daf164bcf25edb534a685f0ea2822e06792bd8f34d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246910, "uuid": "30e3f203-4d6c-4e72-becb-9cbec5cd9e07", "value": "T1770512C2F34288F1C0453D716862CAA165FB7431E6349447F779AB2E2E707D1A8BE399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246910, "uuid": "27e4fc9d-9322-45d9-b01e-3d23e48a951b", "value": "84464e125c276a9ead62be3c5a8b92f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246910, "uuid": "3c144a16-d10f-4a55-8c04-95d07e6500ef", "value": "24576:svPwOwaoK5RqJGgEQ0QDwoGakrOqqNjJa:svYOwaoK5RqJGgEb6jkCqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246910, "uuid": "75623181-354e-46b2-9779-fe783284f868", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246910, "uuid": "3725bfbf-3edd-4e44-b957-ea3f30a613e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246910, "uuid": "ff6c8a48-d68e-49d5-a0e3-44d648aa4a9f", "value": "7c31ae17b7a7922d100fc9717a8927f2123a17e49c190dce9d8f1e29c434789b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f09eda0e-b5dc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649272107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649272107, "uuid": "6e399174-de0c-4569-8f4d-d3c822a69d07", "comment": "Malware payload (Loki)", "value": "0919662ee685f3e7a5b7d59e68366d71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649272107, "uuid": "97a0a1cd-884e-4814-a30e-4e7eb6b37eb9", "comment": "Malware payload (Loki)", "value": "7c53b01f10a7f6a1674b7dd246d3bda189f5bc208b52b5b085dea3a7a9a920aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649272107, "uuid": "cd3cbb66-661c-42df-90ea-b48788ef12b5", "comment": "Malware payload (Loki)", "value": "5498d15e3367c432b9f0428e0f4c8a775b4ac05b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649272107, "uuid": "28ee9cc4-f647-4f27-b399-a845d1b3be6f", "comment": "Malware payload (Loki)", "value": "65b67bfa42a0aac5b0f0782ed78b17b74d72b848e42d8a3fd4b7758a722d689e231d8bc785875d5c5b96aa7475a84bfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649272107, "uuid": "7b4016dc-d014-4aa8-bbe2-3ba0e237266e", "value": "T1CCF49E1DFAF6CA12E26C2B77C8D6580443B1A941E74AEB1F76C136A506033BB8D4365F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649272107, "uuid": "4c0c6ad7-9643-4d94-9705-0292afb5e253", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649272107, "uuid": "f3e79369-c85e-47a1-b5b2-44628a4cd369", "value": "12288:04TNsQchj2eF/haDIVv9JXUUyizkncS7sK0Lm4LnazwdytV:00sQO5D71KcC0y1KKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649272107, "uuid": "bdc931f5-48a8-436f-bcd2-e7b2051b65fc", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649272107, "uuid": "cd256d49-9e31-4665-a674-1e237c20c9ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649272107, "uuid": "29b5a73b-2fe8-46a1-99e3-28ab08e2f354", "value": "SHIPMENTS_MAR_SOA_TT_SLIP_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79316bb1-b5ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1649257304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257304, "uuid": "795ba951-bc22-45b1-837c-67188c86be33", "comment": "Malware payload (Quakbot)", "value": "ad737e82f54c7f2f608474adef109f7d", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257304, "uuid": "0320c2bd-1d96-42f0-a1c0-a51859b40096", "comment": "Malware payload (Quakbot)", "value": "7c880c51bcf1a2f5d8dfdce8b1bc9ff0cb1867f95bdfe911548ee4c6c3f18d56", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257304, "uuid": "34f721de-4e9c-4182-b323-6571e352ad61", "comment": "Malware payload (Quakbot)", "value": "307564014184227c80e32cd073701bda971cc7dd", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257304, "uuid": "4cfedd9e-faf8-4b86-82cb-d48ce9149e3c", "comment": "Malware payload (Quakbot)", "value": "1dd3ebb95d963ac9efec2f4193d40c597d6c5b6f440e8424693dea5402c77469a2b69556b2ab4ac050e1b59285bdf589", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257304, "uuid": "90b55051-91f8-40e0-b205-35ad62e2d9da", "value": "T15D551236C8E05991CAEFD73315186AF983182477CCC9E5BB0E6B36DA2CB6431536B06D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257304, "uuid": "5f9745c0-45bb-44ff-b3d2-fded5d5b2007", "value": "24576:TF+BnmJkeGC2PbA/HMoNYIPeuVe2HHCkm6CyIwl6hafINeWHWR72vF+BnmJkeGCf:JymaeGC9YSeQHCkXC/wl6LcW2929yma0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257304, "uuid": "78db9899-5523-4fbf-80ce-066f95d8e74d", "value": 1282468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257304, "uuid": "63f720df-2f0f-44a3-bd48-f6de6e9b9f69", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257304, "uuid": "2c22f57d-0602-4b43-8cdf-7570617efee2", "value": "SNC-1823171407-Apr-6.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b6cc45a-b5bc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649258086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258086, "uuid": "35c66c88-9b79-4408-a60e-874aef952ac4", "comment": "Malware payload (Loki)", "value": "5323e405b2c60674151b1c2764820564", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258086, "uuid": "f5235088-89d5-4d7e-9d47-ec756edd8197", "comment": "Malware payload (Loki)", "value": "7ce50e70f7e1212405ac6974264444ee5fd50e42f5506640b335de2977d5780e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258086, "uuid": "b0e30234-a63a-4043-9fed-636a44fa5b7a", "comment": "Malware payload (Loki)", "value": "ec9fa333ca775d037e202d6e802e8884a7c2e43e", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258086, "uuid": "cc6966d4-e3a4-404e-8a4b-5c5d43e460e3", "comment": "Malware payload (Loki)", "value": "01503339306be9601d1fe020d6a1088851f4666b659569f51857b510d0b584e3f9e099d22705e0d7708f969cd06ce678", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258086, "uuid": "1673b681-e848-4bac-8483-0a5b66963718", "value": "T1EC1412046336981FE52B15357B3D6F84BBD0AF23F60C749B740935C493B79AA432897A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258086, "uuid": "1ee3226b-691d-4ff9-990f-236bac914a82", "value": "3072:pTyEWh2EZPP9wiHk/yRkR25cq00ad9KYM/EdM0M1DkWKy2F6:NcDM+fRI25Wd9KYK+le5Ky2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649258086, "uuid": "97b0391d-b869-459f-96e2-0b4157b22e9e", "value": 191992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649258086, "uuid": "0a0fcfeb-0333-4932-b31e-7ebfe58c65bd", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258086, "uuid": "c1d39daa-390a-45f2-b85f-37bbed3596ad", "value": "commercial_inv.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7495c77-b5bb-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649257918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257918, "uuid": "d3a3a6f2-2f24-4e21-8a87-45cdfb50aec9", "comment": "Malware payload (AgentTesla)", "value": "e075ef773930c4eb5c95babce9abd2ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257918, "uuid": "a8eb131a-13e3-40e1-afe7-3f83f447a30f", "comment": "Malware payload (AgentTesla)", "value": "7d2e1fb50cd6cc625dc663bffa1e7bb638e4666c0842be67f7a5daee14e857ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257918, "uuid": "a40a5439-c6d7-44ee-b64a-6a556b33a352", "comment": "Malware payload (AgentTesla)", "value": "1cb1cb90ce34b922251f84fef7f02fd2b4e582e2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257918, "uuid": "89372c23-6c4c-49a9-b95b-195c39ce9dea", "comment": "Malware payload (AgentTesla)", "value": "1f3f80f8d9f963df23ff06dbd7c046d816a999cb5186f184fa9930cedb3861a13e266b7c76ae23bf9c60245013513d5b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257918, "uuid": "ce1d8f92-26c9-4b68-ba0f-93fe3572af71", "value": "T1721412C83E95E049E0E607F7589DAEA62884FF516C77B6C2E4B030EC653D21D8F462B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257918, "uuid": "0f2024f7-6b95-4847-ba1f-42b7ad730716", "value": "3072:lVr9x333nojnNQpIxqHrw1tfqSmHexkagnKoMCxTthsZQY9UpJwKWGbwN9xJfvsF:vr9x33sl9zqxDagprivKQNDJXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257918, "uuid": "16780bc4-495c-43aa-845b-51b5a7ecf7ad", "value": 191640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257918, "uuid": "c8249252-d148-4319-8071-119f27329ab6", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257918, "uuid": "ea69d6a3-7e8f-4d89-bed9-3b3379927a5f", "value": "order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fa7b29a-b603-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649288668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649288668, "uuid": "8b113562-1755-4e25-b24b-acee0b3b3eb5", "comment": "Malware payload", "value": "0aa9d5a2d10c13c94ff2d00015b2054f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649288668, "uuid": "4edb59ef-ac29-47ea-9371-0363797cf2d1", "comment": "Malware payload", "value": "7d6d38f2cbe320aff29eb02998476e731d02ca27ca0e2f79063b207fc10229e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649288668, "uuid": "531d5472-1cc0-4bb6-b0eb-6aca3df2f252", "comment": "Malware payload", "value": "90339d7f593205b4ab3294f48039ddc43ee28111", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649288668, "uuid": "f455903f-c2f1-41ea-9f8a-86295a8ff85e", "comment": "Malware payload", "value": "c00f8680caba0a0c1700ee9b9fe053de80ebc47034207dd0764cd57cfae687cbf26d8c311c0a966194ecf91fa8095532", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649288668, "uuid": "1b971064-199b-420b-9f71-fec093ab590f", "value": "T19764BE57A3648561E71846B9AC13C8B5193D7F319B03762BA3E0BEDF3AB0247361532E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649288668, "uuid": "c82f4131-6cc2-42ce-b73d-7a0925a328cd", "value": "e7ccaa6ddd2e4bfdc648530b4b6c4c2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649288668, "uuid": "8b505c56-0e64-4a87-99b9-1886293f1f1e", "value": "6144:omEdSunAqHdroKcykhPBbiMV5xzr2fXpMIZZpkN:o4ujKyUp+gOxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649288668, "uuid": "239c1dd8-26cd-4829-bfd3-f5ac4c45d1c4", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649288668, "uuid": "b33d067a-d32c-4246-88fd-db5dfaf5b566", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649288668, "uuid": "14eb2887-558a-4ab1-bce9-0cbbfcf80d3a", "value": "7d6d38f2cbe320aff29eb02998476e731d02ca27ca0e2f79063b207fc10229e8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f2fa933-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277983, "uuid": "d24d69f8-cf09-423d-a6d4-77ff65f0a3ac", "comment": "Malware payload", "value": "94870712405db9950f672dbd7105e3f8", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277983, "uuid": "0e8004a7-0991-487f-8429-4c835edb4131", "comment": "Malware payload", "value": "7d984a4e0547c047eef65f8088528a5b2e85fdc5a9abc5d43b56fd9c61c7f9fd", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277983, "uuid": "fa43c11c-6f07-4cd1-a726-330866c713fe", "comment": "Malware payload", "value": "b6f5e667742af080ac0434e6b159f5d7feb2f199", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277983, "uuid": "5e7431bc-7bd6-4d0b-8dfc-3dcf552d0c4d", "comment": "Malware payload", "value": "b80c61d61963689766d6cbaf950f3136fed41f7f821c07ed6245ef9ca2165a9fcf0b86ca22f0b9399f8d66e81c7f83cb", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277983, "uuid": "017bfa71-aeda-47a6-a95a-03127689b5bb", "value": "T18306330C229AF8FDB85A066C3B228EF0C5E452F1ED4224F346791554093F5BE4BDFA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277983, "uuid": "9d3af33e-f9dd-4b4d-aa88-f454852e9cdf", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKSAFy:0XSxVJG2fLAqFOfT9sMYNM29SAFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277983, "uuid": "bb3ea767-6970-41ed-a465-8cc0df57627f", "value": 3977216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277983, "uuid": "12ff931c-e26b-4cef-831f-9c448a0f2e26", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277983, "uuid": "f242dcf2-3dc7-4ba8-8102-1618fb6c172b", "value": "7d984a4e0547c047eef65f8088528a5b2e85fdc5a9abc5d43b56fd9c61c7f9fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43182d33-b5e8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649276970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276970, "uuid": "27c5829b-6bfe-40c9-a25a-5c5236f137bf", "comment": "Malware payload (Mirai)", "value": "15d103f214959206e21ebbde77803eca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276970, "uuid": "464be5d3-5d8e-4338-b8fd-67b75741ebff", "comment": "Malware payload (Mirai)", "value": "7e181ee377d66bb9b0d14aae432530a53941df1c6f81fe7dc891fdbe68774597", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276970, "uuid": "4f49eb1a-d4c2-4449-b1a9-2e2136255db5", "comment": "Malware payload (Mirai)", "value": "866c398682cbff199495fa52d3828622e8c05b0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276970, "uuid": "7c4cf8d1-dfb9-462b-b0cd-f3cb5d06ebd8", "comment": "Malware payload (Mirai)", "value": "331ccacdbc77149f5e979c70c8225bf09c85121a2d780d0c4dfe6d1bc732fc392a45c25085a05ee0e020fad0ea42c860", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276970, "uuid": "29860bff-ea76-425f-bcc5-8a83673b2bc3", "value": "T16AC2D0BCE5A07F53D20C5E38B1ED53F5A6AAB080338EFA0C63026C02B526A9BF154074", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276970, "uuid": "af533d05-0793-4a93-bf99-1610dc0f0e81", "value": "384:1y2NN08zn8TLEr/FWq2C7SRPqosE1FCEEzy6DHKTWQaIjTxud3xVmRWGVCz0NvJN:02Ny8z8Tq2JdHn1cESy67jdT3xViWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649276970, "uuid": "2ef7fc27-913e-4f63-870d-ccc03437424f", "value": 27280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649276970, "uuid": "aaf5e49e-251e-48cc-9b96-386c36a38c51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276970, "uuid": "ae56776d-25c0-437c-998f-90259be8abd6", "value": "15d103f214959206e21ebbde77803eca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aa8f08f-b5ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1649257360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257360, "uuid": "b0e00632-e15c-41fc-835d-ec58d60bdc8d", "comment": "Malware payload (AveMariaRAT)", "value": "cac17862c71d59052b2542a254396751", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257360, "uuid": "a2e45eb2-4cfe-4b79-ac14-b6f4332a4e0e", "comment": "Malware payload (AveMariaRAT)", "value": "7e1e9987b68b3c5a374d6dfc52a34a3d6f5094dcd91eb6c585998be70369946e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257360, "uuid": "e0f14003-88d4-499a-930b-1efc3cb8e05e", "comment": "Malware payload (AveMariaRAT)", "value": "0f874241f0e72bba1904f83462499222234655ac", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257360, "uuid": "91bce5f6-c90d-4d92-b1ff-5bec021606f3", "comment": "Malware payload (AveMariaRAT)", "value": "b5f1af6cd1ef09c13ce18f55355cf315286804cc718595cb90e6ceb6e7bb0b6a5790e2bff64b3287bd61ed0068fa3b68", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257360, "uuid": "44d64aec-7e99-4b22-9698-33051e36e141", "value": "T1E3450294A7ABDE12C5AC5AB260D3241183F09F13E4A2D78F7BCC559F5B063E51982BC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257360, "uuid": "a7be5e7f-5312-494b-9bf9-3b7076f302a0", "value": "6144:TeVREjV3UMRE0iH7lzntKa98xb5kxsHhUAaj9+sbHuLAzohChsMjmmGMt9jK1LZt:BBe9xntZ1AkkyOQoA5jbGMtE1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257360, "uuid": "391fce7e-848b-4f6e-ada9-3e4e3467e000", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257360, "uuid": "66aefba6-fd04-451b-a61f-af587127956c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257360, "uuid": "7cdc3e1c-6e20-4dfd-9577-a9c02c72bcf8", "value": "invoice_img.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf0da8e-b5c7-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649262704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262704, "uuid": "252123f0-b02a-4d6a-918e-babd17f4c240", "comment": "Malware payload (AgentTesla)", "value": "aa80312c02afdeca5637642065881035", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262704, "uuid": "4f5320f9-8a47-45b8-837a-6a8db16d974e", "comment": "Malware payload (AgentTesla)", "value": "7e840527c08cc44418a9d45ce4311b201cf5e15f85efb806ca81edd7d5c29fd8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262704, "uuid": "ea80c795-4d58-4894-8290-ce1f7cd4c88d", "comment": "Malware payload (AgentTesla)", "value": "6f08159520db3c466929f00181ba0cce7e94bb4e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262704, "uuid": "18a80a7c-b393-446f-a8ec-0989e6f003ec", "comment": "Malware payload (AgentTesla)", "value": "787bb0e8108ac37e51424873f0c5795a388bffca0de4b9f704fd99bcecc7b01616783c241f359d8917e3ca57b66eee28", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262704, "uuid": "4828c4ac-dee7-4703-be63-85e5264afe7f", "value": "T136C4129577ABDD16C8BC99B398E2651503B09603E0A3FB4F1BCC12AE27037D54A127E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262704, "uuid": "be8b85db-8d1f-4851-ad27-5f4400eeb10f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262704, "uuid": "293fe143-ba17-4e2e-9cf3-4718ecd1a817", "value": "12288:29SloV4omzFA6shtJYrlqFYmh46ti53TkZwYq3+U2CpaWuNF:RoVYZUht+rAYfkidYwzDuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262704, "uuid": "b5e1f907-a238-4948-a0ba-5dc2ea236048", "value": 558080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262704, "uuid": "a77cbf93-d54d-4693-b792-e9add0ebafab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262704, "uuid": "37fe082a-1434-4993-ae05-adc218666662", "value": "aa80312c02afdeca5637642065881035.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4879eab9-b5a2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1649246914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246914, "uuid": "9721d26d-e987-4f8f-8ed8-c2927c9c8572", "comment": "Malware payload (Stop)", "value": "7473a97e013526e9ef73bb2d616e18eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246914, "uuid": "a05e1b48-1711-4391-a5a6-a432a190c8f9", "comment": "Malware payload (Stop)", "value": "7e9bd8a66a9e70d5d2d17a8b736ed71fe5dcc085432753d843d88afe99620525", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246914, "uuid": "12ed65ca-4ab7-46bd-967a-3db22c8dd35e", "comment": "Malware payload (Stop)", "value": "d0f2c22c5d629064dfa0ddb89b35f16802ee91b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246914, "uuid": "4b0f785d-2093-49e3-b289-1004b0193cf7", "comment": "Malware payload (Stop)", "value": "2de3ec687566b6d08513551097a383cbdd43286da325249c1331d4ca6790c33b022968474045b861946624b8a8ae2413", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246914, "uuid": "6c3b5bf6-c57f-44c5-b25e-8c3a96be74f0", "value": "T1F40512C4F381A971C466EE70A860CAB1423B7972C6708647F7BC7B7F2A343D059A2765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246914, "uuid": "3929b3dc-6d15-4710-9798-bb51f266b5de", "value": "c573cb6c93cba3d870a0445c3d1cb654", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246914, "uuid": "cf92c939-b4de-41fc-96cf-f484d20656fc", "value": "24576:f7wkXxSweoGYESVe37gNz6ZLYa79CeI6a:f7v0weo/VW7CzM9Ci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246914, "uuid": "ddba668b-d7c2-41e7-8774-8a79cc60d9e1", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246914, "uuid": "1ac0e1b2-a12c-4b76-9c2f-a62ac3e3348c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246914, "uuid": "2b7bb582-8178-4a94-ac54-c741b60e989a", "value": "7e9bd8a66a9e70d5d2d17a8b736ed71fe5dcc085432753d843d88afe99620525", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e8d5d3-b5a0-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649245942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245942, "uuid": "841f8e04-2cd6-494f-876f-b5007f5fccd4", "comment": "Malware payload (SnakeKeylogger)", "value": "ea264602f26400986f9f721675b0efa0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245942, "uuid": "2ecded18-5476-4723-9beb-3de666969e97", "comment": "Malware payload (SnakeKeylogger)", "value": "7ecbcb1aa9fb53281db81c5297498d8953d2a470dfa1ade910350a75cb42b947", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245942, "uuid": "8d22d2ca-5e8c-4423-bdac-44bfab22fbf7", "comment": "Malware payload (SnakeKeylogger)", "value": "a8d53a2bdb39f46c133217aea9e9c2df5936097e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245942, "uuid": "8aae0fd6-af67-4591-916c-380906d8e6e6", "comment": "Malware payload (SnakeKeylogger)", "value": "7ee0486d3107fbea1273902d98481dfcfb81e6e3a17fee4e979df3431405c79a98778eb727c66c0372d7a673019f6a2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245942, "uuid": "cdc52068-6873-4fe7-b365-a288136b7500", "value": "T1C7B40281339D4613D8BE57F6A43B4B5007B1ED2B3852E29C99C176EB0E737805913BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245942, "uuid": "0ab6be8e-2d7d-45a2-b52b-56179b26edee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245942, "uuid": "f7d338e4-68a8-43b6-84c2-dfed95907eec", "value": "12288:8uaUiWmhxPjIt87pTO3Kq0m6EQ1dccpPspUeQU7:7iPxP3pTO32EdcmeeZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649245942, "uuid": "e3cfa713-692d-4de1-8ef3-f6a88fe18147", "value": 503808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649245942, "uuid": "7bdc5524-1627-4e2a-817f-71e27256b367", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245942, "uuid": "1db6f63d-d504-4c39-9a06-604144eb3ed0", "value": "Request for Price Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "511b36b1-b586-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649234903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234903, "uuid": "b3e0ff2f-5ef4-4954-9efd-c6ab5ed59927", "comment": "Malware payload", "value": "9b2e5b6d52e182064e97c4e7993ebcea", "object_relation": "md5", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234903, "uuid": "18148cd6-0b6a-4e73-a375-6fcedfc157e6", "comment": "Malware payload", "value": "7efa4a3625f93bd09d8a344b849ea2f3698c2aa04a28e9c4740a5ff02307ef6d", "object_relation": "sha256", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234903, "uuid": "edad59bb-eb63-4c58-967b-402573f43bf1", "comment": "Malware payload", "value": "7a733065c3ea9b321e22295fdfc0a93a028bdc66", "object_relation": "sha1", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234903, "uuid": "ef64c683-3621-4c20-94dd-41216c465db4", "comment": "Malware payload", "value": "2af92aabd843839ca9ad0ed1f3975ae1d9a58729ce496f4a20dbb5b5f1923a06b40506f152a8aeb49162893b88049dcf", "object_relation": "sha3-384", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234903, "uuid": "965bc015-3084-43f4-b57e-4036812241d7", "value": "T164442345AAC03454CD80FEBEB81E300BCC33578A71757B9E7A36B22EB5D27236A6D154", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234903, "uuid": "6562c27d-a2dc-40d4-90c4-6299b6bede4a", "value": "6144:S84Hc/ZYMfQocyN0sUS1IkQ0Y93pCRaB290EcAM:SB8Wo3N0sUS1Ij0Q3pCRu2DxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649234903, "uuid": "75fc73db-19e0-4411-b268-b878fbb6f50c", "value": 254395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649234903, "uuid": "c5b7d591-5d6a-4f45-826a-3b98343f6af5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234903, "uuid": "e7948031-454b-4b34-8422-65368d6eaa51", "value": "0e8bf3e0-a85a-4d78-4639-e6fa5cd37b71.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b1b741-b5ab-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1649250916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250916, "uuid": "25783d6a-ca51-4b61-ad98-4182d4d7ed05", "comment": "Malware payload (Quakbot)", "value": "3f9a967ba01a7cf4efc04c49c70a8476", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250916, "uuid": "de22a6cd-0d16-4d7b-b78a-a4242723cc46", "comment": "Malware payload (Quakbot)", "value": "7f253796752ed131d472206385a2d9c9d3baf2cbbd14de9eab4624418a7b7857", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250916, "uuid": "69362e3d-c96f-43a3-8fbe-f057309f123d", "comment": "Malware payload (Quakbot)", "value": "89b19cfb988e78e681e36b5cd8ed5bf9f588c03b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250916, "uuid": "2b5d5a20-3b87-4c38-b116-5ebf024ea76f", "comment": "Malware payload (Quakbot)", "value": "4581e52151a1408adc443d906b7e5b3df8a076b9f65dc494d01c13cce48741978a1afe70856b9eb05b5d0ff13e5ced28", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250916, "uuid": "4520b404-7a7a-434d-a8a5-cf89ea774f11", "value": "T1DA65AFBC75046CDAE66F06BBDD96ACDD13B6262299C794CD807577C309A3372EE02C05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250916, "uuid": "d1f7f21b-045a-4494-9374-9cc595ec23b6", "value": "1538717eb64bec210d6f84c7331143bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250916, "uuid": "254a1e3b-3eda-43e8-8dc7-01b41d887410", "value": "24576:4z3YrrLEaF0tTHMjuX5PmnKUz3NL3BAYJWDJnh+idFsv3YgPmHFes:4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649250916, "uuid": "62d4a600-40f6-4e8a-9003-eb0ddf6cdf75", "value": 1427464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649250916, "uuid": "3a7becc8-2774-4774-aa20-e9eb13cfd6e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250916, "uuid": "a6902707-204b-4305-8713-667af47590a7", "value": "7790983516 (1).dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fdd8f3c-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277985, "uuid": "20295491-97b7-4a9d-b622-bf245c78dfd9", "comment": "Malware payload", "value": "dd1ce444fa313bf64e36af5c9235d33f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277985, "uuid": "09910aaa-c7e9-47b1-8def-18f50a9954c1", "comment": "Malware payload", "value": "7f6fb37700d9f7f20d5a5fe942f05ca62ee0089114639f35651614b842b2c6a9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277985, "uuid": "753de0bb-a7bf-41ac-94a1-3b433f2e1283", "comment": "Malware payload", "value": "1f29c70d6d3c558fee1d263a25fb77d5da380402", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277985, "uuid": "1b0c7c0d-7581-4ff2-82e6-c24cb7b14a7e", "comment": "Malware payload", "value": "351d0a9cdac3d444b8f823c0a955cc8e5241266eb96560fb2cda0c3115f52016938a8fe58eaf66c2f26ece321f6dbfd1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277985, "uuid": "962f016e-64ba-4a80-8652-072f8ed83d81", "value": "T1F9313A80736529B83FE31EA72375582471C464672D909D8AE8FCB4F48D8EF4929A41FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277985, "uuid": "b4ee43a2-7d7f-4aaa-b014-bd9e7b76c1b2", "value": "24:Ij+bOe+gaIOe+wWkaUoOe+CoOe+sOe+hOe+g5Oe+1MOe+SeOe+qOl:tb222X2Co2s2h2g52e2Se2qe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277985, "uuid": "dfa5419e-8947-4294-a67e-bd564461b347", "value": 1860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277985, "uuid": "71466046-aaaa-4486-9fc5-70edc5f4d220", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277985, "uuid": "d7811fab-8d97-4ece-9e79-270b6d60ed05", "value": "7f6fb37700d9f7f20d5a5fe942f05ca62ee0089114639f35651614b842b2c6a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f106ad-b586-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649234835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234835, "uuid": "99058552-e0bf-4c74-a656-e5a18ced050f", "comment": "Malware payload", "value": "3436848adf5563bf3042e9337b6c680b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234835, "uuid": "fecba0ef-15f2-4eaf-8485-151899f0fe30", "comment": "Malware payload", "value": "7f935e9614d94993e58847461a8847fe5722eed090daa48daaa6020af445195e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234835, "uuid": "68577221-1b40-4d45-ad6e-fc41850ee78c", "comment": "Malware payload", "value": "2919ddde3cf438d474e7409483e5c43b8b3dc141", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234835, "uuid": "7d34f16e-0c0a-4868-9060-ee1139a3e23e", "comment": "Malware payload", "value": "b0aaa63ad0e80ceda8ebbae2bd3e566e6af2ff463091747bd660eff018ae1e3b5e7cef21a232b35df22c4d10d3ed3775", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234835, "uuid": "b7ae950b-c43f-4495-b0d3-fac047788fcf", "value": "T1214423B4BAE5236B98678954BEEEA6F67E235883458B3B04CC5C47067BC31F55E1C2C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234835, "uuid": "2163ae45-9c17-43d0-8cf2-3efcf3fbdd16", "value": "6144:9ifC9SIVLGJ7cojyrI3KBbl231RiLupzV7cCAguUzBYwxyZZGt1:9ifQ3Vipcopq541RiLgV1XAZGn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649234835, "uuid": "9a031dfc-92b8-4a51-b76c-8c29df463cf3", "value": 254395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649234835, "uuid": "89b60e31-31c5-4871-9fac-c97d2c15a1a0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234835, "uuid": "b4fca699-893e-4223-ac8a-214b8efe6d6f", "value": "73bbf4e0-aba6-4ffc-6a58-60fab35f0a99.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a07c7b3f-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277986, "uuid": "d07a178d-a876-4c7d-801e-97958f213f7d", "comment": "Malware payload", "value": "56bc3c67d1c75bc3e70427bad0f152f3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277986, "uuid": "31764f6b-236b-41d5-82c3-8602bec58720", "comment": "Malware payload", "value": "7fa3cf9f55479fc7353109e14fc6ab7babb9d88b5b7558adf7cb56635fa498cd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277986, "uuid": "2c26ed56-423d-469e-a8ad-8eff9ad38b34", "comment": "Malware payload", "value": "0958c6de396e321a2587acaed10e84f419419f1f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277986, "uuid": "8bc22e30-6980-4de5-ba5f-67426a240cf3", "comment": "Malware payload", "value": "6058d224e43cbfae075b1b405221f3f6c339d1e2604f41da360b249f7d532157ced202278d3a3a60676ad3312139d98b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277986, "uuid": "6e7e808d-b44c-44d9-92e1-44897c32ef43", "value": "T1173170CE62A206792DA0AEA7317A480930D0D0CB28DA6F6A7DFC38ED54CCE0471467D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277986, "uuid": "6594f3dd-0d9a-429c-9aea-c7f81615e5cb", "value": "48:vQ9QqkQ54kQNbQPJQ5QGOQ9QhQhQ9QhQWr:vime4kubOm7OamWa2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277986, "uuid": "4d24b66a-34c2-4f81-82b7-01689008c366", "value": 1578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277986, "uuid": "b8b57913-821f-4956-96b7-1bb25cc929f7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277986, "uuid": "58810f5a-246d-40e0-8e43-f8f0ced628c5", "value": "7fa3cf9f55479fc7353109e14fc6ab7babb9d88b5b7558adf7cb56635fa498cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4379f19b-b5ab-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649250771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250771, "uuid": "c2420e63-26a5-44d5-8356-faec098507b3", "comment": "Malware payload (Heodo)", "value": "04bbc843979951b172f5ac08c1f5a006", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250771, "uuid": "b190f7fb-5f19-4d0e-8268-61db168d8847", "comment": "Malware payload (Heodo)", "value": "7fbb5f25ad69fa7ff9e3a2b9f82489f46f151dde414398f9c5d19762ce578a74", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250771, "uuid": "8bf86d2b-95a3-4c27-836f-012151748224", "comment": "Malware payload (Heodo)", "value": "5407588ea8dc747ab004b0318e31dcffb9310038", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250771, "uuid": "65d5fece-9715-4f53-9a11-8f32a27a3e7a", "comment": "Malware payload (Heodo)", "value": "153935943c3e526598dbfbcdc1a094974a25275198dfa0d01c0547544c4c92ad7411f6f67145d0e7e0fc0f4cdf4cddf4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250771, "uuid": "01c98c00-a3b7-4bd6-aab8-f4969ae9f69b", "value": "T169E427137CC34030C89F0875891AF20A6995EF04DB99B33AEBB5BE8D65355979D38B0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250771, "uuid": "38a6b20a-3b97-4959-b410-025295e358ea", "value": "b39d2fd2d18c2cfe493a1e089561b46e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250771, "uuid": "7488e5ec-d430-429b-a527-c64f284ad607", "value": "6144:EiH1vXSjOsl8UG2fde2VwS7D8dwDFYAcAf6UZUfNKLgM1xIhg3teXE3XsuTWKi7T:X14GEdtVlnqYF0ArZUQgM1xou/iA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649250771, "uuid": "4c84fd7a-7fd8-4768-85f6-adb51d1d5f51", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649250771, "uuid": "34f514ad-96b4-4d41-8a72-1d73f375a893", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250771, "uuid": "99082623-ca30-466a-8192-bff57378fb52", "value": "emotet_exe_e5_7fbb5f25ad69fa7ff9e3a2b9f82489f46f151dde414398f9c5d19762ce578a74_2022-04-06__131245.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "674342d3-b56d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649224203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224203, "uuid": "65b3b357-f483-4cf5-a03f-6939d7e0be8c", "comment": "Malware payload (Formbook)", "value": "a3c4030e4b17e0a0bea605ad5591155d", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224203, "uuid": "60a3fd63-f366-41a7-9d96-0dda474827bd", "comment": "Malware payload (Formbook)", "value": "80185d2c2dfe72063459e5a69b3313d38effd650efa19da78ba3e11187bcec65", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224203, "uuid": "a7a5ffe4-dca9-44e5-a4c9-aac4bb12ddcc", "comment": "Malware payload (Formbook)", "value": "7594a5a4e481c0bc8160d41e5bf729885c9add11", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224203, "uuid": "be25c16c-0e64-4ff4-a8bc-ad2943139591", "comment": "Malware payload (Formbook)", "value": "89389ea41ece54cd601b6b348fcb9bf531963c1393d5dfbc22667b6ee2fb1d8d6f7df6e67af5619e2e7fcd4b24de71a9", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224203, "uuid": "541465e5-6b55-430a-a674-290062348e61", "value": "T177A423C56C7539E81B39C0FD1808BB296A219FF5E4DD98F82CB070A20B891F71957E5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224203, "uuid": "a4e7958d-5983-4e56-b43a-4c89803384a7", "value": "12288:T7jbl6bL8/HooZGoI0K6mdtDg4sJ1t1s+8tokL:TPobGoOI2mdtDg4e8ug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649224203, "uuid": "d3ab77a7-2004-4622-9017-f605c3b16a87", "value": 465595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649224203, "uuid": "8feb8714-08f5-43a9-a1c2-bb182f0d8162", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224203, "uuid": "1b4b718f-f868-493b-9f3d-27a23cc357fa", "value": "PART SHIPMENT- FEDEX - Cargo Arrival Notification Import Track No 270962529096 MR V fKUMAR.pdf.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6173b313-b5cd-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1649265424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649265424, "uuid": "05598470-d553-453b-ad3b-0d12cd8d6c6b", "comment": "Malware payload (AveMariaRAT)", "value": "e7bc410788af86fe5e41695dd0ae308b", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649265424, "uuid": "ec6286d4-094d-4e62-b397-a4c9e2f09089", "comment": "Malware payload (AveMariaRAT)", "value": "8056c874a9bc6c2204ab4ea45a6f0ef4f2de0302e367695fdfd3599e4509df55", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649265424, "uuid": "02749dab-06ae-4424-b1f7-eae8390fa0a7", "comment": "Malware payload (AveMariaRAT)", "value": "8d9f55c90db961ea66993fd03e148b0dc9bcec5b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649265424, "uuid": "9343065c-7f1b-49e6-a3c2-ba39cc7bcaed", "comment": "Malware payload (AveMariaRAT)", "value": "47d16673c756f7ea55eb1673757073acb22269aa33b598b4ab63c5d17523215273f930ca19b6a4bd25a0de271721a06c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649265424, "uuid": "94527b4b-51f5-40ae-bcbc-b120428edb36", "value": "T10D540224F039F489CA9F113DC1058EF7B24B0250B6C1A456B911D7AF6652EAF478F2FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649265424, "uuid": "4b8b6e1e-c05f-4ef7-9c5f-b466fbfccb90", "value": "6144:M9z4Tkn5m8YZ06AgdkaG1BMKUwWVwlNIJ+o/xCxzxkxht:M9z4Tkn5UFdiPUwWVwlN05clOht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649265424, "uuid": "41a69adb-0bad-4d0c-86a0-b0913706acd8", "value": 297778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649265424, "uuid": "395fb906-a873-4a69-ac36-e52167558ad8", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649265424, "uuid": "c334a2e6-d93e-4c67-b1bd-9dea280fadda", "value": "Tax_Documents.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c76ea39-b5bc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649258034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258034, "uuid": "9a4f3794-98c9-4ed9-946b-1103f01c8c74", "comment": "Malware payload (Formbook)", "value": "b0984e71d168bd53b1619640b6a7e69f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258034, "uuid": "2f987c70-517b-4e6b-a83f-abaa4ce1b5b8", "comment": "Malware payload (Formbook)", "value": "8147b64b3a691fbee9b9845a80fc65fecce89fc15515ebaff1c853cc5226db9a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258034, "uuid": "40107f0a-db5e-4a10-b273-66c72f1cbce0", "comment": "Malware payload (Formbook)", "value": "b44604ff728349a7086202516370fa1968adfc92", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258034, "uuid": "bd86085d-ba4d-4b26-85d2-cdcded75d9a6", "comment": "Malware payload (Formbook)", "value": "b10c81293d13ee5f259a38bf345792d5d0a72efc11ad13d47d619371e1de9ed97462d9b808e7ef8370e622883f16bb5a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258034, "uuid": "366673aa-a186-4f79-ad95-b0d0df14019e", "value": "T15214127435EBE630CD8C407ACB1B01A3DE65DD093B98266E14A675BB34372E036879DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258034, "uuid": "135557d6-3c46-49be-bfeb-89ee33295e73", "value": "3072:MXlRJEDJcSR7UE+niMHRSMlYZBRSkWkDle2kuaPxRGAZWyNL/zwC2Mg:QcDJca7UBiMHIMcBRSk0ZuaPXGAZ/NLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649258034, "uuid": "7954f8ad-c9ef-4228-a341-2228d2d7eb0a", "value": 192376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649258034, "uuid": "7c2f2f8d-3afd-4f45-8a65-5ae7de36d17f", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258034, "uuid": "8285c5c7-c156-4063-a56e-1ce65c1e69fe", "value": "Swift_Euro.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1977bf8-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277987, "uuid": "74d926f2-262c-4815-ba7a-4b755e95452e", "comment": "Malware payload", "value": "91f0fe51809f869974586ec7c125e8b4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277987, "uuid": "2ef42db0-1784-4116-8097-18af24ae5dbb", "comment": "Malware payload", "value": "819c02bb5bb1a3477ac104876d76b95eb2f3923d48281854645b7ad90c7a22b4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277987, "uuid": "43abeaac-f9b1-472c-a23a-e153855b8903", "comment": "Malware payload", "value": "535a94c72c8acf7a3f7500b02b95fcf6b6c67bdf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277987, "uuid": "bcaf3dcd-43eb-4d38-a143-70267c18fabf", "comment": "Malware payload", "value": "bb26e2252575e6b41c7ad5467fc76906e863d4093ba4563958de811f0a2b9b14059d206376b45d7067039599d62e2421", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277987, "uuid": "a266b603-0ec7-4926-8a62-b6711e2aa014", "value": "T199D0A9C833E0A33018A5C8A3A36E0C43AA94B842788B1C08A0CAA9B15A4CEC5E081B02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277987, "uuid": "3cd191a4-f4c2-41b8-815c-a47ccf6f1f74", "value": "6:IOnFflE0FXkUuUlQACNQrdkUuUlQACuu5ACgUwRdn:q0FtuiCNizuiCuZCgUqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277987, "uuid": "00af5e12-548d-432b-89ac-8e6900760817", "value": 223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277987, "uuid": "a580c593-a2de-4cd4-bad0-f6007a6e9d18", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277987, "uuid": "75950a21-f22e-4b7f-9cf2-92e8ac155aeb", "value": "819c02bb5bb1a3477ac104876d76b95eb2f3923d48281854645b7ad90c7a22b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f10f3b-b566-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649221160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221160, "uuid": "9d5435a2-3a2d-4752-abed-afc5502f90f5", "comment": "Malware payload", "value": "238a338605ce8263a233bb5380112767", "object_relation": "md5", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221160, "uuid": "570d336c-440e-4018-8401-3a0c48a57859", "comment": "Malware payload", "value": "82889be1e6a2231124b10f9b45bd6b4c4a5b92bddc06d3d26d23c732597a7c0b", "object_relation": "sha256", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221160, "uuid": "ba568a27-a5e1-4613-9e17-08b056de17f3", "comment": "Malware payload", "value": "d9e8364b0aba11c386af31dc411e5359e497de54", "object_relation": "sha1", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221160, "uuid": "95ee428f-6711-4c54-b867-63d5937728a1", "comment": "Malware payload", "value": "ab6986da1c2fb736cb4b5bdee2a3d4927597b640be64375108d9f8ffa542457a25d19c5339a6a02e17711cb702e0d62f", "object_relation": "sha3-384", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221160, "uuid": "3faa1888-7f81-431e-ad3b-c66419ca4ddd", "value": "T18EC3128DFA44E8D6639324374602EA3706053473D5631C3FE6BBE8E7C28B82516355B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221160, "uuid": "6d27d8f1-d217-491d-90d6-0b55a46ade8c", "value": "3072:IEAiJk/dVFQMzmWunpgqL8nWExnfhhf9iisqBByY0WxQ:IEAiJk/dVeYmWcgiZ2hhLvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649221160, "uuid": "051a7ffa-a85e-40ed-b0b6-45c23a02bd3b", "value": 125224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649221160, "uuid": "fb2ab5be-f9e4-4f28-ad3b-b19ebea2bf3d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221160, "uuid": "ddee1618-c374-4e28-a98a-35f1768e3e76", "value": "comprobante-fiscal18022022.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b7c18d-b5c4-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649261702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261702, "uuid": "b8682615-62dc-468c-bc30-806a0a73ca6d", "comment": "Malware payload", "value": "4a2534b48cc5cbf4338066777a7a93f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261702, "uuid": "4d9174c7-3d31-439b-abba-345498614cbd", "comment": "Malware payload", "value": "82d96717faf3e135b237cd1d5675510aeeb478bec65745010c31536192ef78fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261702, "uuid": "3b07295a-30a3-4d8b-92d3-f073a314589b", "comment": "Malware payload", "value": "c9d6c17c52fc4fd4d4bf03dcadb52ba48c7442cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261702, "uuid": "1ad82813-70b3-4da4-ac87-b8b22a6749dc", "comment": "Malware payload", "value": "4f04d7d1e9c3029d3df5b5abe8ab38163cd295ccca931979b9052d3c0b8f6dd031f666747031382b49c3bfff60fa33ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261702, "uuid": "4956e170-28b3-4072-b089-da76dc36b96d", "value": "T1B6C36C57B7A130F8E5BB4235C9612A06E775B87206209B6F0368465A2F237D19D3FFB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261702, "uuid": "cd852865-af5b-47ad-8f19-80811d7243cf", "value": "36daa2fda4775acd28be118b1461a7e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261702, "uuid": "a8cf524e-f4b2-4e40-8487-3695c87082be", "value": "1536:onRXOeZm5Xllsa4PKWkBRE5TSqdTqfZj1LRU4CqdGsWG6dP9dlJZAqQ7:ontO9XiapWCCXVqfZj1zCqAvDuX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649261702, "uuid": "309b9bbc-ecd4-40df-9517-a994c446dc6f", "value": 120832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649261702, "uuid": "086fe54c-423e-403e-8413-c61bff588b30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261702, "uuid": "0a015f0a-d755-4c2b-8778-9c4bb777d0e5", "value": "challenge-9db4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad4741e1-b5a9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649250090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250090, "uuid": "06be0497-67b7-48df-98b6-e826bc2c329b", "comment": "Malware payload", "value": "c0e649fa591ed6c5746d394cb2de3c72", "object_relation": "md5", "Tag": [ { "name": "Cicada", "colour": "#47E440", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250090, "uuid": "c5c55e15-49ca-4bf7-a775-4fe0ffd510ca", "comment": "Malware payload", "value": "83030f299a776114878bcd2ade585d97836ef4ddb6943cb796be2c88bcb83a83", "object_relation": "sha256", "Tag": [ { "name": "Cicada", "colour": "#47E440", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250090, "uuid": "de6b3889-77de-411e-8325-cbf3ea7565b9", "comment": "Malware payload", "value": "d2b8f4fe6eedb8b87521772fc823da596f2403b7", "object_relation": "sha1", "Tag": [ { "name": "Cicada", "colour": "#47E440", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250090, "uuid": "fb6b33ca-ccde-4c9c-90ac-9e6bb3f1453c", "comment": "Malware payload", "value": "d1df058578e2f08d1732bdf526eeabaf63b5cc766f26e5150f58bddf104afc77c243b6649ca8805453032ee18e3c16b6", "object_relation": "sha3-384", "Tag": [ { "name": "Cicada", "colour": "#47E440", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250090, "uuid": "2dd71717-aa45-48d8-8d8d-b8d4a47e6af3", "value": "T1A963195932A500BAE1679278C8A39E46E7B2F852437A838F4764C35F1F537C17A39371", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250090, "uuid": "1486f9a6-5950-4d5a-8f6f-16087dafb6dc", "value": "73ce8117f37a845a6469e9b28d0c7b11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250090, "uuid": "2b3e4432-a37e-4f4d-9a6d-43a31f5d47d4", "value": "1536:oygz4wgM7hxyTaqxMU/sP7SjGx9J0hutfFx+Tx9A3X:UpxyTaqxMU87w0J0AtfFx+TU3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649250090, "uuid": "02e5a4be-bb1a-4a5f-b9d5-bc45e80a5300", "value": 71831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649250090, "uuid": "4cd25594-dbd7-4be6-a2a8-fc87a114a2d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250090, "uuid": "22117d62-2ca0-4f22-8953-f9935c603d79", "value": "83030f299a776114878bcd2ade585d97836ef4ddb6943cb796be2c88bcb83a83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c8d6080-b5bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetWire)", "timestamp": 1649258437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258437, "uuid": "a2c963d6-4de7-4599-9274-f12c21e2aadc", "comment": "Malware payload (NetWire)", "value": "8ce30bd69935d2b0f7e37dd8ec5702a3", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258437, "uuid": "56487bf7-e930-47f6-88d1-da2fb8281fac", "comment": "Malware payload (NetWire)", "value": "8314bda2183be141b9808a5bb5c748e99e558fb3d07a87499119dc14d39804b1", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258437, "uuid": "3d13c6bc-faa5-4c7d-b465-2a980af9fdea", "comment": "Malware payload (NetWire)", "value": "4dc1271d4a3983d9d40756c226d5d6ec50a3854f", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258437, "uuid": "73257444-b0bc-4cb2-af26-da3ab0565c09", "comment": "Malware payload (NetWire)", "value": "32a234478d10ea97816ede1757aa0cc9426251e8299e3fcbae1ecc4ab896a06fc32370f88c3d8285465f5ba707ff265d", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258437, "uuid": "7cf0dd5d-c01c-4533-954d-dea58de0a54a", "value": "T1C84165EF318B7020671708F1981F683F6C659122C6788540B618DFC55EBC1A9A317E7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258437, "uuid": "62e3ee5d-8caa-40c5-84a8-6532d88a5631", "value": "48:4Lho1YFyGrc21UqrnQnwQdxlM4wpJMcvvTRAwj5:4qJOpdrnQnwQtwpJduM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649258437, "uuid": "6f2e0e50-7379-4f9d-a3d9-23ad20e19742", "value": 2244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649258437, "uuid": "1d4fe373-a1b6-4a54-ad1e-949e176aba78", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258437, "uuid": "8c218c66-de34-41dc-bcd7-adccec4b925f", "value": "DHL_OVERDUE_INVOICE.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56bd2d56-b604-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649289029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649289029, "uuid": "2cd8f2d2-2038-4b88-a1e2-d7e3f3384d02", "comment": "Malware payload", "value": "6a2cf784b5b3c0905d6af96e6be7d9a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649289029, "uuid": "bbab3720-6415-4bad-9b71-35c47941c674", "comment": "Malware payload", "value": "831bb308a9f1762653bfdfb2404b801b39c68e5563f215fda502b39aa725827d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649289029, "uuid": "6f9bca14-a512-4e72-908f-ab324a357d33", "comment": "Malware payload", "value": "21dcf2af82ac63dfba0e39e8797216130638569d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649289029, "uuid": "14138792-9498-4730-8ac2-04a480b95616", "comment": "Malware payload", "value": "3af5740735b9803f4bc129dd2804e8c6c98aaf44405e1642df6980c8ad84d3b3798d35ffb2b6a733f899be84bfb1ddd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649289029, "uuid": "de19ea5a-f5f5-4ac5-9a58-94ac96887bb0", "value": "T14B64BE93A3648561E7144679A813C8B51C3D7F359B03762BA3E1BECF3AB0247366532E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649289029, "uuid": "59f828e1-52df-4777-aa12-1025bc2dafce", "value": "a758f977f5c6bfb8c4eb2cdb0c48b781", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649289029, "uuid": "e461cfa7-f2c7-417d-a623-c75e8326a78c", "value": "6144:GmEdSunAqHdroKcykhPBbiMV5xzr2fXyIJxpHC/N:G4ujKyUp+gO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649289029, "uuid": "5b34b698-f291-4d21-9837-04350ca58c98", "value": 323584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649289029, "uuid": "ce1d976f-40c7-4d59-bda5-f5646ff404f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649289029, "uuid": "d586223c-106c-4b4a-a415-3b78228d3551", "value": "831bb308a9f1762653bfdfb2404b801b39c68e5563f215fda502b39aa725827d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4908eaa-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277992, "uuid": "294952da-bf0d-423b-94a6-e71e749ce320", "comment": "Malware payload", "value": "627e3155e8c997712c0cfe631316ee19", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277992, "uuid": "b2b5d703-ddc2-48d8-9c77-363fe3bbb9fc", "comment": "Malware payload", "value": "8397dc140252720ff66fd494b632e0b490e40a8210c9c95561de70638da35f34", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277992, "uuid": "df917e80-5756-49a3-8fb4-fe2d70f3c57d", "comment": "Malware payload", "value": "74c41547c7daa4d5dda78b083ced64773ec4a532", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277992, "uuid": "4f11d2a9-c239-497b-861d-0b719c696c4b", "comment": "Malware payload", "value": "3baba4e0401ff51d9ed5c52345ef919c51d52ecfffbdd1a7df8c63c2f0e49b2575949d4a2bad2df854d0d5e0db5da53b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277992, "uuid": "d530ecad-c343-464a-ae23-5cdcf92f246c", "value": "T1B341B6C0B5B5A8713C67E4BF237F1D183595A4E42CD25D082CE47CB6ECCED4166850DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277992, "uuid": "5b10b4b2-4bed-426d-909c-85880662ecd7", "value": "24:IjbM0baWmHIb10qlaEHb9vbPdbpk0brSl9z8b/bRb2:+CzEDXPSl9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277992, "uuid": "85c21da2-fce3-4945-87e3-fe18f7fe4b84", "value": 1977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277992, "uuid": "d4ca06d0-2f95-4485-9fc2-a8ccadf6d467", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277992, "uuid": "b4bcd62f-4bbc-4d16-8033-44bdff3ad7b4", "value": "8397dc140252720ff66fd494b632e0b490e40a8210c9c95561de70638da35f34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53c2733-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277994, "uuid": "573a6392-033d-4029-a2ab-9ae0a5f86211", "comment": "Malware payload", "value": "ddfc37c2324929ba2b467d99417551bd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277994, "uuid": "cd91c106-1a5f-4b2f-b1c5-32e3e2c81911", "comment": "Malware payload", "value": "83b24906d754d2fbbb6b06302d8b50cba1586fb15b62a68d6f524a66389faeab", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277994, "uuid": "c8d70f51-9729-44b8-9162-73c779d56c86", "comment": "Malware payload", "value": "cf0c084f704288e838dc44e14f361c24343277ef", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277994, "uuid": "c6967b65-5a38-461e-9bd3-0ac639f3c97a", "comment": "Malware payload", "value": "170cd59a4dccd3e6404c86a3e51d00a9696d204587f5e53a731e66e6c9ad6bf5952d3959fefebed5c24cab8f70a5c2ff", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277994, "uuid": "063a93ba-3c46-453c-948f-7bbb0d1b6c19", "value": "T11EA1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277994, "uuid": "c3027c72-2d92-420f-987f-104729704a2c", "value": "96:qRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:qRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277994, "uuid": "b4a9eed8-be1c-454e-ada8-63710d189248", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277994, "uuid": "5bb1da57-4e70-4972-b4cd-184c7a46c866", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277994, "uuid": "1f18a97d-3e7b-4989-a25d-b08a7c4310c2", "value": "83b24906d754d2fbbb6b06302d8b50cba1586fb15b62a68d6f524a66389faeab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a637b67c-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277995, "uuid": "c04ba421-2797-4dd5-89cf-bc5a21525459", "comment": "Malware payload", "value": "d87243a2239caca3edf51ae948215e2c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277995, "uuid": "2a03b336-4df0-4961-8ce0-85c0b64fb3fc", "comment": "Malware payload", "value": "840645e75a2f24c16e7ba6d6d3282bf9e51daf9587fdc3978da2372b13a06531", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277995, "uuid": "7670b4ba-d93e-48ab-a319-d168f94e2e22", "comment": "Malware payload", "value": "8767df70fe8663fc88e7855a9eafc659a8fec07a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277995, "uuid": "9b322101-25c9-4260-898f-d3578dd80a4b", "comment": "Malware payload", "value": "de7985a268cf671e2888bdc7c5aa2d037095ce64fb52540e298baf7fc7cfeccaede29f37525cd59a1b9cf9abac9025f4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277995, "uuid": "97ab79f0-96b4-4b1b-a63d-4c59c4209799", "value": "T13DA1E750112C1AB17346697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277995, "uuid": "6125a174-ea9d-4dc0-a68e-07f971159bcb", "value": "96:2RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:2RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277995, "uuid": "9e76727d-5c94-4e9f-9dd4-88d01ca20a29", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277995, "uuid": "613334d6-2e8c-4605-bec9-1bf125198f9d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277995, "uuid": "988a53b6-c8d1-4d86-90a9-14a9ab3d43e7", "value": "840645e75a2f24c16e7ba6d6d3282bf9e51daf9587fdc3978da2372b13a06531", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e639146-b5b9-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649256829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256829, "uuid": "4fbf67d1-04ce-431c-adbd-e8bb306a39ad", "comment": "Malware payload (SnakeKeylogger)", "value": "d3d051c1563bc336a001c82cd6609095", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256829, "uuid": "854c2177-6349-4e42-b865-15858362c2df", "comment": "Malware payload (SnakeKeylogger)", "value": "8450742ff54356842a08a92cff45b930cf310cf1b3eb7dfa34a2889062587b56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256829, "uuid": "119fe0cf-c03d-4961-b5ad-b9bcb1933740", "comment": "Malware payload (SnakeKeylogger)", "value": "b93a9d7369835f7b4e8da929e9660f31ee526787", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256829, "uuid": "908bcb9a-d5fc-4abb-a3bf-d6a13ab6afbe", "comment": "Malware payload (SnakeKeylogger)", "value": "b6c9e84f0087e2b87f2d4bd6e52744d86138c38adb54d2c5387d924b0e6709fa08d54832fe0c48390dccf9f863a75ed8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256829, "uuid": "e009ce3b-1f5a-426a-bf87-96e8817f49f0", "value": "T147251260F2E9599AD52557FA58314000133BFB2B521ED34F29B672CE6DB3BC2016AF1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256829, "uuid": "33a49bb0-8bad-4b9f-89cb-dac787659d3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256829, "uuid": "07231123-8e3d-45c9-b83e-28227f5846fc", "value": "24576:fgjj/RocpBFLVxGHr8kOkAtWcn7wrTDxJFOVDe4:SbecHFB4AkOkAQi7wrTAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649256829, "uuid": "97de89c3-d458-4422-a81d-9b562755039b", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649256829, "uuid": "550b2c03-53a3-46f0-9ceb-8a13daddbfec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256829, "uuid": "2bcd44c7-0899-44c9-8e2b-d7cb4f289cbe", "value": "d3d051c1563bc336a001c82cd6609095.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35bc87c2-b5bc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649258050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258050, "uuid": "dd7e2d1f-46b3-4e6b-a1a2-cb922493075d", "comment": "Malware payload (Loki)", "value": "5dd8031795922d320940d8988df7c85b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258050, "uuid": "f7178f28-24df-474c-93b1-40bbca897ddf", "comment": "Malware payload (Loki)", "value": "847128e5b3bb02973721718159c915952f3bba62e4e68d2184e5a8a719fe4766", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258050, "uuid": "be81824b-f450-4d3e-a827-ab488b9e7c97", "comment": "Malware payload (Loki)", "value": "ac66bde3f6cd6deaee0f68b1569f300c74717e4e", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258050, "uuid": "fa3480a4-ae1d-4217-9f8d-1de08958e709", "comment": "Malware payload (Loki)", "value": "d6d625fc1b545b99f3692bb1bae7b623dd32d906e745c430de468b4c095f14627b7935d17eae2c02e9e67f4201de7863", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258050, "uuid": "64e47507-9683-4ebb-8bf9-a4221db2ff5b", "value": "T14B1412447AB9185AC7E5E1BE76C45F1521D0BE072790CD190D16FA28C87FCEB8CB2EA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258050, "uuid": "01ea00b7-d58d-43dc-94f0-7abb7dda8c4a", "value": "3072:4E6nr4lEWvg/zQWSizRe4Y1IIp5Ed8GHXZbpgzPcaD7QxV227g0M8yf7QNLbg5:X6r4lg/U6Rm1IUS8GHJ9gzLc22fM8yfV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649258050, "uuid": "224965bf-01ae-402c-9bc8-1ea593c640c7", "value": 191432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649258050, "uuid": "77124aca-93e1-440d-9f54-d35b4c930b8e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258050, "uuid": "95b3d174-c20d-4271-98d6-33659c655a5a", "value": "Q19834.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd4a6ad-b59f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649245846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245846, "uuid": "52f83df8-539e-45a6-8fa4-f86f5a0a95c9", "comment": "Malware payload (AgentTesla)", "value": "be4683655a8976bde071a68fd1354ea3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245846, "uuid": "e108020a-9175-4223-8780-2867c5169656", "comment": "Malware payload (AgentTesla)", "value": "8575c4daa7dbe4bad80b6772ac57d4e1aad1cc5707cdefcd4cd11f4ec5a4f622", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245846, "uuid": "88e42615-5eaa-4cbf-86c5-cc06ba8d8c26", "comment": "Malware payload (AgentTesla)", "value": "57ccdfa3b77e5bd5ff4f214607bbc17372ac2c0b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245846, "uuid": "9986bc61-a23f-4e40-bd6c-834b2dcf5403", "comment": "Malware payload (AgentTesla)", "value": "48aa31f73c17b41d404424a96e2a510162cedaeb019cc5408b660be605fbd91bd8b44a23b9bf11c9b281f931cf1ad68e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245846, "uuid": "3390e829-c6d1-4443-90b9-9b1bb447b33c", "value": "T147C41258A7EBD727C5BE92B281EA54450370EB57F062C79F23CD45EE0A027D60902BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245846, "uuid": "c8664be5-9ba9-43e7-a4b4-f74b310bfdd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245846, "uuid": "e3063046-9bff-4dde-a31d-1781e73b8bce", "value": "12288:CbIJqRQi99Rnn4b5t48NlG4NJTcDcWrB04DkOmTOYkF:T+hRn4b7JWrwoj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649245846, "uuid": "9c25886f-b3bc-4798-821a-d11e20898c74", "value": 563712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649245846, "uuid": "f08f36df-ec32-40bf-9968-8d6fd622b210", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245846, "uuid": "f5253e49-a7eb-4dfc-9930-e8b0e02aad25", "value": "RE P.I-118.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ce8957-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277996, "uuid": "1a6afe41-7954-4169-b24e-955a037731bc", "comment": "Malware payload", "value": "299fea581832e5d71a584e1f7ca4c4c8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277996, "uuid": "e1f88a9d-6b03-46f1-bf53-73b495fe608f", "comment": "Malware payload", "value": "85c40458dcf42a9ac2c1b733aae586a40244522d3fec0c99c649b869af01362e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277996, "uuid": "68f9fb04-6d81-4a71-8f82-b070a720cf0a", "comment": "Malware payload", "value": "5723e415f88e7a360a35812973e22a71a98599dd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277996, "uuid": "fc70fb52-5c43-4b4f-971a-7139ade396c0", "comment": "Malware payload", "value": "5f73ea2de39ebd26bda6b0ba9f3a38bc646fefca29346a29ac5f9568ca7622400d92c7d40bf30a0d7f43b096032515cd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277996, "uuid": "e743442b-6cb0-4663-869b-048891307e67", "value": "T11F31498172B168343EE71A9323755C2075C460312D90AD8AE8E8F4F8CD8EF4A6A951FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277996, "uuid": "1c6144bb-c5a6-4388-9b6d-eada4bd3f329", "value": "24:Ij1OeyaIOeCWkaUoOe8oOeCOezOe65OebMOegeOecOl:IkV0oarS5I4eEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277996, "uuid": "9d91495f-8f1d-482b-8f6b-cc34f04c4ca9", "value": 1860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277996, "uuid": "3a4b9926-04c3-452f-bb62-40d0c639e57f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277996, "uuid": "e2b79632-8b87-42b2-a61f-7613b9892786", "value": "85c40458dcf42a9ac2c1b733aae586a40244522d3fec0c99c649b869af01362e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "942b3247-b5a8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649249618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649249618, "uuid": "054b5867-a0cf-4a75-8fe1-c8a360a1312c", "comment": "Malware payload", "value": "74bee2d2319f1ebd5e9edd03f906e76d", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649249618, "uuid": "3a556a3f-d4dd-4f8e-a5cc-5946cb150bf9", "comment": "Malware payload", "value": "864ec9bfdafa9aa98cdccf966950415a7f69475ac13fc48a3652a096470f4ce6", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649249618, "uuid": "8054c6b7-40fb-4368-8ada-a733f799dd17", "comment": "Malware payload", "value": "318cb3406a1aa4d2f35ee1ed01ff4d4ca11044f9", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649249618, "uuid": "c3cf0cec-4d96-4339-b2f4-b7b64ae751f7", "comment": "Malware payload", "value": "3fb3c3d10991d9f368317921b4e8536bfa04e4d3fe63e67fd4631f66d998a6a5421046d92cfee65d599d5e6b65bcc7f4", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649249618, "uuid": "9788c3cb-15a2-41de-bd2b-d724b0f30ec5", "value": "T157A32B42A06D7533442491DCE7690BA5E57753B890F802354E32161CFE6AEFA73F8E8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649249618, "uuid": "42c8278b-0b08-4bfb-8455-24c21e1a9c4c", "value": "1536:cyB41Trio2Pptjbmhvka5RqnmhkPOACo7QBWtO0mXZjx39+DO3fG38A193I3vG6w:TevkanMmhkPOBEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649249618, "uuid": "cbbccea5-7e6a-4b82-ba71-9afe0fbf3bff", "value": 105032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649249618, "uuid": "f936023d-77ad-4d16-9451-038db2bca019", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649249618, "uuid": "e63d2f77-ce7b-4c34-ae87-44e3f861515d", "value": "FOTOOOOOOOOOOOOOOOO.jpg.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da9156d-b5a2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1649246950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246950, "uuid": "2a81db90-197d-4b3b-9654-51f3bd2b888c", "comment": "Malware payload (Stop)", "value": "e841e282793135040dd77d5a639a3874", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246950, "uuid": "3d487deb-7372-4c89-bf80-cb913e18369a", "comment": "Malware payload (Stop)", "value": "86952bc63598b98d3695e09a6482b4af5edd4c596e5a6c2a2b84ca7f0d0cfa3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246950, "uuid": "65ddad43-d4e3-46aa-81e4-388166dec32b", "comment": "Malware payload (Stop)", "value": "f41b257ef8b03d3519bef60b00ae66c7af5386a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246950, "uuid": "c70f08ba-eb10-4e7d-88c4-15e5ee5b6645", "comment": "Malware payload (Stop)", "value": "b1d40d92b19aec5d74e0cb0dc8a3d2676c2e0b0ff7866c4a25fd1114d63f8b3a80a7a1bd6dfd8ffdfdf5cf2ba15faa29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246950, "uuid": "d485beda-7204-44f0-8dfd-c2938a1ffcc9", "value": "T1E7F4F111BBD0D035F1B706F45EAED368B92B7AA05B6490CB66D816EE06347E4EC3134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246950, "uuid": "befb8b09-362f-477c-92b6-6bc0405c8d3d", "value": "25245420ce2e5010c32179ae5d5b5793", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246950, "uuid": "0e7ab5e4-ac4e-47cf-84d7-207cdae89301", "value": "12288:OIkYdJsYXZpNDyUJQ3nvhyu++04NijYDnkwnT04/qRUvW21uQq:OipXpDxm3nvAu++VBTTqREzuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246950, "uuid": "5d53d8af-9074-4c57-82fb-db0841243026", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246950, "uuid": "ef1b90cb-d11b-48d1-bed2-6bbf68193ab6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246950, "uuid": "8d71c242-f7b6-46f0-a386-43821e6bce0f", "value": "86952bc63598b98d3695e09a6482b4af5edd4c596e5a6c2a2b84ca7f0d0cfa3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c8f66e8-b586-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649234868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234868, "uuid": "c168a785-f394-4314-94bc-080f096244ec", "comment": "Malware payload", "value": "bc388fbca6274ecd04a68c6b0aa5b9b1", "object_relation": "md5", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234868, "uuid": "771f0f02-4782-431b-817c-d0a1c122ae28", "comment": "Malware payload", "value": "86d33d2735b0fe8791661289f98eb77357007a006dcbb6f043bd84d4313d2e6f", "object_relation": "sha256", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234868, "uuid": "20718409-d96c-4756-9ae8-01b2e0cceb3a", "comment": "Malware payload", "value": "82b9ce83e09149d4d014d393d4668dfb6c08f468", "object_relation": "sha1", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234868, "uuid": "f7637642-2055-4e03-b76f-6599421b2878", "comment": "Malware payload", "value": "434e477a76170cf211adcf3ea83b29c5fecdf676ce114e982c942e2a62c04eb2f45e0b1657ecce68d2f20194525af579", "object_relation": "sha3-384", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234868, "uuid": "3ce3ceb1-9fac-4444-8382-c7f5c50d1d70", "value": "T1274423CA0D65254C381E358E3C794493970322E53F7A93B96BBA5FE389909E3520BDC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234868, "uuid": "42607d6f-c3ee-48f8-9e13-7741fb32b85b", "value": "3072:HlDiQNZjFiHfuGoJFH5YskWuuZBy4WofMihW3DfyxeYM91KBmn5tpL5n09Hbwkcz:gQbjgHfItDkCYTB3+sJDWlbgrNcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649234868, "uuid": "a8936404-7185-4b54-bf1e-d0b7810c3aa1", "value": 254395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649234868, "uuid": "75759cf3-eb30-459d-9938-805ccba94efe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234868, "uuid": "98368207-02b1-4f09-ba54-adef857acc84", "value": "b83f339f-cd73-4807-7273-d76ad7c1015f.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60206eb9-b570-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649225479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649225479, "uuid": "fb52ea07-4e4d-4585-b4d6-204ad04174f1", "comment": "Malware payload (RedLineStealer)", "value": "c4753d4efda428971afd33ec13a00e9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649225479, "uuid": "304c40ba-dcb7-4d90-8cc1-af6f7f90de99", "comment": "Malware payload (RedLineStealer)", "value": "8704c0b6842fd04928290c56a7cacb70e920c1af0ebad2bc981d5005345377b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649225479, "uuid": "f0808cc3-6527-49f4-81ca-2e621c5c8da5", "comment": "Malware payload (RedLineStealer)", "value": "8801c82e95d5d5ab2c87e81b6b7768142df957f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649225479, "uuid": "c05f498d-a36a-46b2-933e-89022c81cb57", "comment": "Malware payload (RedLineStealer)", "value": "b5cf2db3d7449932b9bab2cf60793d2cfc553d6ab5a9bc7854847dc0f65cd3b96052dc5387927129405a4be5918b6c5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649225479, "uuid": "527256af-a5bb-49be-896d-ee0e51f70052", "value": "T139447D00BB90C035F5B716F499BA93AC793E79A15B3491CB62E51BED5A346E4EC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649225479, "uuid": "99ec3235-abe7-4c75-afd6-64e655cd738c", "value": "4015140a4b9194b9643a2e5ad5a6ffac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649225479, "uuid": "7835553e-50fa-4f7b-b902-023257350f3e", "value": "6144:rpWD21e7aRcIcQylq16YQvZ4y40rTWWotwr64U:rpWAOkcIcQcq1sx4y4Uotwr6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649225479, "uuid": "10ecbbda-c8d4-41a7-a1d9-ff7e1e09800c", "value": 257536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649225479, "uuid": "434169a9-6d6b-4bd1-a7c3-9f6d06bf470a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649225479, "uuid": "80032979-7997-489e-8f54-29819084d153", "value": "c4753d4efda428971afd33ec13a00e9b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "928b33fa-b59d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1649244891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649244891, "uuid": "f45e7c66-41b1-4c5f-99c5-bd700d963eb3", "comment": "Malware payload (Quakbot)", "value": "6aaa67af6c73640735f0451021b671de", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649244891, "uuid": "bac62c25-e2c2-495a-a2cb-51408d364c7f", "comment": "Malware payload (Quakbot)", "value": "870f91509fd2b3bf182cd1bb146032e1139dcdc90f344c2fe67f7a8ea7429ccf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649244891, "uuid": "7acc81e8-2ee0-4807-a95a-0e170be48c86", "comment": "Malware payload (Quakbot)", "value": "8c8a9bfbe37341c36597e4f8dd16bd35cce6c6c0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649244891, "uuid": "0a006ff5-7978-466b-a387-b5aa2a2288d7", "comment": "Malware payload (Quakbot)", "value": "0f35ff73af535c667eb5ba0ce44a165849fd09f1d0101fcf90f183a77201bac5d5311ecd1cc8e777b8cc4b7c31920bc4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649244891, "uuid": "15ed9810-af99-4b68-bf11-b5f24e116d75", "value": "T16865AFBC75046CDAE66F06BBDE96ACDD13B6262299C794CD807577C309A3372EE02C05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649244891, "uuid": "25fc22e0-16ca-4972-a4a0-f0d1ad848903", "value": "1538717eb64bec210d6f84c7331143bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649244891, "uuid": "a13527d8-798d-4862-b067-1f21561c1c98", "value": "24576:3v3YrrLEaF0tTHMjuX5PmnKUz3NL3BAYJWDJnh+idFsv3YgPmHF:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649244891, "uuid": "d31012b4-5c0b-4f15-8884-525666703ee8", "value": 1420800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649244891, "uuid": "5769c890-9ef5-4d04-b182-15b2a529d488", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649244891, "uuid": "12b88c18-7501-4b49-88e2-78c82b4c5a10", "value": "870f91509fd2b3bf182cd1bb146032e1139dcdc90f344c2fe67f7a8ea7429ccf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "532d2c0c-b5dc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649271843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649271843, "uuid": "8b96a4d2-fc05-4ccc-a00c-f9bdb6c94ddb", "comment": "Malware payload (Formbook)", "value": "8838db5c8b5fbe98c6ed6dc395ff9c60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649271843, "uuid": "0bc6268e-561d-432e-a12d-8e3fb398a88d", "comment": "Malware payload (Formbook)", "value": "87a811832bc1364726f37dda09d1530aeceeaf7fa9bbbfeafadea985ce7c3f06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649271843, "uuid": "2a3edc17-0742-4240-b414-8e68e5c5773a", "comment": "Malware payload (Formbook)", "value": "333ae52c84e7e206066e1b1e1ed389292b682665", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649271843, "uuid": "93b6eb44-378f-4ad8-855b-60cac21fb9ed", "comment": "Malware payload (Formbook)", "value": "c428d73e3b1ac18dfea194843df6cf46a7e75f4dae0b3413776bbc5b1b60701f224cc87aa5e91df38d1db41500d2d9f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649271843, "uuid": "3c975d02-5513-41ae-9c26-3b53b9004ea5", "value": "T15EF4D51133D82F52E4BDBB79E068608847F1BC8AE725EA0E7DDD70E91576F809A40727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649271843, "uuid": "7963845c-114b-4a3d-9f55-411b58978409", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649271843, "uuid": "1537ece4-1c73-4006-aa63-2610f81fb24b", "value": "12288:vj/pWH2ux71TlHy71O6n0jGaROWwLMNfM8LO2iJVH:r/YWw71TlHy71l06+OWwLMNpBiTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649271843, "uuid": "0d5c8d64-be15-44f0-84aa-20607e36ad68", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649271843, "uuid": "1078549a-3d8f-4445-aa45-09b7d696dafa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649271843, "uuid": "b3e04666-c9a9-4b51-bb05-fa774c58f429", "value": "Quick_Shipments(RE-ORDER)J7042.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c01a3158-b5b9-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649256993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256993, "uuid": "490715a0-9324-44fe-ac1e-4b6535b0c25d", "comment": "Malware payload (SnakeKeylogger)", "value": "a5e941ebfd0277638786d681b32c6db4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256993, "uuid": "20886f57-2fb7-4102-a7a3-02b8e2bafb88", "comment": "Malware payload (SnakeKeylogger)", "value": "87bc3ff4a40f736436d5929afebdff84d6009967d3b1b3b4e8e4417706e12db0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256993, "uuid": "096327ab-13ea-4d57-b872-a0bb5f23d1d0", "comment": "Malware payload (SnakeKeylogger)", "value": "6dd5e168b76ecae666fb7bbc659066a7abfa72df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256993, "uuid": "993ea9bd-e54a-42a2-b194-39f9e6e6f45e", "comment": "Malware payload (SnakeKeylogger)", "value": "fbda7a896baef65211d40821b5b60719e49974141ee96ad2f78a5a5975373a54877e378d97e4201f3a1b93c2bacf3abe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256993, "uuid": "f0a69e66-6409-45cd-ab4d-ad9cf29e820f", "value": "T1C4A41225A7A7DB23D6AD5EB790E0248903718B03E473DB4A2BCA05DF06237D90956FD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256993, "uuid": "6babe8cb-9f40-4a97-96e3-061fe7b2089a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256993, "uuid": "ff2d1885-8c74-40cf-80ac-5ebaec314d0d", "value": "12288:lVufurOcXNhSCPCyMh1pmPELpZGkalfF:rusXNhSClMhvmiI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649256993, "uuid": "be780db3-853e-494e-a46b-367063c61b20", "value": 476160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649256993, "uuid": "808d6b53-826c-48f3-81d1-5adff0d08a22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256993, "uuid": "506543a7-dd2f-45b4-bf3d-ab86f0e84b82", "value": "Payment advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7d7f9c-b5b9-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1649257100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257100, "uuid": "c8e3a3f6-18cf-44ff-b61a-a6c422aa7b24", "comment": "Malware payload (RemcosRAT)", "value": "4a6a42977ab0eed00e67c69632c17bf2", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257100, "uuid": "256843f7-6653-44cd-8260-240fc5ee0193", "comment": "Malware payload (RemcosRAT)", "value": "883a9481a969f80c2ec86283a499ac311f4b7689812ddb2ce8250f6ab6569836", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257100, "uuid": "cc95aab8-8fed-4662-9916-19c7f91a2d71", "comment": "Malware payload (RemcosRAT)", "value": "097e8051e5db36c5f6fa1c06ea89fddbf16de988", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257100, "uuid": "b5e1f6b1-d393-415f-8f00-4c436b0ed992", "comment": "Malware payload (RemcosRAT)", "value": "bcb1a1a88bfade19e30ca6325bae93c27d44e9537c47245ba7fbeb7f3eb6b5f265c93e7c429239ba6ab538b3172c4eb6", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257100, "uuid": "df679083-8e6c-499e-88dd-278d919c2de6", "value": "T11845DF01B2F27B27EA7D5BF12550601107FA26AF6835E3142EDEE1EB532AF014A50F97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257100, "uuid": "979c3762-4bfb-495e-bfda-64392e039471", "value": "6144:vcBT0RYglQ5yr1w0hVU8UUqXNQ4K/eoAsIiVp/rO2Xfda7GJhMABC:CVgDR48UUqXN/K/BAzib62o6UABC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257100, "uuid": "2cd1ec19-52e0-4b2a-b557-85bdd7f17100", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257100, "uuid": "92e5e82f-1d2d-4375-9176-78499cf23dfc", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257100, "uuid": "2d34a2d3-2975-404d-83b5-634ca8103d58", "value": "Attachment.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f90aa3-b57f-11ec-8e58-42010a9c0032", "comment": "Malware payload (STRRAT)", "timestamp": 1649231795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649231795, "uuid": "c5c845f5-9504-45ae-8af1-85ee4f033d68", "comment": "Malware payload (STRRAT)", "value": "c6f8a8c964ea20d4a2ece21e63b85599", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649231795, "uuid": "b447827e-bc17-41ad-8a1d-3698123f403a", "comment": "Malware payload (STRRAT)", "value": "890c11b49c783acbf068a14ac419369ed9a0d71b3118008ae8b1a60b3dff2ee7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649231795, "uuid": "b7b13551-e7d2-45fc-b65a-89daffceef08", "comment": "Malware payload (STRRAT)", "value": "0271fdbe2bf2103c742f50f5c44c257b7de0a7d3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649231795, "uuid": "a6c3e5dc-52fe-4d16-b7cf-4d8e30b56e56", "comment": "Malware payload (STRRAT)", "value": "8a989968e0661edfa8f37c2c5a89cc633520c3ac4dcc4c484a584336f17423ce1e187d2700afaf3e6a759116de2055f3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649231795, "uuid": "3b9ee94c-d888-47a3-92a3-2dcd2a960e3b", "value": "T12D1405D6CDA01A5E99F5C2D432AB032B96A4E305B007DB59C7711B2FAF3266B310DD2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649231795, "uuid": "a9b091bc-7a6e-4e4c-995a-1eb7bbbf6fd7", "value": "3072:l99gOerjwYdBqk1nDGv7Lo/apXpTu3xhX0KD2r5oVXiSJmEQsGTv:lTx2fqkNDa4O5q3f0hm9iSI4Sv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649231795, "uuid": "1b90681d-ed84-4585-b54f-7af0f56a1dd8", "value": 209367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649231795, "uuid": "a05c8356-d5ef-4077-8d42-7fcfb5d77042", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649231795, "uuid": "ca15446c-f078-45ea-b29c-f942640aa458", "value": "Request For Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7a95c79-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277998, "uuid": "9da37975-7299-4ed1-b2eb-2d9b959b703c", "comment": "Malware payload", "value": "83e1c37bd17a51378005006292fb0edc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277998, "uuid": "0b5e68e1-695a-430a-8750-9abcac8da729", "comment": "Malware payload", "value": "8943e041ef2528b30c2b94d7c54d40a375a33fc43be6b2ec122fd6827ac2c491", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277998, "uuid": "f0dd1305-4e75-4dc7-b6c5-b9d0e48697b1", "comment": "Malware payload", "value": "a9dbfa69a81f95fc32f3164a18fa9d6909b39d7e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277998, "uuid": "baaeb713-c794-4cbd-b348-4dca97856e37", "comment": "Malware payload", "value": "502f1add1ab1e21cb962c432141e1187e5a97c434b9074de66cdda56b9bdc7607090589cb7eaa947eec85aefcb6ce791", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277998, "uuid": "f080b6af-7be9-4490-8616-31ed075825e7", "value": "T15CA1F750112C1AB07246697AD26FFB52B90EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277998, "uuid": "5f67ed2e-753d-4753-8cea-b59a3e2552bf", "value": "96:tRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:tRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277998, "uuid": "72a9a8f0-6f2e-43a7-82ec-f12b25ee36b5", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277998, "uuid": "ca4fc802-6f92-4e70-9331-7c05663c5bf0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277998, "uuid": "6351dff5-78c2-4b5e-a501-c0dfce0f421a", "value": "8943e041ef2528b30c2b94d7c54d40a375a33fc43be6b2ec122fd6827ac2c491", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c02b50-b567-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649221596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221596, "uuid": "a1d12628-60cf-47f7-83bb-6df1abf1e4d5", "comment": "Malware payload", "value": "d5bf991e94bd3d0d6d865a21657f91b7", "object_relation": "md5", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "pw 123456ze", "colour": "#8B779B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221596, "uuid": "77001001-1022-4028-96ac-46e7ad38bec5", "comment": "Malware payload", "value": "896d05bf89cb789345e4161320450f33061bb21e717b14569e8511400619b588", "object_relation": "sha256", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "pw 123456ze", "colour": "#8B779B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221596, "uuid": "e8b4b752-3aa8-450e-83ca-5f34973f1c49", "comment": "Malware payload", "value": "bc1dd3b6dda5a1254cd064ae709612b64928dd10", "object_relation": "sha1", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "pw 123456ze", "colour": "#8B779B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221596, "uuid": "9708c1b7-c6de-4b67-9ebb-fd1f3f962d3b", "comment": "Malware payload", "value": "996ae1fa743eaaead41ea70aa19e5df01129e9164e540fddc65f48aece43af77e173b72d26c71089084632e7de3e9399", "object_relation": "sha3-384", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "pw 123456ze", "colour": "#8B779B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221596, "uuid": "d34feec0-66bc-4d41-be78-453ba24194ba", "value": "T1D1B6332593656283DAB9EA74F94758626DB01D0D02E4FA0F379C43DC98D9CA87E133CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221596, "uuid": "52c7ba77-9fea-428b-aaa9-c3a7ef520198", "value": "196608:dZHZO28jGt18HY6WlFNrWHUQm4mDqaLb+QX9JdpupAx6t24PGR9fXsg5i:75qjG04rBRq2bXbzupAx6zPGRp5i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649221596, "uuid": "f9a92185-77dd-4ccf-852c-bac53a8a7ed8", "value": 10561098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649221596, "uuid": "a50e80b1-b71b-4398-9dc8-b07038114725", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221596, "uuid": "682d4482-07d8-40aa-9d6e-498f7ac1058c", "value": "PVGfsc.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc54d354-b5e2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1649274650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274650, "uuid": "31dd20e0-ffc8-4a6c-882e-893c89c1938e", "comment": "Malware payload (Quakbot)", "value": "c7796954e945ea93c73d26a3030372f1", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274650, "uuid": "2efe5a06-eb16-461e-98ca-5ef92d254d40", "comment": "Malware payload (Quakbot)", "value": "89a1fc475c266fe386fa517eb51d7c00bcd4b0262bba095d468c5f4da51f312c", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274650, "uuid": "ccf9e2b4-c21d-4dbb-8fb4-f36311912623", "comment": "Malware payload (Quakbot)", "value": "1cd70e3d55be049b2043b78a145cadec39d2fae5", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274650, "uuid": "2077131d-304c-4399-98bb-2ee596bcf9c0", "comment": "Malware payload (Quakbot)", "value": "23cf6ad29b90c8c9b5bb328c537f2ab0e4652d27e0c882f8688ba07e2c0d937bac7e2c773b3f79e07c59e8564f01d0a7", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274650, "uuid": "62cd9e3e-1882-4770-be3e-18e973ebf1a6", "value": "T1B565AFB876046CDAE66F427BDD96ACDD13B626738AC7A4CD806577C30963372FE02805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274650, "uuid": "11dbf1ad-574b-492b-b13c-22072e8fc20d", "value": "bf76170fdd1a32d24bc7fb416675e801", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274650, "uuid": "56678c27-b480-4c1e-8f59-3060ed8b17f8", "value": "24576:KDeI7ElHgumRVAAKHr5X2U1v4usbARb9smALTYSKfArYiM/eOR2R15bJFcyySCIC:KCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274650, "uuid": "aee006b6-4c73-47e3-9b14-4ff6be4f70f7", "value": 1432579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274650, "uuid": "d48ae533-6abd-4a43-bbde-38b1eb1d5912", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274650, "uuid": "28c33c2f-1241-4921-b118-2b23a6bffac4", "value": "89a1fc475c266fe386fa517eb51d7c00bcd4b0262bba095d468c5f4da51f312c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a830d42d-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649277999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277999, "uuid": "16a35003-421a-45ff-ad22-c254d265fa12", "comment": "Malware payload", "value": "a60ccec32aab12d99fed465dfa8e0bb5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277999, "uuid": "e71fc907-995d-4bd2-91dd-386bc6dcff0c", "comment": "Malware payload", "value": "8a14613bfd588011bc3e815e2c2ac7e788a9c0c5adae6225286b4afa921c3acb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277999, "uuid": "208ee435-7599-43da-bd80-ee78083df9f3", "comment": "Malware payload", "value": "310d4dcc52a18af9f1026ad04e5b58a473ca3ede", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277999, "uuid": "693bf923-2fbe-4cd3-89a4-88fe415a34b0", "comment": "Malware payload", "value": "01f658913dc764a4fbe76989b2ec3def9119676b93b23e3bcde71160243db7f29583177e2df2578be5a89860f6f56e7b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277999, "uuid": "fc60aa12-037e-4836-82b2-4f3f70539e30", "value": "T19CA1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277999, "uuid": "876bfd9d-1cf9-415b-b1f0-10ac22a4b490", "value": "96:BRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:BRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277999, "uuid": "787e1958-94b4-4aca-accd-c22c7dd89169", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277999, "uuid": "fc883e4e-2339-466a-bc5c-dad58ee71ca8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277999, "uuid": "643f5d39-9281-4503-aadb-649317ae11cc", "value": "8a14613bfd588011bc3e815e2c2ac7e788a9c0c5adae6225286b4afa921c3acb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a914d059-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278000, "uuid": "84b8e962-62db-4f42-a072-f0614fe1739b", "comment": "Malware payload", "value": "3a1ee8cc7363a601e1a0bd9ab48ad650", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278000, "uuid": "c93e6cf4-b7ce-416e-bea0-d4f5e10f295c", "comment": "Malware payload", "value": "8aa31d11d7cd5eeea5ede909024a77ff3371dcc1a6e7191a44ed5b11808c3afe", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278000, "uuid": "579683a9-8de2-4cb1-a953-2bc0d6c3c697", "comment": "Malware payload", "value": "52919a0376aa63251fb8b72c04ac57ec91f0d787", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278000, "uuid": "65bb9bcc-05cf-4311-a9a4-6fd58f382f5b", "comment": "Malware payload", "value": "961f854162c2a9687f3e5826edfd9e52da70f6d783623d60394d2cb14f8414d23a13bab98a4dc659a7b00116db91f006", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278000, "uuid": "847183bf-c21c-4b44-980e-6c6d8a14426a", "value": "T143953374B7DA31BD5AA8A577ABFFC938302F91CDA0514BE06DA911CE1406431DAD4F2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278000, "uuid": "2935caea-b79c-4416-840b-5ed613ff19f4", "value": "49152:tT0+oOBiXLUNaRHKmjsbS21i2F/ecE+0n9aFctnpbbTruN3k:tos909Qg6ecEZHyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278000, "uuid": "8f098b27-c39e-4b12-ac9e-0636abeee061", "value": 1912832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278000, "uuid": "699ca850-7bcf-488e-9f95-b20cbed1ffeb", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278000, "uuid": "8000aaee-da04-4361-976d-32e60bf5d849", "value": "8aa31d11d7cd5eeea5ede909024a77ff3371dcc1a6e7191a44ed5b11808c3afe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6218bf8-b5c3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1649261379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261379, "uuid": "b9cf271f-9095-4ed9-97a0-fbbc1a1ffbe5", "comment": "Malware payload (Quakbot)", "value": "02456456ee0790ce555b503dc7865d86", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261379, "uuid": "cdb4ca95-1a8c-49d8-8855-6a2ce147e3c0", "comment": "Malware payload (Quakbot)", "value": "8af6e6ec8b4d613b784142a302ad1e662230be7676ada1f4291b188eec3bb705", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261379, "uuid": "502f949a-9435-4e19-9022-6c87224aebba", "comment": "Malware payload (Quakbot)", "value": "6f4b9910fa6fd310e666d2bd1c9bcbf5433a50f6", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261379, "uuid": "9b3cf77a-32e4-4b2d-b202-786772797700", "comment": "Malware payload (Quakbot)", "value": "a3ce1070b0e26caa8dd82bb7f12b137c1b616e501faae2aea3ea1283bf2d1243e35bf53cd9e9317aaf20e19286e023d3", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261379, "uuid": "89e61b09-4e56-4466-a53d-fd6748b0005b", "value": "T143E3BE1BD8289D03D168D77CFF031EEE6B0D2244645179EB04612E4F7F762A38E8E55A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261379, "uuid": "b76bd667-c986-44b4-9670-5bfb31665c8e", "value": "3072:yKYsgP9LEhWYjnsCbxKljNE5gKmFOi+uaE7O6Cb:rYsgFohtrsCbxKljDKmFOi/7OTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649261379, "uuid": "f7557988-3cb5-447a-aa6d-5e11d18b0861", "value": 149600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649261379, "uuid": "ab1a96f6-151e-458c-ae35-ad508a9175e3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261379, "uuid": "6871070f-ed9c-4506-9818-d1104a0ce950", "value": "354.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a98be928-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278001, "uuid": "ea0ab808-184e-4abb-9c7a-1fc1ef881144", "comment": "Malware payload", "value": "e6e59632b1c92523a8620d52973aa5a9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278001, "uuid": "384e7b07-560f-4bc8-b8a7-d75a323eae2c", "comment": "Malware payload", "value": "8b16995dcb7e2ecdd322b47981df409c49801a8d1a8c1ba4b9ee80964b0c3cd8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278001, "uuid": "7ca380bf-328a-4704-b5f0-5d5762f1f1a1", "comment": "Malware payload", "value": "f5789e28ab8638c4540c43b24c3e62472773304b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278001, "uuid": "833ac8e8-2818-4045-8ff6-7ff853288593", "comment": "Malware payload", "value": "d7b99601b73c77303da6222bd72132bf71a1ab0320387d8c661953cdd00adc7b03bd476e3a25424c4f1b615d3f592df3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278001, "uuid": "60807f25-0e87-4880-ad53-e6349a781a03", "value": "T1E7A1F850112C1AB17246597AD26FFA52B50EC81B097B7B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278001, "uuid": "d72fa02c-192f-4e5f-8240-777fc025c4cf", "value": "96:GRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:GRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278001, "uuid": "5acd8f9c-4592-4c5a-bf3e-f084fe40abca", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278001, "uuid": "67c63f57-ae77-498f-a16f-9f21c46aabe7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278001, "uuid": "9017d060-b0c6-4504-88ce-4fd4ec50fe6c", "value": "8b16995dcb7e2ecdd322b47981df409c49801a8d1a8c1ba4b9ee80964b0c3cd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0cee97a-b5a9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649250176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250176, "uuid": "233a90a5-47da-42d5-9819-a30229e2e347", "comment": "Malware payload", "value": "b19558d0a82a601885b453002d39a641", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250176, "uuid": "31751489-92cc-45f9-81ba-3ba26edba5a5", "comment": "Malware payload", "value": "8b81624ffc9cebd7b26b2c75ae17dfe36a6fba7534716e01c9bd7e60294d1ce5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250176, "uuid": "02c35127-7b4c-4b6a-a19f-e3dcbbb597fd", "comment": "Malware payload", "value": "591154885461049fb133e3195ce391d7b14418ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250176, "uuid": "09b4bd36-e607-45be-bea5-ab1505773472", "comment": "Malware payload", "value": "f6ee4deb92011e365163bc54feef4d62647a92b24902aa12e588732917068fcaa8474f1cda47423485e5076d10fe001c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250176, "uuid": "fcedf88b-273b-499c-b663-fb1ab5dd6701", "value": "T12AB4125AB7ABA906D9AD45B395E7150403719B03E132EB4F2EDE6AAF17013E24C01BC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250176, "uuid": "8ad93dfa-3eb0-4133-9f82-5bfecee12450", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250176, "uuid": "f79ca888-9e2f-4a00-b41d-86ab65be0a08", "value": "12288:n4KFpnPecsHjVyMR7iciThAiFE6IPgJXJU2/UuT188Cd8Yecl7ruF:4jVydtAiFEX4Jr/3utYcl7ru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649250176, "uuid": "d18945f5-55bf-45a8-8eca-ee97c6701487", "value": 534016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649250176, "uuid": "b6db1fb7-6052-4e9c-b98d-ce5b71c9e474", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250176, "uuid": "4818f710-e868-483a-8903-efb108fb5209", "value": "Confirmaci\u00f3n de pago.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d405d8-b577-11ec-8e58-42010a9c0032", "comment": "Malware payload (Hydra)", "timestamp": 1649228730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649228730, "uuid": "587e2e63-91f3-4b20-8558-5f9977bc8468", "comment": "Malware payload (Hydra)", "value": "0359ed6cf8b99cd8b7f41512755661de", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649228730, "uuid": "b9717c7a-0002-4f34-bd6f-20708e967d9d", "comment": "Malware payload (Hydra)", "value": "8b9158ba3138949586cca3973a975745302f6d7e285299cb6b38c53a7c353f2c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649228730, "uuid": "c6d31487-1daa-4d72-aaed-5ba56ef32a0c", "comment": "Malware payload (Hydra)", "value": "cbb56158e4cd662b51b58f61f6efcb2dac4fb7a5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649228730, "uuid": "2afdf6a5-1cfb-4cd1-b82d-6983e39e15da", "comment": "Malware payload (Hydra)", "value": "5314cb573dc33742b3f2b6ed9df49147ae95d8366aa190e10f63356829c8ca9df049e94b9c7bd721175007ce4655d323", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649228730, "uuid": "2201fadc-cb27-4d77-864a-038b0ed3801c", "value": "T12AF533D5F7F18699CDA24AB15B47A8514A780D489220F3322B533BEE04B6CFA77438F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649228730, "uuid": "9e340ef6-9c4c-437d-8e89-ab82328f6a68", "value": "98304:TRCDv8/eakNx0Zq4MQEOLMGbcjeB5UY7neMKSR:dM8mRxDLQIEJnLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649228730, "uuid": "9bd69637-5d48-4c79-bb1d-6e0af3ee8a7e", "value": 3480460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649228730, "uuid": "9f14a069-35cd-42ad-a719-a67693afe94e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649228730, "uuid": "8113f1da-d513-456a-adf7-bf9333cf99b1", "value": "easybank.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa62ad00-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278002, "uuid": "28040dfa-832c-4727-92d0-3b0aa1b42c28", "comment": "Malware payload", "value": "4a5ab4dd6302afd7a378a5de83db8e6e", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278002, "uuid": "726ddb00-0098-44c8-98c5-c4c06ebf7722", "comment": "Malware payload", "value": "8bc9230ff72ba80c1f5f54a09d7bd74ffd13ef25cc5bc73b589cdfed3142b286", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278002, "uuid": "3c8e5f6d-b26c-4e2f-b900-4738d8b2f617", "comment": "Malware payload", "value": "1c4f435f7db9d4b78280c0dc108ff2f12633a8c8", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278002, "uuid": "8557b195-411f-44d2-9935-6210bb4e2d4f", "comment": "Malware payload", "value": "4c0ad6ac56cac838309fd1f5a5011d7d788c4d5d0d609f233270f9e88b46c20473494b6c498511af4b1f9e84683b5a7a", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278002, "uuid": "47c4f948-015c-4145-a2a7-c692a193b476", "value": "T16C05330951B77CC9F5AF6A3812130C98C7AEA1F2A096929912C84C9511777FDB34F3FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278002, "uuid": "89a68d86-edf7-44fb-9f3a-fadaef163565", "value": "24576:IVbRYvjxOgOhntwZIdc/th82I0uDkbekAz:IDSOgOhntWID2I0WkAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278002, "uuid": "25b3c264-714b-41be-868d-bbc59d0a7073", "value": 872448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278002, "uuid": "2d6a55b3-b391-4a2f-a6ea-9773b382c9c3", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278002, "uuid": "f3e75dd6-483b-4300-b1d8-c2275538b929", "value": "8bc9230ff72ba80c1f5f54a09d7bd74ffd13ef25cc5bc73b589cdfed3142b286", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c3a6a5e-b569-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649222385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222385, "uuid": "b7f1dff2-621c-4125-a1a8-db3d54548779", "comment": "Malware payload (Heodo)", "value": "9d0e2153f4b8832413c467fa4812c012", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222385, "uuid": "a425c07f-369c-4dfe-9d98-d722f7fe61b3", "comment": "Malware payload (Heodo)", "value": "8d3d42bef9fd408a123dd6eab36f020e0c0c3d6fc492faa0ae2d086192ab4069", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222385, "uuid": "6c4d7068-6537-4369-b1dd-9a2fad7a04b2", "comment": "Malware payload (Heodo)", "value": "2721d81f9ed1363a085abcce29947032bb459b5c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222385, "uuid": "e3dda2f1-f404-499f-a637-becf15d4f484", "comment": "Malware payload (Heodo)", "value": "3fd37499723d72a275a0a02d0cec7584c08511d559a03878a0f5b0516b0e2cd4f3f1eb9f693eac412273ef75afcc823a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222385, "uuid": "51704812-ccee-4d28-a60e-e287ddb8f6f3", "value": "T1DA948DDC7281C232CE7B6B758512C2A05E6D6CD06AE0DF472E886A7D7F32D84C9297C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222385, "uuid": "fa9c46c3-7385-450b-a2be-fb3200ae2e42", "value": "6eb736b73a786957562fd323f3abbe25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222385, "uuid": "870a6934-6278-4a3b-b9e5-04aaa29343bc", "value": "6144:XbfQnyfAdoAuYqMPksEeZ7fYX3WVpLQF5DT:XoynYqMPksvIsLQFx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649222385, "uuid": "0b3cbbc1-8f40-404d-af66-439ccbe39fa7", "value": 441344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649222385, "uuid": "eb10e820-8601-4904-8f55-f6067ee3cf55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222385, "uuid": "3a006ea7-6634-499f-8d86-bb5c48ba893d", "value": "YmIVboKpCIpp57HV.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "941f721e-b59a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649243605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649243605, "uuid": "31d02e88-c91a-4517-a6f2-d2c6bc4332cc", "comment": "Malware payload (AgentTesla)", "value": "faac95fc125ae50c73f8ff4cc39cfa8e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649243605, "uuid": "db74821c-59ca-4ca0-814f-3bb4d2a5e4cd", "comment": "Malware payload (AgentTesla)", "value": "8d5c82d852007085478106fd1dc7260cfd358dbb758e50eb1abe03d538cdb632", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649243605, "uuid": "2fc586cb-efea-4360-9a47-546a85fd9fed", "comment": "Malware payload (AgentTesla)", "value": "ae7b9ef0aab60c64a94a242e8e166552619b2681", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649243605, "uuid": "6e5382a8-b4b2-42bd-80b7-557730e76c20", "comment": "Malware payload (AgentTesla)", "value": "1ee851792d8470e9219a216237ca3cb9ffcd32ffbff82ba9dff367fbc4132290d33205e095a8ca57137a00d7d0d2f9d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649243605, "uuid": "92961b0e-c105-4cbf-b460-4f89b4ad14de", "value": "T1DBB3E5077256BF13D6485479C0E7092403E2AF8B3273DBBA7D45058A8E037E6ADB9BC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649243605, "uuid": "c4732138-2a0a-4629-82ee-44e3fa2aad4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649243605, "uuid": "8b9b7ae4-2b89-4e3c-b06e-e86ce07f1fce", "value": "1536:k0fob8qGiPXe5sVCCMrl/yVlKFuGbhFT8r3XFuAgHo:y8kPkssT/yGXbhFTo3XFuAgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649243605, "uuid": "43c32d1e-c1fc-4b4f-86fa-7423fb7c31ae", "value": 117760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649243605, "uuid": "3d6a222a-1645-4c56-9c54-e65fedf5427c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649243605, "uuid": "dee15cbf-8d6e-4a96-a8c5-0732a1ecf9b1", "value": "faac95fc125ae50c73f8ff4cc39cfa8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad52e4a-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278003, "uuid": "08449a52-0145-4e29-9810-34724c8df3ae", "comment": "Malware payload", "value": "2aef23c22cae127e94e6110eae3d4951", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278003, "uuid": "273b81fd-dd53-4eb7-9451-081750cd6ef8", "comment": "Malware payload", "value": "8d86293edfd75e1402f8406d8a9e918cd99de1d266cf40da5459c1937b8f7fc9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278003, "uuid": "75dbf078-f1d5-46a7-a178-377eb7e81eb7", "comment": "Malware payload", "value": "63a0857c249046e6aebc117c8d0cb87df2de8da6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278003, "uuid": "90b9d0b8-bdf9-4411-902a-c80ed6abc290", "comment": "Malware payload", "value": "3b512778990e1b05398c2d76522a74bfbff58432e05ca27f24cfc1e9d198a0df1d075e26658361143fab9855a76f971a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278003, "uuid": "402ff085-fc68-4e6d-b248-dca5a0824953", "value": "T1A7A1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278003, "uuid": "b7a1f6e8-54fa-4efe-bd46-66009213919e", "value": "96:gRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:gRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278003, "uuid": "76c95496-fa4e-4c18-8043-7578158fa45c", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278003, "uuid": "cac4f5ec-9199-43d1-979c-6f3b4e4c2450", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278003, "uuid": "9e66ebe4-91c2-4772-80bb-b331759575a0", "value": "8d86293edfd75e1402f8406d8a9e918cd99de1d266cf40da5459c1937b8f7fc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac75345c-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278006, "uuid": "2c202e36-3f08-4f38-af0f-0a6c1b764e05", "comment": "Malware payload", "value": "d1b7a3b005372d752bf2edacd2c124f3", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278006, "uuid": "9a16da02-1632-4cbc-907c-c28527569bec", "comment": "Malware payload", "value": "8dc14b060868df92acab81aa6c3d516c5f67dd55cacc81194e9892c630519a9f", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278006, "uuid": "7890dd69-be8e-4790-9a45-08e1c1494e31", "comment": "Malware payload", "value": "4f66848813417c66da709024a0ac37c46e5c5037", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278006, "uuid": "24cd7a7a-c670-47f5-8897-7b36808cb237", "comment": "Malware payload", "value": "c9376ae3619f52dea33256562bc7383071a9798164e1c05522433dc1dbfd14bab787b45a20fad5b93c653fd0568c83ee", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278006, "uuid": "eaefa680-ec53-4944-800d-b44db5240f8e", "value": "T121B533619D3BB5C780791955A45383B396B1BDDC1815F409F3FAEA8826CA0F6B0C2D72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278006, "uuid": "c7895077-f771-42c4-a5b1-d108a7b5c728", "value": "49152:DJMych6OZaIU6M9yZ29jsE4dKi4qi7/RhQrM+mvsx562dQ10LIKR7aLL:DJmAJI9M9yZqQEmKlqi7REM+mvb2TEKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278006, "uuid": "dc39da49-8fa3-4e3c-9558-a400b13cd30f", "value": 2285568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278006, "uuid": "1e0ee4f3-6ce6-4d45-9219-baa928715330", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278006, "uuid": "fbb2a3fd-6c19-47a0-8988-983471f7b6e6", "value": "8dc14b060868df92acab81aa6c3d516c5f67dd55cacc81194e9892c630519a9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c9a690e-b5bc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649258115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258115, "uuid": "58036087-05f0-418e-aca1-2dd9405f992c", "comment": "Malware payload (Loki)", "value": "8fbfbddd40c0cb3ca56c98c3822611a0", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258115, "uuid": "c413d698-7c47-45ac-9c69-ea2bbde5a1a4", "comment": "Malware payload (Loki)", "value": "8ddb95d4e8dd264af0a1b59a40711ce1756f632eda6baf6d8d7696c9e5587d6f", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258115, "uuid": "5dc54b58-6732-49d5-ac9e-ed48771f74aa", "comment": "Malware payload (Loki)", "value": "cc99167a46a1351f7fe9684109d4f544b60b6b6c", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258115, "uuid": "131c598c-cc07-485a-8691-2e5d658b1531", "comment": "Malware payload (Loki)", "value": "3c77e29854c97bb4cfe47284312986009229a203b82004c46b39055dc8b336502c0adc4afd433b62fd8d1ef3582582e7", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258115, "uuid": "0f20a0ba-d2d4-445d-9eb8-a417a2f2009c", "value": "T16014026879FA844CC96017F906AE299DA16CFF67D7316850F6A8390CCBBDA49D370D30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258115, "uuid": "5027259b-7e84-49c7-b7af-d0333ed79a5e", "value": "3072:KR+3/yhiC+umiAN2+o/4I0btuMouaVJ+q15Hq89YCpHxv3vLWpPz0BigWq:d/VCjA4h4I0YMtaVJ+q15HHzpHdePzuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649258115, "uuid": "62189384-ffe2-49e1-985e-a29fc80bbc08", "value": 191992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649258115, "uuid": "cab00619-9fdd-40e7-bb5c-cd49d8766c5f", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258115, "uuid": "bc608e50-ef1b-4d70-ac24-5fad833f5c28", "value": "DBS Transaction Advice - $10,314.00.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93e2de6f-b5a0-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649246182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246182, "uuid": "cc6340d4-b93d-4729-ba88-5e9d44710734", "comment": "Malware payload (RedLineStealer)", "value": "2ee5b64b06693f4561eb5c1b183d2dfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246182, "uuid": "a6c83cd9-4442-472e-afc6-5c7083167d4a", "comment": "Malware payload (RedLineStealer)", "value": "8e0eb9c341507feb9619ba70fdea2c2589705f693bed120e88dc70d4f941becf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246182, "uuid": "7c757b4a-1a9c-43bd-909c-c2bc9f8ef896", "comment": "Malware payload (RedLineStealer)", "value": "0baf62c8be4d75626b336a614af8b5e6d73959a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246182, "uuid": "237269d7-07cc-4e87-9dab-bdea1ba72cfc", "comment": "Malware payload (RedLineStealer)", "value": "65a03b1d8e1e25f079900f219437dfefee3f0858f39131f16425de7fadba5e034bc2a9b04f1fb31675ebb8919365bc8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246182, "uuid": "e53db657-c95a-43a2-8b4d-dd9d2086f83c", "value": "T19B25E045E3BAF047D2E8433B4700A06DA2ABBEC2A655E3E257A7B977BC30E44DD40745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246182, "uuid": "07943991-505a-4c76-88bf-5473588b3dc6", "value": "2969d44d3a1db4bc58da7a3f12e733ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246182, "uuid": "bff894b7-dc91-499c-995a-d7415550ac80", "value": "24576:GWg2pQiSjZykHXn+Xv8kKVE2DzWQ+/Ek4h58kY:GWZp7SVP3nk0R784H81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246182, "uuid": "295ff1bc-d8f8-467b-87b6-50442a0646f2", "value": 990728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246182, "uuid": "062e8d26-477a-47b5-944b-85428c14d341", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246182, "uuid": "6dfa92d4-e84e-4bac-9a29-d5941cb3787a", "value": "2ee5b64b06693f4561eb5c1b183d2dfe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c17e5be7-b5e2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649274605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274605, "uuid": "d85f64c9-220c-4c76-9482-fef424f26a3c", "comment": "Malware payload (Mirai)", "value": "66f2f210b30969be8a65e5649fe5f83d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274605, "uuid": "57496d38-df07-47bc-9b7c-910cb3f5a1e5", "comment": "Malware payload (Mirai)", "value": "8f1d8e5cb4d943e4eb2999610023575d970a640f1505a39e1c6fa87b64e9f795", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274605, "uuid": "89c2a53b-dd6d-46e6-87d0-a436baeb2833", "comment": "Malware payload (Mirai)", "value": "7e61b75942fe3a3a8014179a31a317d29a3fcc6f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274605, "uuid": "326f5e24-a2e8-4fe2-a935-e755251f6bda", "comment": "Malware payload (Mirai)", "value": "229e5aa26f6849952f6d3a2971027e50e89698f8695cc423de9b8346b04255b914efe53940e0cb2016baf58a7b541e7a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274605, "uuid": "10cd8e91-a977-416d-9a7d-36adefc829c7", "value": "T1582302394007F833CE342DF2B04CA1A97A534F6869BBA137E1604EBC5B506453DFB45A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274605, "uuid": "6987af91-651f-4247-837b-d943a6d9add7", "value": "768:78m1jL9/87Ij96pZ4j9q3UELwq6e3EL7E82iYwWiCztTD0z:7NN987miLx6CA7D21wWLpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274605, "uuid": "76b4d241-1a10-404b-83be-737cf92c62e6", "value": 48388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274605, "uuid": "84011644-b35f-4f8d-8e5b-a6034152f633", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274605, "uuid": "6277181f-831b-43b9-b2f8-765922307c21", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ff4196-b56d-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649224147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224147, "uuid": "f1c8d6ef-037c-4772-9075-a46ee8450c3f", "comment": "Malware payload (SnakeKeylogger)", "value": "6bca6e699219e7e16616f94f8ebfb2e3", "object_relation": "md5", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224147, "uuid": "f79ff54c-5808-4e58-8b0e-f8585fb1beee", "comment": "Malware payload (SnakeKeylogger)", "value": "8f8ae570105cd188faffc7cc9fce507db5666e6817880577ef80efdc7a1ef4e8", "object_relation": "sha256", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224147, "uuid": "84a9f5c7-00ad-4abf-a191-4d9418b6575e", "comment": "Malware payload (SnakeKeylogger)", "value": "a12d9334df0bc3ee34ab1b10b001925d58e95668", "object_relation": "sha1", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224147, "uuid": "17cb739c-94a2-4628-9bc3-b773124a2799", "comment": "Malware payload (SnakeKeylogger)", "value": "89341099990ceeaa8a9c8b11e3f39f80c258d135a17e0358731f42d2be25b624fd8f49d8635bd06d40dcf3e0d28d5f80", "object_relation": "sha3-384", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224147, "uuid": "0c389f58-0f7b-4446-a876-9fdfdbbc46fd", "value": "T148942333A499CED9AC8688C1114D3701FC52A22B1DA97AD77EC7F4CCEE96E090D157AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224147, "uuid": "379e5680-567d-49bd-937d-2482c103547b", "value": "12288:bM8opGZLsK4MVcxTwJd20LAzLk5MNOscZML6ISET:o8oWLhd2F45COsElS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649224147, "uuid": "32e2ceda-77d2-41a4-a8fd-e2eaa2e01f96", "value": 421017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649224147, "uuid": "960f1ea1-a2f7-4b08-aedb-fc42b294a041", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224147, "uuid": "4c7a2fe5-901e-4578-8110-f1add3c69cf2", "value": "ORDER TKHA-A88160011B.pdf.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acee9722-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278006, "uuid": "4666a1d3-465e-4180-a395-630bc147f4b5", "comment": "Malware payload", "value": "9a90fb8b9926a3885e708126117ca5f4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278006, "uuid": "2c0fcd99-8230-494d-819a-4f09ac4f123a", "comment": "Malware payload", "value": "8fabb7633a8c57e0b1e5336ae9d7c38f35f41a3f0c814a8ea11c0db93eaa7608", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278006, "uuid": "c7b50cd6-a263-474f-b877-8912dc9d42a5", "comment": "Malware payload", "value": "c9993266613484b9cf6d77ede8b14f42fd891210", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278006, "uuid": "8a9b0f4c-b66a-47a7-9f92-733db6587d09", "comment": "Malware payload", "value": "5bfdc2eaf4cc4217244d8bbdbd1e59df5c816ca22a5518e2bbd90bcb85e1717dea92ffbeb0e62b73adf866f745861871", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278006, "uuid": "65141a17-b3c3-4e2c-be3c-50f605075b99", "value": "T191A1E850112C1AB17246597AD26FFA52B90EC81B097B7B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278006, "uuid": "4db577f6-97bd-46eb-bc44-57d88974b2bc", "value": "96:CcRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:fRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278006, "uuid": "d56060ed-6ff7-46a2-b4b8-379331f172d4", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278006, "uuid": "34c2b9f0-9636-4daf-a902-6075f261bc59", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278006, "uuid": "d1782e61-9df1-4042-beb1-b7055b0060ce", "value": "8fabb7633a8c57e0b1e5336ae9d7c38f35f41a3f0c814a8ea11c0db93eaa7608", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad6c6279-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278007, "uuid": "2547f9aa-e3ee-49db-ba07-49531d732340", "comment": "Malware payload", "value": "00e4f2796c4ea5dd0ea4dedf631ece5b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278007, "uuid": "ca4ceb33-21a4-47d6-ab40-46676c26e469", "comment": "Malware payload", "value": "9031c440a3e98f8600436d832285f75364c3922b6c9ecfdc7aefbb8aea1b8479", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278007, "uuid": "e5c798f9-5968-45c3-8a12-a558ee7ffaa9", "comment": "Malware payload", "value": "0178a22e3cebb221f9724805763d1c2dc1f90b37", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278007, "uuid": "41bc14dc-34d1-4887-a6b1-592d6786aae3", "comment": "Malware payload", "value": "58bb9be807fac8ffd8a75a2eaac3dc090aa2031887f4f72ba132268015d0082df7d47aab93649d86136bb173729f522e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278007, "uuid": "130d6ae2-2501-4016-aaa3-26177fda15df", "value": "T171A1F750112C1AB07346697AD26FFA52B90ECC1B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278007, "uuid": "cf328e32-457e-468b-bd51-14e5b571641f", "value": "96:dRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:dRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278007, "uuid": "064a3c96-fa16-4ca5-8238-cda0473848b1", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278007, "uuid": "40c0f4ef-70ac-48bb-8a5c-0b1d7ee5272c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278007, "uuid": "4c9fb309-6b84-4f85-bd0c-636e80ac2aa8", "value": "9031c440a3e98f8600436d832285f75364c3922b6c9ecfdc7aefbb8aea1b8479", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b786bfe8-b5b9-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649256979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256979, "uuid": "e2a4b34f-f866-4115-b161-224a7c06b39f", "comment": "Malware payload (SnakeKeylogger)", "value": "131d48211849f8d3a606673b75bfb72c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256979, "uuid": "95663c1f-ea24-448f-ad4b-a6867b8c6d6c", "comment": "Malware payload (SnakeKeylogger)", "value": "9063f6b4b4021db3c623e82b3834036c5ad99e56563bdb06ad26374de8e843ba", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256979, "uuid": "4c97d456-f0e0-4614-8d2c-3163c50ca14f", "comment": "Malware payload (SnakeKeylogger)", "value": "2e2b5080edce6f532c4fda5cfabfcacd98077d3d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256979, "uuid": "50036ddf-7ea8-4ff3-b2f8-83a498a55c74", "comment": "Malware payload (SnakeKeylogger)", "value": "bfb8efb6acd89c3c4b4a96d19d1417c858dc8ae63be4e6ad42783a24121a3c7be2980d0120b50945eff27ea79d3133f2", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256979, "uuid": "af6acdc3-3608-4035-9bc2-acd8b5899fda", "value": "T152A412C123992323D9BD57F6747D558043F1A46B3A26E79C8CE1A1DF29133808A52FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256979, "uuid": "c0740657-b96d-4bf7-917d-41ad78e0ffd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256979, "uuid": "731608b5-a0b2-4f25-a66f-924ee3fc63d5", "value": "12288:Va/2XgEZgEQdBxlD+2izL3fcM3qc/7oF:Eyg8lQrp23fcM3H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649256979, "uuid": "3d017017-5d55-480d-b6c8-81c9d5bfaaa2", "value": 455680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649256979, "uuid": "01cb4dfd-2512-48e1-846b-a842633a22c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256979, "uuid": "f77f6112-3594-4b01-abe4-80031884afd0", "value": "Products Inquiries.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "254df709-b5ad-11ec-8e58-42010a9c0032", "comment": "Malware payload (Vjw0rm)", "timestamp": 1649251580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649251580, "uuid": "b67ddc92-ca96-4623-a5af-30b62a9d48b2", "comment": "Malware payload (Vjw0rm)", "value": "8a39e82cb51d121c09e257308c889717", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649251580, "uuid": "a3030829-a299-47f4-a14d-1e422d6a9cd2", "comment": "Malware payload (Vjw0rm)", "value": "9195a973bdb10571cfbeed43a341b4ed19e2d8e281147a7aaaf53debaa72d448", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649251580, "uuid": "a50ab7ff-5027-4b0b-a7d2-26cdde3c608f", "comment": "Malware payload (Vjw0rm)", "value": "8842e3c5818d8bda0e434544757e2613d534effd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649251580, "uuid": "68b2bf01-83f4-4883-9303-b8c5256e515c", "comment": "Malware payload (Vjw0rm)", "value": "025c4857a0209b3944c52b2772269180acc4773d8dd50256eabbbe51be795bf75b4ab3ba0d486b5b8854b6d60c330bb0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649251580, "uuid": "6a70c935-31e2-46b5-ae3d-1dac047fbb52", "value": "T1DBB2EB2EF3612547241287A3EB0FDC01789CD5C0F99921D95D127B4E9FB089FA76E22E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649251580, "uuid": "e90b8cff-70ad-4f51-a7fb-98ea5a7f4654", "value": "384:xUVfjkn7qH2u40bu1y3BlUOR1+YZ2JlmYGR5LDrENcMG68kvM/zSuOHUgOGoX1EW:6VfzBgJvGR5nqvM/2mgOGoX1EM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649251580, "uuid": "722bdae9-6ebc-4b91-b07b-0ab21e6aedfc", "value": 24215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649251580, "uuid": "1f47e3e2-de0f-4fda-a64b-d74dc4122892", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649251580, "uuid": "dd0abb94-7379-4b22-a5eb-13a0f2b0fced", "value": "Historial de multas vencidas.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf9ebdd-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278008, "uuid": "e4e883fe-32de-4855-8947-c16d0254c8a3", "comment": "Malware payload", "value": "c5d42be04fadd53e9ef959f8f29ddb1d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278008, "uuid": "cd58462c-462b-4ba8-af23-47052d8798cf", "comment": "Malware payload", "value": "91e26024b7a6372890bf2a0e8005e899c188a30554df6464d373236ca27f229f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278008, "uuid": "1a8d8454-7bb4-49d4-8ef5-6466c309fdea", "comment": "Malware payload", "value": "ca624679350d260c60f369330cb8f4a1fd7fbcdd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278008, "uuid": "e45b4242-53da-4a0d-bd3b-d117310fd38e", "comment": "Malware payload", "value": "46b7dda09e8a8d78930cec9bcd915dd084ecac07587ada7a510ea149cebadc6607dce34add59a809760d2492d42aaadb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278008, "uuid": "61fb92ff-052c-4448-a9ce-9c47d17674ea", "value": "T139A1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278008, "uuid": "192819ac-7e46-49a8-95ee-620f87bbc8e8", "value": "96:5RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:5RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278008, "uuid": "6c0d5d5c-7b11-4277-b5db-0b879b3f0853", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278008, "uuid": "bca9f935-5000-4344-86e6-f23b492c9cd6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278008, "uuid": "dea78d9d-77c4-4af9-aa6d-da684277f053", "value": "91e26024b7a6372890bf2a0e8005e899c188a30554df6464d373236ca27f229f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9578091-b5b9-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649257009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257009, "uuid": "20d3bd2e-a55d-470f-a2b3-080fa1eb8584", "comment": "Malware payload (SnakeKeylogger)", "value": "346724d8816ae51aad26ecfbf121c9da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257009, "uuid": "9feafd4d-cd04-49e6-9132-c05107ace5cc", "comment": "Malware payload (SnakeKeylogger)", "value": "91e89cebbc559ecb5c62b36fbc1be6cb1b58d8d070c787818be42377400f2d14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257009, "uuid": "9881a77b-85c6-4823-b053-b040215b63b4", "comment": "Malware payload (SnakeKeylogger)", "value": "c9960be83553ef4a810fab02a4a2b346d4e985c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257009, "uuid": "287e3f2c-cece-4870-bf35-aa7bc251bc6d", "comment": "Malware payload (SnakeKeylogger)", "value": "043434fb065ce4a608197819833efe12dd52068d3e92bc4533fc824b8fe5100cd54aa7640faaefbef6eda37b8b03ac19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257009, "uuid": "6c95a230-80e8-4ee0-87db-269757872da7", "value": "T133A4128533E51726E8BE9BF3B87E21C20776A5372691E35C4DD62CDB0D02B909602F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257009, "uuid": "666ab294-b647-46ea-a8f3-d1f047b9b48b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257009, "uuid": "48b96564-dcf3-46b4-a0b6-930ddbf57b29", "value": "12288:tQgSpx1sgc5SEIgqfPHCA+F79xX/NMBCQF:hSpxjXXHW7zOBCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257009, "uuid": "d77a42d8-2424-4b0e-a50e-3a46ce954dc6", "value": 457728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257009, "uuid": "64c91e2c-a857-419e-83f8-08971ecfcb7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257009, "uuid": "7dfab876-ab92-4fe3-8c3e-968570d9956a", "value": "PAYMENT SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb7db3cb-b5b9-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649256986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256986, "uuid": "866b454f-69a0-4227-aa0b-eff6a90ab26b", "comment": "Malware payload (SnakeKeylogger)", "value": "9acbba4c49007185c5f0f89219c6f509", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256986, "uuid": "b98750c3-0b0d-4aa6-97d8-ce49767b6986", "comment": "Malware payload (SnakeKeylogger)", "value": "9230cf22a14fb3a4d43b713bf3422f5dd23f73764a9e640efb00aec066c0b5de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256986, "uuid": "4494bf4e-e434-4f0a-9981-9ec770c42716", "comment": "Malware payload (SnakeKeylogger)", "value": "357a304d4fcfe8cb158e4619358ae0530bd56969", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256986, "uuid": "49800cc8-8f34-42b1-97e3-fad1fc984017", "comment": "Malware payload (SnakeKeylogger)", "value": "e1aa93b7a7354a855f31d1465a29d36518cf462d778407121208e066a6ccf9871dbecf6c146a757b5a780d280bca005e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256986, "uuid": "d3870895-639c-4df3-9f92-c9a4bd5ba004", "value": "T159A41258BBABDE17C1ACA6B794E204400374A643E1A7D79B1FDD21DD1B073E60A81BC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256986, "uuid": "2eed1d74-379d-4ee5-a682-a8223e7f6705", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256986, "uuid": "cf7544a7-c591-4108-85ed-63529218ebb9", "value": "12288:bpuDGdnJ5JnQ+1GUQ/B3ARm0am24voR7VeBumbvmF:GGdJ5JQ+Y/BQUmFoR7VIjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649256986, "uuid": "a802fc70-d9b3-4bd5-a8de-4e102be02820", "value": 472576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649256986, "uuid": "46619dc6-9b75-4a35-b9e9-6630831173bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256986, "uuid": "0cc13b73-dd32-470b-9f67-b44e97a13651", "value": "WIRE INFO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea1bcb1-b586-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649234818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234818, "uuid": "d5cc58e6-9bc7-42f4-b781-1e7df9eaf6e0", "comment": "Malware payload", "value": "bfada454bfbee437b49a24f06f2f1095", "object_relation": "md5", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234818, "uuid": "88525e13-e8a3-419d-933f-59f44f905bb0", "comment": "Malware payload", "value": "935abc96db1ae86aa21a296ef445d84e18772a850a71127b4af42b928ed685d8", "object_relation": "sha256", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234818, "uuid": "6117d22d-5cef-48f4-8d35-b3de9f114b2f", "comment": "Malware payload", "value": "88e162efa35000c1ecf4c1163138f7443cd40085", "object_relation": "sha1", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234818, "uuid": "1baad770-5ead-4a8b-9fcd-69b54d110712", "comment": "Malware payload", "value": "e8a75b0b1d7962cef76002bb3b2b1fec913b26491c67cc6604e0ffd34599a487a4c0a04a68bf7fa638ece407e92b4a4f", "object_relation": "sha3-384", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234818, "uuid": "8650068c-b7f9-49d1-a32a-5d08c913120b", "value": "T1FC442356623469A9F792D3E22917FFB9D27348E191D130D771FC97303843CCAAAC029A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234818, "uuid": "6840ab6f-6117-4d9a-b93e-c1d6696a81c1", "value": "6144:US1YgvZRRGspt1YdDslIX0vy4HgxCEu0rOg9/:UctRRft1YV09YVTrOgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649234818, "uuid": "fe59ad68-f710-4be5-bcf1-5b9e8e9d38b2", "value": 254395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649234818, "uuid": "a35cba2e-6dc9-4032-996c-cbf6d80f8868", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234818, "uuid": "1f7d3a3c-15fd-4d61-a6d5-6d320f287789", "value": "b0826267-bd04-43c6-7c61-d0a4ea38ef97.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69febaaf-b545-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1649207027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649207027, "uuid": "6d4bea2c-ba6e-446c-98e7-b264e889887e", "comment": "Malware payload (njrat)", "value": "7dfec5a225dddbeb3d7972cbb145eb43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649207027, "uuid": "841f6acc-b1c9-49ed-b788-2f017bf655aa", "comment": "Malware payload (njrat)", "value": "9435cfaf83d541afd3776aade5018ebbe8659ad99151edfbe135b29e792538bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649207027, "uuid": "3c29b084-bf5d-424c-a47f-103b9ac36d71", "comment": "Malware payload (njrat)", "value": "5482ad5b6504f8df6b358c42ae963f53c7006184", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649207027, "uuid": "0c27089c-941d-40e7-99c2-ec305267e01e", "comment": "Malware payload (njrat)", "value": "2eea7096a735f10ecfe80dabd27aa490a5a9058f323eada24f684ff64a50e847774ad222174f38c61ba720232461f726", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649207027, "uuid": "643c4f57-4b0c-4737-aa45-4051b82d092a", "value": "T16EB2094E3FA98866C5BC177486A6965003B491470423EE2FCCC960DBAFB37D91D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649207027, "uuid": "db26985e-4002-48c6-bf64-c91e220be813", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649207027, "uuid": "39385da7-06fd-4fca-ac77-e281fc5831d1", "value": "384:0eop9oS+2pRURIXIRHVSuV+MX9w6Dglo61ZhXDVmRvR6JZlbw8hqIusZzZ3Y:fof9pnIP1VkYRpcnuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649207027, "uuid": "9c3d0891-582b-46ce-aed9-0a490ade3ed7", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649207027, "uuid": "3d4bc0d7-ccae-47dc-820b-d8834919d00f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649207027, "uuid": "d59499e4-64e0-43ae-b044-f6b2f30f23d4", "value": "9435CFAF83D541AFD3776AADE5018EBBE8659AD99151E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb6f5a3-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278011, "uuid": "de5d8aa9-66bd-48ce-9789-108bff9ebe01", "comment": "Malware payload", "value": "92cf345875f3eca204e00b29597953ad", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278011, "uuid": "9d735a6c-1abf-4029-82c1-b2e5cd4c1deb", "comment": "Malware payload", "value": "9452b82eab873771268f459b75198f7d9df510ba39d3c2eed27a0c08cc4c8749", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278011, "uuid": "b17f77dc-b401-4d0a-b591-cb9f2cfaa168", "comment": "Malware payload", "value": "2c1214a17c414650c3ffdd7e0fba2cf7eb194f56", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278011, "uuid": "1f9c43f0-7415-4bc2-8d30-ada2eb6f1bbc", "comment": "Malware payload", "value": "181e17aeed148ca82f6192f289847115d0d3e9cead5760ba22401c738b673f0766a8db85a65ee99613ab90af0515e1b7", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278011, "uuid": "bd295e50-c5f7-4f82-b5a3-ebdae33c8a64", "value": "T18F4633466362A5B3CCB7530F948678AB3AB37BCC617D4C774CC0ABC20984136BB59B65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278011, "uuid": "b74c473e-cc0b-453c-ac60-c0bd74783775", "value": "98304:q13V3a0rqRIZ+wrvNoGRtKzIVLplxsVmHOx+IK4Wpi5WVHpC/tBYVZpaLEItya:q13V3HrqR4NlEzIJprsVmHUWkQJC4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278011, "uuid": "2533497c-3cff-478d-88e4-f22da37b614d", "value": 5812224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278011, "uuid": "b4469812-de9e-4f81-82f3-eda02588c705", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278011, "uuid": "16613301-570a-4b94-9882-fcd18f26aedc", "value": "9452b82eab873771268f459b75198f7d9df510ba39d3c2eed27a0c08cc4c8749", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582a0b51-b5a2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1649246941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246941, "uuid": "f6ec0693-bbe9-4625-9c72-6c83f5914d69", "comment": "Malware payload (Stop)", "value": "b43e65b19507145f0a74991ef9392a18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246941, "uuid": "b9b78c88-6ffc-4c3a-82e7-98c6e5719c09", "comment": "Malware payload (Stop)", "value": "9460c8ee8fe7a2aad2ceca9c34b3060a2bf1fbe050bae570e08560c6a7e92525", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246941, "uuid": "cd16aa2c-663e-42f5-b522-e60cf9770583", "comment": "Malware payload (Stop)", "value": "b68a2b1eba12de5f54caf3d14d45532e8ff07a47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246941, "uuid": "ba84977c-a772-4d58-a618-0a0cf22ee24f", "comment": "Malware payload (Stop)", "value": "a1036d726bfef6e9d8334cb441f1b03af39cb804e95b8541ebd5f372fade4b42c995718ab585bb9958af3902f43ebc90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246941, "uuid": "3e8d7ab5-a2fc-4b62-bd7a-157ac67de85d", "value": "T1BDF40214BB90C035E5B716F499BA936CB93EB9A19B2490C7A3D416EE1734AD4FC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246941, "uuid": "b41850e5-2b0e-496e-a472-47e7fb21a076", "value": "25245420ce2e5010c32179ae5d5b5793", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246941, "uuid": "ba98809c-2bcc-4741-8e40-a53910ab87c0", "value": "24576:8Dz1oct5qCHcZOYZTBmZYuzreRNUNC9CWrgT:8u+cUm0+uORNaCYWrgT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246941, "uuid": "dce4f272-f253-450e-a5c8-2355c766c439", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246941, "uuid": "8bd0e104-24b9-40a7-827b-9f7bc7fe7419", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246941, "uuid": "8e9daa3b-0b87-4408-bef3-787d944eee8d", "value": "9460c8ee8fe7a2aad2ceca9c34b3060a2bf1fbe050bae570e08560c6a7e92525", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27fea1fb-b5bc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649258027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258027, "uuid": "3ac4c44e-e705-401d-bbfc-d7d31cff0de6", "comment": "Malware payload (Formbook)", "value": "aa867bd2b7bd7d8040384db68621bcf5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258027, "uuid": "61c3e720-dacb-4ccd-959a-ebfe088e2a7e", "comment": "Malware payload (Formbook)", "value": "9473d0b365794972f01489dd9ab1987f0167d8d3835d9d2c0d3dccfeddcab865", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258027, "uuid": "6fdf0c4e-67ac-4b21-80ac-8b2d6528af14", "comment": "Malware payload (Formbook)", "value": "c16cc92a39d7f3206322eedb76dfeca284ac74ff", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258027, "uuid": "0ade4f48-1178-4afa-b77b-78164e75c0e8", "comment": "Malware payload (Formbook)", "value": "92f917118155ba573d82622a15ea7a421856560bf80829e08f6a89251ba86097c8b1feda025b1f9d62a91581779c9cad", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258027, "uuid": "eafb15ab-e18e-4aac-bd8a-a93abefddba8", "value": "T12F14128DF3518EA6E1E17D3B53DE703BA301FD7CDA57098A8246B24A98796C1DD02391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258027, "uuid": "b8c6da3c-2d82-416b-80c6-88fa8a0b9c53", "value": "3072:o/sqBuIf7JDtElUKUyTU7VqQrUvY87tt6hOWwKzq2LM71k0dVsK5ON:YjD6lUKUyUsQY1cOWwKrLM71tVqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649258027, "uuid": "71611ba2-d334-499c-9799-9170613d7a49", "value": 192376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649258027, "uuid": "334da41f-6efa-4fd7-8ca6-4e41559a4e99", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258027, "uuid": "b0792baa-1e7d-42eb-9406-0668c5373306", "value": "NewOrder06042022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b1e690-b586-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649234937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234937, "uuid": "b18b69af-cdb8-4ac0-b77a-6d42d8842d3b", "comment": "Malware payload", "value": "7f99832697bf9223a706a6d0cedea9c0", "object_relation": "md5", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234937, "uuid": "72d02f92-2dec-4e33-87d9-f418d25c576c", "comment": "Malware payload", "value": "9517fb226382ccf46ecada7a298038f1c6a1c809cf99573d347820df9493dbf9", "object_relation": "sha256", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234937, "uuid": "396a4c3e-b2b8-4bf5-b108-763ca0205873", "comment": "Malware payload", "value": "cdd57f7fbad2a00764d06cddcb70ef2cf7df1168", "object_relation": "sha1", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234937, "uuid": "c58d1cf8-b7e7-4551-abc0-ebb24877b12a", "comment": "Malware payload", "value": "19164d9cdeb31704f6a53b5421353aaaa55ea83faf4b8dd4fc2c5539f621d790025f4cf1225c3d3955f2877912dc73eb", "object_relation": "sha3-384", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234937, "uuid": "9652ae04-d4e5-42d2-bf6a-a587f0fb90a5", "value": "T1554423D1E121D468EC4B4EAABA658D06F71B03CC7E23D15CF55934267F1ACAC60ABF06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234937, "uuid": "fba3bda2-16ce-4f41-8760-9d206c3cad56", "value": "3072:J2+ktW13c2cDjDHajqtWlcbnu1LVp15d0DS5ZMdXAR+VzRP8PEB02hIGUUZNBKTT:gNteXjqKrr15d0kqziPu/hI/CBtG+IN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649234937, "uuid": "76d8bf60-8f7f-4efa-8f6a-8b7b4bedca2b", "value": 254395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649234937, "uuid": "ba4dbf47-51c1-4d9e-ac79-876075bdfc35", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234937, "uuid": "bbcdcbcb-6ace-4899-880b-956735d46668", "value": "f024f3a9-cc65-44b9-5684-6901d5834fdc.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50f60f7-b568-11ec-8e58-42010a9c0032", "comment": "Malware payload (Adware.iWin)", "timestamp": 1649222239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222239, "uuid": "cd58e970-da02-4004-bbe9-c4a2f74e177b", "comment": "Malware payload (Adware.iWin)", "value": "5f5b64d897e10d8887964024ae82080c", "object_relation": "md5", "Tag": [ { "name": "Adware.iWin", "colour": "#48FD15", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222239, "uuid": "d77daf38-5b5d-4078-bab1-2ef39479106e", "comment": "Malware payload (Adware.iWin)", "value": "952764c5137646981d349146d2d275da6af8595925c766d7eef56f6f51a296af", "object_relation": "sha256", "Tag": [ { "name": "Adware.iWin", "colour": "#48FD15", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222239, "uuid": "e6026035-40d8-417f-a5f8-7752ba63d85d", "comment": "Malware payload (Adware.iWin)", "value": "9142a8d946159b9df1027a0d15ec703943b511dd", "object_relation": "sha1", "Tag": [ { "name": "Adware.iWin", "colour": "#48FD15", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222239, "uuid": "c4cd32a6-8005-4935-a186-fc410d5e44c6", "comment": "Malware payload (Adware.iWin)", "value": "36ddabe9e921a768ec77649e36caa9595b0316dd9c65d6fbb933111ed8b7a68de4962f7cda62b6dec5a8de0a4acaa6be", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.iWin", "colour": "#48FD15", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222239, "uuid": "d2500a7b-49b0-4c70-ad70-3020ae38e1f5", "value": "T1C00633298A24AAA3CFBC53744C30AF79F9927BEA401481DF8AD46C7E75DBDE4D147009", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222239, "uuid": "788365b9-4b06-48c1-bca3-0c41a516dcbb", "value": "1c042238f43557c055fca8642de8a074", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222239, "uuid": "27475bed-97ba-4832-89ce-916a66af9636", "value": "49152:y0c24StiTTsdoNDjoJSFWWCycq1mFDbPd3Zm7BmKGMkO/VcmFJRUZYUxPIaSLmEA:y36ivJDiSFdph1mPYAlO/hJ6ZYWOqnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649222239, "uuid": "327b6e95-09bc-4c31-831c-4eed5cf4fe4c", "value": 3826552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649222239, "uuid": "17e50165-eaec-487b-97b2-dede8383e809", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222239, "uuid": "042b3b30-5ea1-4b92-940e-28736f230cca", "value": "MightBeAdware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f682f2a-b568-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649221908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221908, "uuid": "3f40e7dc-d80f-470b-82a3-d9b6f87785a9", "comment": "Malware payload", "value": "45a04f354bfdf4a95dc469bb843b961a", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221908, "uuid": "0ad668c2-dfdd-4771-884f-6c799f2d26af", "comment": "Malware payload", "value": "9528b42bbb466390acad5433102227556f428e875afc7a157aca6249c64d32f4", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221908, "uuid": "4a886a6d-9031-475c-935c-ed2be9f71842", "comment": "Malware payload", "value": "3cf81aea07d3c0006f264d2bf37ae4a50cf7efa7", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221908, "uuid": "d16da130-d2fb-461d-ab57-5b00125752a5", "comment": "Malware payload", "value": "1c001e96a78e4c4983b6abd75e2960f0b0bd5f203a0c1d76258e03094e7c4ded34cccc1f113c29eb757ab0fdbeaa7222", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221908, "uuid": "b7b95c1d-a327-4700-b46c-8031c8b374c8", "value": "T1438533F2061E3BC1835D17E52951821F6CEA1160D7AEFFE4A7892D291E30BBF7341662", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221908, "uuid": "756c3a1b-84bf-457c-b0f9-d29fff0074e5", "value": "49152:v5RErR2CtQaswz/gf+0CV9ml6tCLmQNDLCQgV7JkhiHePQ:BSN2Ta3osfKNNaj7JykeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649221908, "uuid": "bc54ced7-605f-455b-9600-69f2dfc2bd68", "value": 1728755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649221908, "uuid": "5448c3a7-cd66-47d1-9d63-807ae6fe0924", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221908, "uuid": "675ebb77-0d0a-47c1-8572-94137411deb2", "value": "xyz.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b0c114-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278013, "uuid": "42f8019d-28b7-4e73-817e-9b3fe0a6172c", "comment": "Malware payload", "value": "9f17e4acae88bc9fd8cbd262cf78a4f1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278013, "uuid": "38bc9350-d0e0-437c-a057-a88a2b580f25", "comment": "Malware payload", "value": "95378445a01342d4903b77b4767007866fb94707565e8b0d5848780d6bc62e6d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278013, "uuid": "0f3735d4-f8c1-4774-ae63-4a5a1014299b", "comment": "Malware payload", "value": "4423a5ebc00cea426b175d171692317d3c8fd712", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278013, "uuid": "9c9f33bc-b759-4571-8b95-ab8237cb3a24", "comment": "Malware payload", "value": "fa6c46968dea7ff5cd6a2f295f3e61c9dc68da335f2fcefb694b3daae93bb9046941083015f68f0af0203460eb261f91", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278013, "uuid": "2b469965-9cf3-4822-833b-4df67f658139", "value": "T1FFA1E750112C1AB17246697ED26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278013, "uuid": "ffc1b6e6-d1b0-4ab1-b79d-37ce54f0bd09", "value": "96:jRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:jRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278013, "uuid": "635741f6-7ee9-4c33-9cda-a535fbe3a13f", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278013, "uuid": "a0feefeb-ee1e-4261-9612-609ec4c75e86", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278013, "uuid": "07747149-0d60-46da-a4f9-ef8537bb033f", "value": "95378445a01342d4903b77b4767007866fb94707565e8b0d5848780d6bc62e6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aecda512-b56a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649223034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649223034, "uuid": "783f2c10-e732-42a1-ad67-6c0fe0ce6620", "comment": "Malware payload (Heodo)", "value": "70cb2158df2768237175ade2582a8df9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649223034, "uuid": "189d4388-3ed4-4522-990a-8ea41fd8dc66", "comment": "Malware payload (Heodo)", "value": "954c696daf7510e394904485118c963f815ec64e4f450af0e49accf8ec6f8471", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649223034, "uuid": "b00d3acd-9d24-4039-a8e7-eb3a97662151", "comment": "Malware payload (Heodo)", "value": "930124308155d220ac95aff7c569f125fcd4f9ad", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649223034, "uuid": "7aa442a7-6900-4454-b1ee-f03ee294a4bc", "comment": "Malware payload (Heodo)", "value": "26cf80120bdf1705b37c8fc6df84e17b2db1b66ffdfba9f8bfd4231878028042f0234bf78171bb8e7163955715e1091d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649223034, "uuid": "1d5455be-1c40-458a-bd01-46244a0146a3", "value": "T1CB059F7A2B43F27AC7E50DFC186002981A75BAB2C7F7A4272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649223034, "uuid": "fe800151-06fc-4a0b-814b-98a3372e24da", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649223034, "uuid": "96bb841f-6455-4024-90ef-a14bb81e7ceb", "value": "12288:KVHML2QJe6XxhqCW2QHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqeQHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649223034, "uuid": "c5bbb497-b607-47f6-9515-f51475c7a331", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649223034, "uuid": "6f48b0b7-c625-46bf-af0a-964590cde6a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649223034, "uuid": "3ffcfbe9-1627-4924-9e3b-7282275219b8", "value": "RoundSliderCtrlDemo.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2deb347-b5b0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1649253159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253159, "uuid": "ba3da57e-dee2-4957-bdc9-e10c4b79c757", "comment": "Malware payload (Quakbot)", "value": "95b854247b62d0bc805de1d38a2d37dd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253159, "uuid": "8bf70e79-a826-4062-addd-d763092c562d", "comment": "Malware payload (Quakbot)", "value": "964b4ec11e60e4a5f7464b8ec4510f6f514e7e49185da9f445e07724536febd0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253159, "uuid": "411d1e31-bcf0-4503-9d86-9bb415970421", "comment": "Malware payload (Quakbot)", "value": "a4e8b49cbc4b3ec51536c96f94d3fb47ba6d09f4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253159, "uuid": "86552b28-3e11-48f0-9ad7-9674be93c447", "comment": "Malware payload (Quakbot)", "value": "2e604e76706e67bfca639c1b0c095e382bae6d75ede6e1291d2b2cdd33581464e93a2f1e3a028877392e550c4b4b5b0b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253159, "uuid": "b7af5d60-98ff-4254-9648-c4412712bf8c", "value": "T1A065AFBC75046CDAE66F06BBDD96ACDD13B6263299C794CD8075B7C309A3372EE02805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253159, "uuid": "eec5e517-208b-49ea-9155-7ad22f8f74d6", "value": "1538717eb64bec210d6f84c7331143bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253159, "uuid": "407b0338-0ba3-437a-bc7f-22e106caa2ee", "value": "24576:X53YrrLEaF0tTHMjuX5PmnKUz3NL3BAYJWDJnh+idFsv3YgPmHFB4:Xc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649253159, "uuid": "12766dac-0f77-4b5e-b9c9-4ac1ecae0581", "value": 1427464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649253159, "uuid": "7c53ebc1-e167-4b3d-9c5a-c76026acce6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253159, "uuid": "b5465926-0ddf-4b96-aaf6-09c413eb46f4", "value": "0x0003000000019d72-286.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b234b59f-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278015, "uuid": "a9a0914d-c46b-40ad-807e-920b2611db3f", "comment": "Malware payload", "value": "2e2f06fdbdc1dbadca5ee008b7fcdb23", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278015, "uuid": "62c4a716-f6a7-41e3-be16-4253f01ef466", "comment": "Malware payload", "value": "9689a8a2855ba73726e55cea132886cebe40ab2808df1a9f8290f76e24049ce8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278015, "uuid": "4a786a09-045b-42f9-a50e-8af97f80a6f7", "comment": "Malware payload", "value": "ff74abe48b229c60914906545d24284b9fa742c7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278015, "uuid": "dc149e28-53e0-4025-bf74-d805c6fa14c6", "comment": "Malware payload", "value": "abfd80e057d87508af8f3411ca50a22c23e1db2c0b4cd5b3914f417dc10214d500927141512ee019c5f79aa7bf4cc521", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278015, "uuid": "c69d53f2-9e54-4c1e-9533-afc8066fdf1e", "value": "T159A1F750112C1AB17346697AD26FFA52B90EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278015, "uuid": "df20416d-92f7-4ad9-9588-e7c36b001889", "value": "96:6JRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:eRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278015, "uuid": "05519823-6622-4a8c-ac95-37c646d65c7b", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278015, "uuid": "d3cd98df-4418-46ed-8fec-10b4ccc5c092", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278015, "uuid": "2307eb7e-ebe2-4484-a98a-bf576b6c1f88", "value": "9689a8a2855ba73726e55cea132886cebe40ab2808df1a9f8290f76e24049ce8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d220728f-b568-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649222234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222234, "uuid": "d309551c-b896-47fb-984e-546ffb8d591c", "comment": "Malware payload (Heodo)", "value": "21de110cc54ac809bd73cca0b6212679", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222234, "uuid": "1b82297d-541c-4891-aad8-c4b0bca9b533", "comment": "Malware payload (Heodo)", "value": "96c58bb6640d9dafc04a9c91e7b6a9676ec7446c1ec12a9a2b2fd4eb1ad24eeb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222234, "uuid": "5db065cc-6b4c-401a-a60c-750701435e28", "comment": "Malware payload (Heodo)", "value": "9b33e7a155b0a18e9bfcef5c36bc4a41277e12cd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222234, "uuid": "f698382e-8c7f-4464-9f64-ed766cdad054", "comment": "Malware payload (Heodo)", "value": "f53825008660cf189b0d655fcc3e1a84f4899c49d6262d35538467ac2da2e93f665e9667fbb5ab4d039f4fe8c6ed3e92", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222234, "uuid": "db827bc4-64c6-4871-ae8a-1b3efbd5e60f", "value": "T1AB05F72D2FAE4062D8660734145C1FE891ABDE25BB2255FF24843E6E2EB53C74879F0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222234, "uuid": "aaadad35-70b4-474d-8721-e4eef225369a", "value": "70b8cfa68ef2c7898ee65b9a0ce218ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222234, "uuid": "61188dcf-a277-45be-b7b7-51d4e0ab45fd", "value": "12288:iKJCPjp1g4SbBKilbUD4AmQjcQ6JC3s5c+:yPjp1g4S11lgDXRAQAc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649222234, "uuid": "e884b189-546e-4cba-9526-e1ff5f1370aa", "value": 831599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649222234, "uuid": "413f1a3c-ced2-4850-b309-9015cc8bf1cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222234, "uuid": "f5979ab4-cd8d-4e50-a3f8-fa9498878eec", "value": "emotet_exe_e5_96c58bb6640d9dafc04a9c91e7b6a9676ec7446c1ec12a9a2b2fd4eb1ad24eeb_2022-04-06__051709.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22da2e7-b5b8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649256567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256567, "uuid": "0d1c0e31-48a3-4fb9-9299-b879a5bf7f7a", "comment": "Malware payload", "value": "13726a198bcab3f2970f675a0eb2bd20", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256567, "uuid": "7cf03e73-f4bd-478c-b0c0-b3016138e0fd", "comment": "Malware payload", "value": "96cac6fbdb9eae2dd02e93f9638cf19408f192eb669ba6eefe20963492dc18bf", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256567, "uuid": "d5435bf1-8aaa-4933-b697-425d1130e763", "comment": "Malware payload", "value": "fb2de2404bc012adeb922aa516de6210cbf9be46", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256567, "uuid": "68cdd907-ebc7-4a58-a416-a12b23c05794", "comment": "Malware payload", "value": "faa1f092a64f3f710bc2f16b0e101e67cf4907c8eb1e522c52c3fe5bff410a1a2470747baf5f9083232230a958c5b109", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256567, "uuid": "d2e50d0a-9408-4060-8e79-3b03373944b6", "value": "T127917A99031FC9FCE613ACC889D95A43EBB68626467CEAC0CF70BEFA2411478D0F4458", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256567, "uuid": "cecaabe8-e14c-4d45-8eed-74132e4bc04f", "value": "96:Yr3IXFq6CdkhGONLQh11mEVaLsJzhIviTv9I7y5J5yZe5tKG7Mc:YUCKni1wSlgi7Go74c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649256567, "uuid": "132490f2-2add-4ba2-81e4-c21385df574d", "value": 4409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649256567, "uuid": "7d0cff9d-6aa3-4dab-9a44-0313ef14f854", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256567, "uuid": "d74f84a4-7059-4e7d-ba31-0046cd48a05f", "value": "dettagli122.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2cfbf5a-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278016, "uuid": "8f3e0790-b032-4806-826f-f610e89881ac", "comment": "Malware payload", "value": "20e97240e870a556f915a8d616affdf2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278016, "uuid": "fa012ab3-a9c0-4669-96ef-de983c93fe49", "comment": "Malware payload", "value": "974830aab341a0a4c6341c5a77e1dbb6008c0e97bda7ae92ff85cd9ebddc3725", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278016, "uuid": "b19504f1-2dff-4adc-aa9c-7c6d2fcb0dbc", "comment": "Malware payload", "value": "ad920ef8d9cfd67b638f5b67a6164790ce23d482", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278016, "uuid": "4f2b316b-ed53-4665-97e9-5a40139fffe1", "comment": "Malware payload", "value": "4b8d40f65abc2090947634a29cb759b99edd8bbbe3e8d5f6bfb6057475e17201af31128be998d97a6af081965441b521", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278016, "uuid": "8cef6b03-14d9-4095-968d-c43064b0c24c", "value": "T19C4168CA03021271ACF69D7FB675441531E0E4879DDC7A05EDE4B4B9418DF29A5C6F43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278016, "uuid": "0c2496f4-54ec-4365-b7fc-eb7efccbcd88", "value": "48:vDWcWZDWHWYDWVoWkKvDWoWxDWEWxJDWzWsDWHWkDWyW5DWLWADWEtWEde3DWZW5:vD52D0hDx2vDxSD7KDM1DGTDlYDa3DXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278016, "uuid": "f5d9d131-ec57-4ef1-8f32-80b47ce887e7", "value": 2104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278016, "uuid": "ccd554f2-be97-4e2f-8320-c8a70e9f9034", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278016, "uuid": "19c619e9-2074-4eab-874d-724fac57bc02", "value": "974830aab341a0a4c6341c5a77e1dbb6008c0e97bda7ae92ff85cd9ebddc3725", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34f69df-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278017, "uuid": "682fb1d7-e523-4b76-ac8a-3e1cfeb73da1", "comment": "Malware payload", "value": "3e20ad019c722be7f0c7a143a6b47c15", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278017, "uuid": "fb513b2c-f256-44ba-abca-919d496a77f1", "comment": "Malware payload", "value": "97cc510ea3b52d7283e72f5c50fa5d7c068b99a368272f73c9f139a67e5280f6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278017, "uuid": "e92f3fb7-db21-47db-b269-16a3c17ce6f9", "comment": "Malware payload", "value": "004644c59cc76d83134296d23c5ccb1fefc80017", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278017, "uuid": "b3c5b58f-ad09-47ac-bfb7-54ba32592d16", "comment": "Malware payload", "value": "33b7c2bb742f44dc29eeed4b51bbc5672f2c6cdacf875b75cf48ca67852268681a4116ca6f9ce10658986aa019b7c322", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278017, "uuid": "a6af19f8-c4c1-412a-9cbb-1e8825b762c0", "value": "T1E8A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278017, "uuid": "bc273cd8-18b5-480c-892b-6d77540da690", "value": "96:iRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:iRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278017, "uuid": "61760a27-1206-4733-a811-2d7116800e99", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278017, "uuid": "8c2dc897-68e6-4ec0-b776-deab56513541", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278017, "uuid": "94ac189b-b6f1-4750-a9f0-399018701f7e", "value": "97cc510ea3b52d7283e72f5c50fa5d7c068b99a368272f73c9f139a67e5280f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f602f64-b604-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649289016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649289016, "uuid": "5f1c6a1a-c6cb-44e7-bd5c-a9823c79a7ed", "comment": "Malware payload", "value": "4fda0a7d20f77b267c62d5fc660f3b9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649289016, "uuid": "9b27862c-4511-4cba-85d6-e6a88f2b3c69", "comment": "Malware payload", "value": "97cf28a6ca62ac032cbdecbcec11500b03ea1f9cca592b11572ce211962b26ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649289016, "uuid": "c0ab20e2-4017-4d27-bae9-341c01985393", "comment": "Malware payload", "value": "f4693f8ae1444d49075cf79f195af5723a865364", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649289016, "uuid": "58cc8ea7-cd92-4ee0-8716-88c4390cb16b", "comment": "Malware payload", "value": "b437bc16f06b3dc448611a8cea240a68872aeb1c06275fa6733b75f94433cc695cea58b0c3dc17d986c4cd22644e1239", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649289016, "uuid": "bb8a1928-7a45-499d-b475-1df3b28f228e", "value": "T11164BF93A3648561E35445B9A813C8B51C3D7F359B03766BA3E0BECF3AB0247366532E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649289016, "uuid": "63acc072-044e-43cd-87d7-0096d3ae7fc7", "value": "a758f977f5c6bfb8c4eb2cdb0c48b781", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649289016, "uuid": "0ae3f1b0-f712-4399-87fb-a8a35408886f", "value": "6144:zmEdSunAqHdroKcykhPBbiMV5xzr2fXmMQhJSkN:z4ujKyUp+gOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649289016, "uuid": "5319c0ed-d884-4dc5-83f2-8bc45d30e63a", "value": 323584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649289016, "uuid": "31212b55-88bb-43d2-862d-a3a883c88ae8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649289016, "uuid": "37b29b81-d919-4bde-8c02-74c63cccba57", "value": "97cf28a6ca62ac032cbdecbcec11500b03ea1f9cca592b11572ce211962b26ce.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b271d7-b56e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649224839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224839, "uuid": "1f71c444-d574-4235-8498-d5b8fcacc659", "comment": "Malware payload (Formbook)", "value": "52c1594921c48e6fc275128dc262e5fe", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224839, "uuid": "533605d1-d51e-482a-adc4-de5032c1ef2e", "comment": "Malware payload (Formbook)", "value": "982efc08cb3e2e3399399fef40665e301f28e6d44ff052a4bba8fba7df679090", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224839, "uuid": "0cd70472-190c-4f78-819e-0393c1a6ab89", "comment": "Malware payload (Formbook)", "value": "8145df4977cf83e23c94f0d196e03bb49e48d8e5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224839, "uuid": "977e546a-afbe-415b-ae2a-42be2ef79fc6", "comment": "Malware payload (Formbook)", "value": "fb854d501f67c90f9d5eee0ffd3048aa2620c37b49cde679e7c22216a0ea36e43b5b69bcf99e373ccf0c346d7de52e17", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224839, "uuid": "3c2de766-bf18-480d-9c02-f13aef24a387", "value": "T15752CF04B1265155CFF9FAB686BB7CCCD87EE068C36E625B130838CC260D2695C6C679", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224839, "uuid": "f848c3d9-822f-4163-a272-9e53e605b423", "value": "384:m8NhJNpC21VCGN3ga6+GxDJPSC2g0p2bNA+L6Y:622GNtt3u0wbVLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649224839, "uuid": "b49731b5-3599-4687-a39d-8c93163c2c08", "value": 14400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649224839, "uuid": "666466be-d0d9-4a36-89ac-2fa0ed43f931", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224839, "uuid": "28ffa736-c2e1-4663-b06f-014a8ffb2cfd", "value": "Payment Advice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "531326fc-b5a2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1649246932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246932, "uuid": "d35bc314-b2c1-4341-9a98-f343a65d79e0", "comment": "Malware payload (Stop)", "value": "b3066f0d8b352cd9e5c18e19118834aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246932, "uuid": "1f4ba594-8749-4dc2-95bd-294a5777e772", "comment": "Malware payload (Stop)", "value": "98ad8fb18714111b504cec9ca6a95f77520ad92a8ee331dc562a86b53f53aa2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246932, "uuid": "405d7823-3e52-4423-b5d2-d893b1869723", "comment": "Malware payload (Stop)", "value": "7cfcb6b5848aac682605cc596f52121327a11c57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246932, "uuid": "3cd508cb-a2f5-4a96-83d2-9e712142d908", "comment": "Malware payload (Stop)", "value": "44d018d196d5ca0ebcd43ab69666d2c48b50749846cabe329742a44de0556e71b65a512c6d5a8488c15130cd8024b348", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246932, "uuid": "0cf0aadd-7178-41cb-8b22-93cfccd3f2c8", "value": "T1C4F40210AB50C035F5B727F44DBA9368B93EB9A05F2891CBA2D516EE87346E5EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246932, "uuid": "4aa84a23-7a59-44e2-ae16-c9dc6e33f8e6", "value": "09b7cb9e514ec032fb567c3b682f1a2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246932, "uuid": "e2ced9a0-48d9-443d-a431-9d45799c3904", "value": "12288:S6dP8h91FluejiQt20WPEgr3RF27GZaIaXRjqtC/7FNYSY1aO1NiB7gUnAgW:S+A/sebtRWnTzc9NXRetMFKF1aO/mDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246932, "uuid": "f5d26357-a5b2-4b27-83bb-01a0959d22a0", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246932, "uuid": "5e017da1-ca9a-496c-8d5d-f99056fdde32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246932, "uuid": "0ec7c78a-1242-4475-8e1e-d11810b77347", "value": "98ad8fb18714111b504cec9ca6a95f77520ad92a8ee331dc562a86b53f53aa2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a229287-b5b9-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649256930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256930, "uuid": "60a6c318-aa04-430f-a93f-d253824fd548", "comment": "Malware payload (SnakeKeylogger)", "value": "3be7c8e236faf18cc00031e1327607c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256930, "uuid": "7c3a4da4-4797-4087-8258-665f83108ee1", "comment": "Malware payload (SnakeKeylogger)", "value": "98dbaaebb62d5a464b1c4a97f9bd01d7495cb9543447a28a5977c0750b7878f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256930, "uuid": "23cf654f-9c3d-4abf-ac82-5b5910a012a7", "comment": "Malware payload (SnakeKeylogger)", "value": "94a3635e79e25a77bb117b64b51d527c946c8a8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256930, "uuid": "a1da1697-2f8f-4546-b863-924569320183", "comment": "Malware payload (SnakeKeylogger)", "value": "af905b2032020b05d831bc46fd111c939cd119a2fb69645781f54306ddda71988dac90443b8cf402e6978ed711ce9e92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256930, "uuid": "e20221db-2328-4bef-b920-35764f6eee25", "value": "T1BC131B57F794BE77EB7E06735C7B82050329AF9698028B3E69CC412A2E6334406B7631", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256930, "uuid": "00588433-7c1e-41cd-a387-41abed401d8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256930, "uuid": "fbdd5abf-6643-4198-b993-8f9e36c91a15", "value": "192:WjkuYMaQ7AOnBdPYX+btL0xgmSQgPVuYzkf92YoRXbyO8:dhOBdPYObqx1EVbk92YUbyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649256930, "uuid": "155415bd-7f2f-4e1f-9a8a-e441c4bd39e5", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649256930, "uuid": "dfda75d4-856e-43d1-8c77-67b644b564c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256930, "uuid": "470b01cf-99fa-46d1-b5a2-8b5adc742450", "value": "BLT_66053_018_782.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4bf7bc6-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278020, "uuid": "3efa8982-7715-48de-ba27-e3d3eb0e5a0e", "comment": "Malware payload", "value": "c90a01812281ee62a5630b64fa0a5517", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278020, "uuid": "7f14771a-d4d0-4e9e-9957-825026f40edf", "comment": "Malware payload", "value": "98fc22b4f54dcc3980641cb48fa7c637e20fcc8e45403853e14a9ecef53f5b1f", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278020, "uuid": "730cf940-b0fa-4cbe-9f74-5bd0a4435901", "comment": "Malware payload", "value": "499f776d2b0323984f9dce88e14168831d77357e", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278020, "uuid": "36751c22-3268-4d38-9654-483a23ea9370", "comment": "Malware payload", "value": "b73b505f630188342d40b2a39eb04fd5e18d5da8b5af6417e2f3557211dd076a52139c7ee7dd53263274948a1d6ea9df", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278020, "uuid": "85f2d088-8edb-4a2b-a293-ed90d7e38f44", "value": "T10E06330C239EF8FDB85A0A2C3B2689B0C5E452F5DC4229F396391544093F67D5BDFA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278020, "uuid": "1cb3fe70-604e-4b0f-886b-5aa96bd4c81e", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKSAZ:0XSxVJG2fLAqFOfT9sMYNM29SAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278020, "uuid": "1dc962e0-edbc-4dff-8a75-bdb32a0b44cd", "value": 3858432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278020, "uuid": "97d3080d-3d52-46b6-b52b-446d152bb62b", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278020, "uuid": "d22838f8-195a-4c7d-adcf-77bef644b517", "value": "98fc22b4f54dcc3980641cb48fa7c637e20fcc8e45403853e14a9ecef53f5b1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd388c20-b5b2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Hydra)", "timestamp": 1649254009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649254009, "uuid": "7fc064f3-1af0-485d-a742-7189b20866dd", "comment": "Malware payload (Hydra)", "value": "c81e236e8e7445375ee40d8e3f327873", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false }, { "name": "tor_hydra", "colour": "#8B3295", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649254009, "uuid": "07861826-adda-43fb-8b14-d5940c384297", "comment": "Malware payload (Hydra)", "value": "9939bea82bef38dff91be0182d26c13694dec687d1b8971bb2924076b89646f1", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false }, { "name": "tor_hydra", "colour": "#8B3295", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649254009, "uuid": "f8dd3fd4-28ab-4801-b369-e09072a54f00", "comment": "Malware payload (Hydra)", "value": "43fd1ac04a1793ceb60061c402c3f2bab67daa1c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false }, { "name": "tor_hydra", "colour": "#8B3295", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649254009, "uuid": "d7e3df70-e770-468b-9f62-7ea49bbfedfe", "comment": "Malware payload (Hydra)", "value": "464a3a65e30b26aeb50210814d3571240b05f30bdfb01e50593665a3a5d5198448782285d71c27c8340614755b8a9bfd", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false }, { "name": "tor_hydra", "colour": "#8B3295", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649254009, "uuid": "52fe0092-538d-44bf-b2c0-a32423ecc649", "value": "T1F5F533967F60AE4BF0238970816B40975B790D4A8765A17318B4B97CC47BEE02367CFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649254009, "uuid": "fd3e10e5-648e-48a1-a07e-e00ee34d7d70", "value": "98304:7ML/uN7+YiIEv6gbk2f4qn3KEPi/MvxlnciASbG9Qv7JvEH:likx2l3KEPUMZ6UK9Qvtm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649254009, "uuid": "a078aa90-04c0-4327-afc1-41f112e2b2c8", "value": 3416163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649254009, "uuid": "2f01e197-ce54-4295-9636-88621aa537de", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649254009, "uuid": "bb10097d-03e7-40d1-a751-bcaf8f196175", "value": "easybank.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5412551-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278020, "uuid": "97eba9f6-1185-4d6f-96ab-1cb1cd6ae090", "comment": "Malware payload", "value": "c2bc11943313e88f1f4eab9cc872c289", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278020, "uuid": "5fd38166-0bef-40d0-ac8f-f9d4c3faa5c5", "comment": "Malware payload", "value": "995883f426a935b21f4f99ece1a23a4ad354228ad1a46ed6b7efbd55bcf2634f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278020, "uuid": "2feba93f-672b-46a1-82ba-08f44e2e7be3", "comment": "Malware payload", "value": "3eb3ef26e0a381bd1ac6843a465ed7bdde6d5e89", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278020, "uuid": "8e44d850-9544-42c6-aa08-73b8a8c914bc", "comment": "Malware payload", "value": "1e933ad203ef5b7ec1d38bc5da0975769e1c1e99a41938f7f1b40bf22eb795978e84077988c6d242a3151d90730223a4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278020, "uuid": "bd4cf8a1-fcb1-482d-83c3-0eacdc1319bd", "value": "T1EBA1F850112C1AB17246597AD26FFA52B50EC81B09777B358433A63C74F5DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278020, "uuid": "b0d33ddf-ee4b-465d-a632-5fb91a598163", "value": "96:ZRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ZRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278020, "uuid": "4dd103ec-0241-4753-9d59-553952f24e57", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278020, "uuid": "f943de69-216a-4cc6-84fb-50f0a5439d18", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278020, "uuid": "de929337-7fa1-478d-872a-8aa525b524fc", "value": "995883f426a935b21f4f99ece1a23a4ad354228ad1a46ed6b7efbd55bcf2634f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5bd1138-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278021, "uuid": "6adab356-230b-46d1-81f7-866d0902d7cc", "comment": "Malware payload", "value": "b0b83e2da593e302fad00f6cb534f9f0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278021, "uuid": "1375cebf-dca2-4f92-8685-763647deec95", "comment": "Malware payload", "value": "998723f3f261f1f5fd047f9c6db2c4549a4e2cfe8fe5503736235d46f40ee23b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278021, "uuid": "40ee330f-76cc-432a-97cd-a1bc01e17f98", "comment": "Malware payload", "value": "46fe618ac364c03d6744af0e56f4f2effc639190", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278021, "uuid": "eabab908-3956-46da-9989-9636dfabf534", "comment": "Malware payload", "value": "ecd332b1aec6dfff0187873c5dbae673c445f63824c32e01f6dadd85bab0d198b984833cb1effeefb966478486b1ec58", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278021, "uuid": "bccff1bf-1d1f-4aac-80da-3b11544d4420", "value": "T15AA1F750112C1AB07246697AD26FFA52B90EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278021, "uuid": "f0f5e978-b580-44e8-b301-ca07fadd7825", "value": "96:ERYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ERJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278021, "uuid": "222df7ab-59a4-47a8-a74c-894a6bda7e1a", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278021, "uuid": "6fbabffc-f8e5-47ab-8ecc-933981a29fde", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278021, "uuid": "f5670d85-dc84-4f17-b875-b953c25f1b66", "value": "998723f3f261f1f5fd047f9c6db2c4549a4e2cfe8fe5503736235d46f40ee23b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b6b3fe0-b56d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649224209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224209, "uuid": "79198e58-fbc1-482e-bfe9-651f81979357", "comment": "Malware payload (Formbook)", "value": "ae2b941e7fbde95c2f65dca62dd868ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224209, "uuid": "1bf04287-9430-4110-b869-afb693480373", "comment": "Malware payload (Formbook)", "value": "99bb3d1c9a2a4dad6465a81df1008b91f5836e51ce0463da76b31f9758dd9b62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224209, "uuid": "02ad461c-e4a2-4fad-a688-c987deaa494c", "comment": "Malware payload (Formbook)", "value": "6b67f39e534b6b6181c5670e1c729c9c014f138f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224209, "uuid": "bd93a562-fb9e-41a0-84bf-b3cd95b131ac", "comment": "Malware payload (Formbook)", "value": "2399b63d741955cee390fcefe2c4685e4ad2e37eaf1705869ab2afd681d423341911ac135fa7698c08b2764d57818081", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224209, "uuid": "a4c786d9-c474-4ded-94be-0569075d0c30", "value": "T1E8A4121A3B17D912E0EF5B3681E4968613709B077203DB8FADDC166A27037EE1DD0AE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224209, "uuid": "e915ad5b-a4c7-496e-b4b2-a99bbb552823", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224209, "uuid": "5373e267-12e0-456f-9a53-32d7b8f5cddf", "value": "12288:Yc0MtxrBN6oONKs3arDkRHK3/LEr960mBPLh/C9j:YTOrioONKsqHkR+/LEvm1k9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649224209, "uuid": "9144ae3d-6621-4822-a273-938f49d27b18", "value": 492544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649224209, "uuid": "ea1da23a-02ca-4fb7-ab9e-3d6a2328f917", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224209, "uuid": "cf0a5ff5-6aa8-4a9e-a5c4-4f25a80c41d4", "value": "PART SHIPMENT- FEDEX - Cargo Arrival Notification Import Track No 270962529096 MR V fKUMAR.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cccefdc-b5ed-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649279268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649279268, "uuid": "0639a3ab-e1fb-4fe0-bd01-1d613d602ae8", "comment": "Malware payload", "value": "d96572b8c6527e419301e293611cc3fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649279268, "uuid": "e6c80f95-551a-4d94-bd8e-fe2d9959d554", "comment": "Malware payload", "value": "99e39ef9a5267ed9790fbef614fa3a0054025c1cb866295e9e320bc95b128280", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649279268, "uuid": "bc03a42d-9804-4780-9129-91c15ec8f78c", "comment": "Malware payload", "value": "149892835dfcc0fd56414d079ca1c068ca62f893", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649279268, "uuid": "5811179e-76cc-4b04-ac65-7ec0d67f7cad", "comment": "Malware payload", "value": "475c09b6ba4ad68e7630bed8481e1e1d5aeb6b9bc029708202993604efa80b3b8036d18ef9b2fd064c9d38f022304b80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649279268, "uuid": "6fb8a897-8d81-4899-a57e-620617bd95f5", "value": "T1F7455DA2B2D0D436D41209367C06BEB4A7B97E10FE7458457AECEDCC6E39E913B25243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649279268, "uuid": "255cbdd5-4e2d-4d68-b220-be4554f25bac", "value": "f5ef87918d0e8c87fd8d7a368f835b77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649279268, "uuid": "065b416e-47f7-40c6-8ece-f12169e10268", "value": "24576:I1H0798GPywlA05Kn4wMSSFBL3O9osgtARoCGEzEYcfPwcB:ihGPBTFBL3OaF3fzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649279268, "uuid": "fd9a62ff-243a-43c8-abe8-47029361fa28", "value": 1233408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649279268, "uuid": "921b2a51-8eb5-4b42-8a4c-f809d7359b51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649279268, "uuid": "5a3fe34c-ece1-4102-9599-e5bae4a4817c", "value": "Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07183529-b59f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649245516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245516, "uuid": "bb60482c-6225-4d15-9e1b-de38c17b4a1d", "comment": "Malware payload (Formbook)", "value": "5abc98867d89ece2c9c19bb834c23fb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245516, "uuid": "e97bda49-7210-4477-b325-9f771c689499", "comment": "Malware payload (Formbook)", "value": "9ae7a32e1f8d49f2d13f632a946043dfe347f3d71ca95c146f0f2e597b54c4d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245516, "uuid": "592a6a47-2a38-4ad4-bad2-0fdbc098e3db", "comment": "Malware payload (Formbook)", "value": "e985a306a333e33cbb5e61db19729fba4c5cdb9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245516, "uuid": "7d5a720e-ab69-4567-8c68-2662ae1a792b", "comment": "Malware payload (Formbook)", "value": "147f4a6c3c9332fafcb5d30e85abe9d130fc701a64fdf5681db87259d9941a40c6d3e47bd093cb5845b3d7e76c801976", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245516, "uuid": "c5a2d251-0058-4e25-a282-e38c21baa1dd", "value": "T17F130997B7C87F77EA6A07B34C7782060325EF99DC438B7E788841266D6334446B6A31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245516, "uuid": "ca403d39-8955-427a-9a17-63504337b69f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245516, "uuid": "9acc4130-1f72-45a1-b57b-a3770980d1bb", "value": "384:F1/9UEYRFBQePeV5NPUIuEVbF92YnRs93:PmStFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649245516, "uuid": "e610ef54-e485-405a-ae09-3767f361eebe", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649245516, "uuid": "b6d7d667-71ae-4f9a-90ca-8df242fae1d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245516, "uuid": "a189dded-713d-4f9b-96ff-14509a54485d", "value": "0060422.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b41f6ae-b5a2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1649246919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246919, "uuid": "32eff607-3177-431d-b960-95ac85f92db9", "comment": "Malware payload (Stop)", "value": "0b19160841298ef16de4b8c9c22a245e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246919, "uuid": "34a37906-d125-404c-a0a7-7174ad5e28f6", "comment": "Malware payload (Stop)", "value": "9b0e4f30696d798dbd39088a10241a8a2e2d5099f0c78a36259714d2628fceb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246919, "uuid": "1e3405f8-65ca-4408-82fa-a410e8fbeba8", "comment": "Malware payload (Stop)", "value": "cf9ee1d4efb559fe5f70ffec261c1cd650b43e11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246919, "uuid": "a5549587-5399-4d5e-a9db-9c39b3c075e6", "comment": "Malware payload (Stop)", "value": "0307c3c89816178b6d0b2302b403da2acbfde83d29fa3fa0b5ed8e99d828d054904e539566f3b66d1420ccac92b0f3d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246919, "uuid": "ba01b17a-fbd6-40f1-9ce4-218250b4fd6d", "value": "T102F40210B6A0D034E5B726F4887995A8793E7AA09B38D1CFA7D516EE5734BD0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246919, "uuid": "8db0073e-103e-43c5-b022-5c7f1e71a2f5", "value": "18434dd795f0f66c344397d1af5ed120", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246919, "uuid": "3182ce25-9e1d-4a2d-9998-94912874b5c0", "value": "12288:vhMbkUS7AZiXSuuCzWj9ePNmud8/u6dyFrI0M4VyyQslMo:vSeWibrUu6dyN84xQslf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246919, "uuid": "ce616ab3-4cc6-4f9c-89eb-2ea64ea6c0b2", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246919, "uuid": "f44b24ee-15ea-483c-8279-062d2016926c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246919, "uuid": "961fa2d9-4b1e-4cec-9274-5d2d59e2a1b7", "value": "9b0e4f30696d798dbd39088a10241a8a2e2d5099f0c78a36259714d2628fceb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a523df1-b5a5-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649248098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649248098, "uuid": "9127da15-683c-4cf3-ab59-b2c199fda1b9", "comment": "Malware payload (AgentTesla)", "value": "993651e818c423e399a3c2f0bca17709", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649248098, "uuid": "75a8cd66-628d-4dae-99bc-ad5e5c03d442", "comment": "Malware payload (AgentTesla)", "value": "9b471a6c7f5ede53f682943f0f7992ef65d85b2238795d0b55c050246e0a3d39", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649248098, "uuid": "1426efb7-cc2b-4e1a-a18c-47d6cfa010de", "comment": "Malware payload (AgentTesla)", "value": "afd65f652eab3b145d80fbdba4681634bee40ad4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649248098, "uuid": "a461f39e-e1e8-4964-b792-c3d2a3d61440", "comment": "Malware payload (AgentTesla)", "value": "fc87416eeaa77b91dbeed74de6418b84215e80f07fee41847e1087373511d770a90ce7556fb7a03c64152822a89bcb89", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649248098, "uuid": "627af5eb-21a9-4cfa-863a-ba79ff847465", "value": "T1C1C47C72E3F86F4BD6BD51314039401579F2D9133224C99EBE9A11DA8EF2F424721BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649248098, "uuid": "904d70c1-194a-45fb-b71c-a862054242be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649248098, "uuid": "5853d572-9773-4d0b-b156-879466901137", "value": "12288:UqHFTSXW2CDeMWyHlf9yptSHZsaLH5k6KRYkLHCgv5Q/pZ45zaItz8Glm:5F9aUCaLZk3YkzYpZ6zZtzLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649248098, "uuid": "bc725888-ce6d-44b4-a412-993f29b47d4a", "value": 545280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649248098, "uuid": "dcea2420-999d-4795-bd61-bb9fa294b600", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649248098, "uuid": "7242de38-c63d-43a5-9a05-567472e96770", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6e6463-b59d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649244718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649244718, "uuid": "76c18809-773d-4800-ade4-50b9c7a256ad", "comment": "Malware payload (AgentTesla)", "value": "b23418e889a64808cdcd91424df6fe9f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649244718, "uuid": "e0972e92-ca2b-4cb0-b40d-9809b6b384ae", "comment": "Malware payload (AgentTesla)", "value": "9bad43f142a567a225549128b8fea3ad301cc5313ec43240573e44d815057c91", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649244718, "uuid": "0041d7c5-ec84-41cd-a8fd-42a8eef6ad40", "comment": "Malware payload (AgentTesla)", "value": "bdbf8ec28fd5483b7fd3a45c1a8642928f3794cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649244718, "uuid": "7b167c30-c760-40f6-bef8-31290747227d", "comment": "Malware payload (AgentTesla)", "value": "eb657f06d0de7e4aeae3e7becc8c93cb0e95eb2591fe5dfefa8b39e5e49e8d2f5206dac30ceb06fdc1f89f60735dc3a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649244718, "uuid": "2a61a8ca-059f-4790-9c36-f9648843dfe7", "value": "T18EB3E603B2567F17D5991679C1D70A2103E2AFC73273DBB5BE480A8A0A433E58E797C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649244718, "uuid": "ce24b59e-2008-4cd9-bae2-cf4f72e062a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649244718, "uuid": "5bb46b02-58c1-4589-8839-8a2f4b40a1bb", "value": "768:0fuy+bQ5v0c04QZbbZoY1yFm4mkpzRgSLDcyFAZCwmRi0Yu5FRERXdWGbGTGd/gB:qqo3znJ/pFAZcTiRXMGbGTGZgQYAAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649244718, "uuid": "2fc542e3-2209-4884-b4c6-59f71c03a13e", "value": 117248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649244718, "uuid": "46052596-10a1-4ed5-93f4-1a7542455e89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649244718, "uuid": "bca162e1-a9a5-4168-ad8b-ba8454598e9f", "value": "BLT6057880150.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b63dde75-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278022, "uuid": "acbddcc8-7adb-4abc-a1fa-ba9fcf3ede5b", "comment": "Malware payload", "value": "a594bbfda032162312c1dcb311c62aba", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278022, "uuid": "b76b00f4-a478-4eb6-8823-7e7345c9ab4c", "comment": "Malware payload", "value": "9baeff5808adf5237a148643a805aff9048167212d4ac36b75d781e8c7e9c15e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278022, "uuid": "0b9d7e15-369b-4cb1-9e0a-bf33f45adc7f", "comment": "Malware payload", "value": "f4f1605b59d3295e96bac5cc44e273252847b43c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278022, "uuid": "99a44f5a-3d41-44fd-a4bb-1bbd449fa0ed", "comment": "Malware payload", "value": "fa359d0d8e710380bda4d467213d5cb86da57c5ac616aab9445aa8e2762ab69f1e251cc777e559410af4405668b5aafa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278022, "uuid": "2aa4eb42-0858-4316-a914-4fc8295b9159", "value": "T17DA1E850112C1AB17246597AD26FFA52B50ECC1B0A777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278022, "uuid": "09fc0b82-9745-42d3-8ace-1dd81effde15", "value": "96:ojRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:iRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278022, "uuid": "61726803-5672-41d6-b437-8cf9d70ea52d", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278022, "uuid": "b2a90417-2077-4bd7-ac5a-a3dd0ed75801", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278022, "uuid": "6ac6eb0c-4e29-4d39-9723-e4113b295cc5", "value": "9baeff5808adf5237a148643a805aff9048167212d4ac36b75d781e8c7e9c15e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d97876e-b566-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649221072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221072, "uuid": "35fc3a01-55b2-442d-a90a-7dbdd639cb5e", "comment": "Malware payload", "value": "349ec4b5cb00f2cda00b05ea03268547", "object_relation": "md5", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221072, "uuid": "4539af6a-1038-440b-9f63-11aece960ef2", "comment": "Malware payload", "value": "9c3bf3b295c27de2731c549237c0b7ba342d76a6158ecd284aed1a5018ae1413", "object_relation": "sha256", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221072, "uuid": "4d1605c3-fc50-4ff1-a5ec-7704cc4a77f4", "comment": "Malware payload", "value": "712c94e2db360903173b94112b0e3098c71c6880", "object_relation": "sha1", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221072, "uuid": "1bf65125-efc2-4c37-90a3-fa27bed51998", "comment": "Malware payload", "value": "9b094b9b1c59026e3a4c5ff810aa8789a6b2b93d91b1ff5a3807dfb0edce6a468d4fb38a7182570bc8b027d12011f95f", "object_relation": "sha3-384", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221072, "uuid": "f56c0440-cad7-4ef9-b466-c4e2b0d95eb6", "value": "T1D00633C7F41DEC3615F7CF7025F6D631C0D9E2AA00D3ACB8A362A4DDB61A78940C65A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221072, "uuid": "14c28507-f110-4211-991d-1956e093fcd0", "value": "98304:kIft/PlLd4u8eZdYpIDrBBn02I/7GwWmANZIfrvLM/98k40p2:Dft/N8x2DrBB0WjGfrvG49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649221072, "uuid": "b4acd841-266c-4e07-8b6b-d3d5f5944433", "value": 3894941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649221072, "uuid": "7a3f376f-fe05-4eab-855d-1a2dd140c640", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221072, "uuid": "6d20efd7-9b70-48a8-9173-77d6824ccb8a", "value": "PDFne d7ob2n16o 7clra97fcm .zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b17fcb-b5c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649260029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260029, "uuid": "846cc636-a163-4f5c-afe2-872059af8b77", "comment": "Malware payload (Formbook)", "value": "05d7ef75529fa9c96ba3af2b3b8b46cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260029, "uuid": "93c1098e-1d63-4dd6-a410-7ddd9d064082", "comment": "Malware payload (Formbook)", "value": "9c5ca29eac3a8ed43997df919e47b72be824cb84564310870b30eb74096a5a57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260029, "uuid": "50e5c35e-774f-48a7-9d98-b724109e3f6a", "comment": "Malware payload (Formbook)", "value": "1eb5136ca9a0c3e37436df8463ec0614558696b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260029, "uuid": "8666e46b-c8bc-4966-a258-63cec21ac36a", "comment": "Malware payload (Formbook)", "value": "7a63046ebcfbed405ad952a0bb4cd5958e72092fb93a3c81b98663664e87a3cfb297b0ca41893670b8fcec49f96b1a50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260029, "uuid": "6490d961-1f8f-47ac-9dd4-4606b9b99ee9", "value": "T11FD4BB2A38BA100DB272AD6C6BBCB175911EF3F226365C7B0DF7050A15129F0DB9D627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260029, "uuid": "10134de8-ee28-4559-aa24-aa9baaefe245", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260029, "uuid": "81b8006c-894b-4a79-9c5d-d0827836fa26", "value": "12288:3H8Ub56F1HURPr45tNIVgbokwQgGZSmXh50IOSwMD8/SM:Nk5o276", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649260029, "uuid": "fcf2360a-17c4-4ce6-988d-342a0fe89d34", "value": 643120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649260029, "uuid": "4890aa7f-0e35-44b1-877e-20d1f0e4bd08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260029, "uuid": "daa96bc7-1471-4659-b918-cfe2bd2fb565", "value": "05d7ef75529fa9c96ba3af2b3b8b46cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f60a850-b58a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649236510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649236510, "uuid": "5189ef51-6ec9-4516-86da-98adce3dc071", "comment": "Malware payload", "value": "580307c9385bd498cea6a674dca1222a", "object_relation": "md5", "Tag": [ { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649236510, "uuid": "233df473-4538-49c3-9e1a-21cff4a9bd2b", "comment": "Malware payload", "value": "9d38fbafc8b61bcea5c9a28a35d7b6f49e63e090233b7e2190eafc72076ac5f2", "object_relation": "sha256", "Tag": [ { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649236510, "uuid": "53bfbab9-8d4c-4f17-a708-edfa1dd85222", "comment": "Malware payload", "value": "55b8a52c1a2494a18a5d1e4480f3d469ffaf0d8d", "object_relation": "sha1", "Tag": [ { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649236510, "uuid": "f09372af-bc8c-4fa4-bc45-597e86bda0d2", "comment": "Malware payload", "value": "46e6dc654ee995246c6a8153ccf7e3402e445af358d3c2234acf401299a57393fa9d4269b00d4883a17aa41b87dc62a0", "object_relation": "sha3-384", "Tag": [ { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649236510, "uuid": "cda0c156-c652-40f2-a8ce-38669cd48285", "value": "T10A92AE7DF19B0F88CE87D6A8121A6F821648F55D73C584A237BCDB387B4096B9213D38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649236510, "uuid": "061c6c79-b61c-4869-82d8-8c8b3ee619dc", "value": "384:RFH2v47MKbSrnkm1kVc7f/MB0U7UOF8D246YsjxZZ:RFfdWrnkm1kFB0gJOD2bYGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649236510, "uuid": "ca9dbaf7-229f-463e-a857-7097b0db36fd", "value": 19575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649236510, "uuid": "0034383f-e4e4-45de-a30f-b705125b04f6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649236510, "uuid": "8efca32f-bde8-466e-8e6f-b453939582cf", "value": "document.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a0f7a9a-b5e8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649276982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276982, "uuid": "f528e5a1-b8a9-47b6-b811-568149915d54", "comment": "Malware payload (Mirai)", "value": "187c481847b4fa987638226b52a2ffb3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276982, "uuid": "0973523d-3c21-4841-99ec-433cde391bec", "comment": "Malware payload (Mirai)", "value": "9d3f61b843ccb7ccf3f31792a9af5949dde1fb7cca6584797dd182037c945a00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276982, "uuid": "feafa4fe-876d-478c-b712-7024be3a8005", "comment": "Malware payload (Mirai)", "value": "549a862a7096b1f80ffa93f015e4ebc15ff9ae48", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276982, "uuid": "52299c79-3e7f-40cc-ac9b-7a85ce42554c", "comment": "Malware payload (Mirai)", "value": "ebee50470bea219aff4f0d417b8397f78652b674fc5dcac2fceb8546281b9709bbf91ec671dc6b8398604e54b966df18", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276982, "uuid": "cd5354be-25ba-4e5b-8e12-257d9740b30a", "value": "T1ECC2E17C9E01AAC8CA9BD1FF0BE013603E310FB481125D89556AF7DBC9A31E75062BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276982, "uuid": "49977d6d-d11c-4376-950b-e80a1c83ce46", "value": "768:YSFu2Fel2Ce+KcSjOf+gZj6gbPJgGlzDpbuR1Js:YSFu2Fel2CsFjOGO6SVJuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649276982, "uuid": "8f37b54a-b409-4e99-a196-288a16dca39c", "value": 25756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649276982, "uuid": "9984b53a-acb0-4f18-8561-915cadcd3452", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276982, "uuid": "77f46692-d44d-419d-b6d5-34538646a1d2", "value": "187c481847b4fa987638226b52a2ffb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab1339e4-b5ae-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649252234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252234, "uuid": "d6966f4d-facc-4265-8007-6734ba4a60b4", "comment": "Malware payload (AgentTesla)", "value": "dc1075aec81ea9e6785a2424a5f46519", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252234, "uuid": "b6c6f112-5250-421a-895b-7bce17f57c2e", "comment": "Malware payload (AgentTesla)", "value": "9d9a936978b19fc81f38e6ff2105b88e5d3a0e76efe63737a053a3d7fa5b946c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252234, "uuid": "c32d6d12-4003-4c6e-b0c3-a4102944c640", "comment": "Malware payload (AgentTesla)", "value": "43bf0acc48f0541e03cdc5813fc416c7cbedcda2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252234, "uuid": "27ed9cce-ec7f-41b6-a7d0-25234623a928", "comment": "Malware payload (AgentTesla)", "value": "5786c490f8d331734a13c0b18f0928155559a80e7708d90609b021421f2e1459cf1a1aa42e0349cc74e5db38f334345d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252234, "uuid": "e8eb0f16-b1e6-4146-8185-5003e0b4a88e", "value": "T16824EA02A9608197CF6761F9D57E8F38BB31A8ED94015D8E3373BEBB1931255A23B143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252234, "uuid": "71ca7fb9-8722-4833-90f8-8a129168976a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252234, "uuid": "e0db6a3f-f990-47c5-8c9f-3e7c10ff3bfc", "value": "1536:KT9Lu3njjyOaXP6AdbTyHKPF7HDSt/S7yl9QxMPSE:aAnynFbTNPF3St/XzQxMPSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649252234, "uuid": "1dff773d-9fa2-427f-a654-645af936a983", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649252234, "uuid": "5ba7c5ec-b5ba-4377-af43-107b1b0d5e0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252234, "uuid": "6e5e69ac-0ed4-471f-b985-6c22cddc10b5", "value": "Kepler Enquiry#20220406_AfB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0360c517-b5e8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649276863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276863, "uuid": "99b1d950-ec40-44c5-8d9b-8d6fc61dd228", "comment": "Malware payload (Mirai)", "value": "7ec7bde69f6a41fa12095048bdb34984", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276863, "uuid": "c1282107-82f8-400d-a3b0-377147be21c1", "comment": "Malware payload (Mirai)", "value": "9d9afb54b9eab1cca08a11390df95709ef5336fa4bc04e896f1b644bf621184f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276863, "uuid": "8d7deeb3-e068-4361-a32d-2dc6acd5cefb", "comment": "Malware payload (Mirai)", "value": "95fd6989958d2d34aa346fbc908a268557f335d7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276863, "uuid": "caf38409-0cd5-4058-8b17-12c07319a89e", "comment": "Malware payload (Mirai)", "value": "3e1420fc9a6067fef6b2061cb9d393f7328cf5b4f4275ca3ba8599bcf193102a125d182b2aa2ddd8fadac343353d38df", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276863, "uuid": "80600933-fcd1-40b4-b5fe-da7f2140fe1a", "value": "T14D435BC661C3FCF2E8110A3D34ABAB724EB7E53F6075EAC2E7995536A90C602910335D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276863, "uuid": "1e40c5f5-2aeb-4e03-94d9-5a6859e53d7c", "value": "768:70F8dcWFmZkft/VM7h0PsnK6bvQFYklK6q6KIBv4Y0owDcGUg:70+MZkf1VMVATF94I94YHwDcGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649276863, "uuid": "97e8b1ac-5568-42c2-9897-342d5766ba66", "value": 59664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649276863, "uuid": "ad61a0ca-e2ba-45f3-b08d-7d6abf8ca990", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276863, "uuid": "45771731-c38e-4782-881f-b4a0b3fd0603", "value": "i586-20220406-2027", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b702b8a8-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278023, "uuid": "f3c00e4a-9370-4499-993b-d63350616e47", "comment": "Malware payload", "value": "9734bca20df7571ee9b3df9ec9d85891", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278023, "uuid": "22bce51a-9cff-400f-8847-469903926dbc", "comment": "Malware payload", "value": "9e5201a975626f0945f2b48ff2f863ded44db50f464897e42e5e80f41519f546", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278023, "uuid": "d4cbb6f8-77e0-43dc-af32-3f56d799b8fe", "comment": "Malware payload", "value": "632bba8233bff875d6fa6b7e7d409d436cb135b3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278023, "uuid": "76234a28-b322-454e-a1f7-0aa6e1f15666", "comment": "Malware payload", "value": "2e0d93f71046d3bca455d2945580e1983b95ebf9ba5ce4eb8540e6b85d7152bb1ed1f07fff8dabae589b84a233cdde1d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278023, "uuid": "da6e2e42-5722-4b3b-be48-3e8416628c79", "value": "T184A1E850112C1AB17246597AD26FFA52B50EC81B09777B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278023, "uuid": "b469b9a9-d965-4b1a-9462-b675de4f5fc1", "value": "96:lRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:lRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278023, "uuid": "54d60fd0-3876-40d6-8195-fb04943936f8", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278023, "uuid": "e7b06050-292e-471e-97c9-78fab5564426", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278023, "uuid": "40a50d4a-a538-4c3e-acc4-d2911a5c7d42", "value": "9e5201a975626f0945f2b48ff2f863ded44db50f464897e42e5e80f41519f546", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56292e14-b5b8-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1649256386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256386, "uuid": "80d3387f-e251-476c-b778-6abb2a7333a4", "comment": "Malware payload (NanoCore)", "value": "e09274f7f6409a6c39314d9a7e5eb33f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256386, "uuid": "36b3e42f-1c04-419d-adc7-bd12a8dac851", "comment": "Malware payload (NanoCore)", "value": "9e564a960b5826184492da70eabf4727c49f5ba127835143e642a1de7ed02b9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256386, "uuid": "de5a48c9-ba11-4791-af6f-16dffe4c1b63", "comment": "Malware payload (NanoCore)", "value": "d3fa1b96bd40ab5ddf61cfe1214039de905c9c96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256386, "uuid": "59173efa-0d34-4653-81f7-31383fadb6bc", "comment": "Malware payload (NanoCore)", "value": "5b64ecf95171fe352b79e93784ecf64462cb145b83d31f98f49c25bb9f241104c018b87f2343329036cfd45bcc7b9c23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256386, "uuid": "330e1b8d-b261-4a0d-a5be-8f27b4b31e13", "value": "T190B4021A26CB46A8D87D53740C7AD09503FD6E2B6A12DF2E7EC972686F732025333947", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256386, "uuid": "a4b2768d-a686-46fb-95f5-8d2671ce4da4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256386, "uuid": "5af0c7fc-f20d-4a67-a9c4-8ee9240833b0", "value": "12288:8tdKpsH/mzBMdMAz+Ly5S25Fe6avz7uPajh/:coy/mzIMl2+LOSjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649256386, "uuid": "213a8250-ee74-4ec2-b7c2-fe3fdfae48ce", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649256386, "uuid": "ba858f43-0bda-4e92-bb3e-a5ba7d9f532e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256386, "uuid": "c2dad4bf-f070-42d5-9bb8-5669e8b77dfc", "value": "e09274f7f6409a6c39314d9a7e5eb33f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f210e8-b5e8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649276864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276864, "uuid": "f23357a8-24c3-4ce8-874a-bdede66bf518", "comment": "Malware payload (Mirai)", "value": "1c791f9c3a9fadf32af2caec691d23ef", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276864, "uuid": "b3ff0206-c543-46b3-9185-af4085872318", "comment": "Malware payload (Mirai)", "value": "9e75c4a2f876b9d4cf84c903b0bcf2bfc6f68146d5d3225386f6076b3481b941", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276864, "uuid": "0b17de1f-cb2b-490b-b654-044b95679147", "comment": "Malware payload (Mirai)", "value": "c1b805b5da5f3bf778b1e8b88886a785a0ad4e43", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276864, "uuid": "47f2f940-ad93-4189-99ff-baea38840349", "comment": "Malware payload (Mirai)", "value": "fdca908e9662338dd586ed02727cac46ec62262612a0f0e28c1d27caf7fd7f5d3395eb8c38bb20e6b880de8eb0aaf886", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276864, "uuid": "262d08e4-e4da-4367-b1b4-89423239f130", "value": "T1075339C1B88759F6C9034934609BF63FCB32D57B407196AEEF866E36DA23701531628E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276864, "uuid": "2561eb3f-987e-4b68-8d18-7e128162e162", "value": "1536:Z5Yxpbi2RVapPijLdNF+G7TdjxaJ8LRVlW9EGUz:bYlRVapPiPdDNcJ8FVlEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649276864, "uuid": "3a852f74-5184-4350-bff6-fa443d0dfe16", "value": 66320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649276864, "uuid": "590a9c18-03c5-4f7f-a1aa-ec6fc11446ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276864, "uuid": "5795ad73-d696-4280-9a27-78a32f2e6a25", "value": "i686-20220406-2027", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a81e6ed0-b5b9-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649256953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256953, "uuid": "edbfac44-dfc4-4d5a-82d3-aa6bbf602173", "comment": "Malware payload (SnakeKeylogger)", "value": "5085f0af19d96c14285f24c8babf29c2", "object_relation": "md5", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256953, "uuid": "6d35ca63-21ea-45e1-9ad2-a18bf574eee6", "comment": "Malware payload (SnakeKeylogger)", "value": "9ffd6a720ade1fbfce01fd4d2a22c1a87f036717e3ef5ca02f58f3ccb31a20c3", "object_relation": "sha256", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256953, "uuid": "3a487438-0b48-4aa2-8264-c27a0e395beb", "comment": "Malware payload (SnakeKeylogger)", "value": "23937e64b9b879d401ee126667e238d4ff212fde", "object_relation": "sha1", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256953, "uuid": "426cc9ac-0f49-4a01-9863-7f60b4c53b55", "comment": "Malware payload (SnakeKeylogger)", "value": "897f7da2f28a889dc3c392c1fcb217a9c05c4115bc818da6cef2ed552abfb4579614142c6f72f378678099f906b65653", "object_relation": "sha3-384", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256953, "uuid": "1a7d1376-354b-4fd0-8cec-39dcd4340d78", "value": "T156A40245B7ABD902D4BE1633A1D119060374AA27F4A7E78E1BCD14EE0F133D60A46BDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256953, "uuid": "1558d537-893f-4272-8657-7f49347f24f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256953, "uuid": "3e62c719-4d18-4e3c-b63b-12a19460139f", "value": "6144:P+Emz7ewBKR4iVZyqYf+QKsXwCw8tcHpGMCOCLW5hn+HPsFyr7A8yllUkNYtLZt:hmPemKnGKYwCwLHDL3+HPsgrPkCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649256953, "uuid": "c6dbfa1d-c3e3-4d7c-a21b-abb31fcf67bc", "value": 456192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649256953, "uuid": "abe727ed-a923-49d1-87b8-e70bbe427b6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256953, "uuid": "023dd088-b855-456e-8e62-1ad8b7f0d769", "value": "(BERN22081).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11ef78d-b5eb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278470, "uuid": "13c32adb-6bee-451d-9d52-9cc178daf8ed", "comment": "Malware payload", "value": "1d60a99f0c16203d2fdf1f2eec9d8d5a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278470, "uuid": "92eacf43-3be5-4a6a-adb9-4586579f353a", "comment": "Malware payload", "value": "a09832c1a8702d3e2b70a3234f767c42622c859c04e3005e7d2ae22ad9a3c9bd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278470, "uuid": "e7379a89-63cc-40b8-85f8-29bf2caed913", "comment": "Malware payload", "value": "7cdb85c1752c23e1a188ae3e1420394030e51168", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278470, "uuid": "93c7df41-32d4-4c32-9143-abdd3ca019ac", "comment": "Malware payload", "value": "5360bff433411df6b8cc4b9d83b63c53f73e5b25e5f8de16402805bb9c02f8a82c98148bcf6873476ac080286e195381", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278470, "uuid": "ba787f67-8156-4968-9957-41d7f56b6f77", "value": "T18674CE1272D0C1BAE3AF07340DA74B7E77B5BD418B71CA8B6794DF2D1E31602A926325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278470, "uuid": "62819ae5-f7ea-483c-9f74-956617e05763", "value": "f9052a428f025680924ffe4c32374e72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278470, "uuid": "33bd7808-0ef3-41aa-828c-789872ffc98a", "value": "6144:wcvynX8aBmTd9m6qH4YC4Pvogjav1iP/I4y8OQLZxUx:/vynLkTbm3og7HHZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278470, "uuid": "33cf7bff-5fb8-4372-bf2f-8f372ca49dfe", "value": 361403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278470, "uuid": "1d5797a0-0439-47d9-bf14-40b3eb36b603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278470, "uuid": "04ca780e-906b-4027-90f9-37c2fbae2575", "value": "emotet_exe_e4_a09832c1a8702d3e2b70a3234f767c42622c859c04e3005e7d2ae22ad9a3c9bd_2022-04-06__205425.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5afcae7c-b58a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649236637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649236637, "uuid": "02dda828-6fab-45c2-a89d-2b737690ede4", "comment": "Malware payload (Loki)", "value": "edfa56156dd16136494b52f03cab7a58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649236637, "uuid": "ef971aec-5a2a-483f-9539-ec995a7e69dd", "comment": "Malware payload (Loki)", "value": "a099e26ea2eacc3d27aa8e9fbf377376b753f03da84b52251d1e5f41030dbda5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649236637, "uuid": "299fe9eb-9fff-4935-b985-ce5710c32948", "comment": "Malware payload (Loki)", "value": "73b24ae729e9a4f2d87fc9dbbde99e5120eb525c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649236637, "uuid": "ba84330b-c95a-4136-addb-5c688a98b08a", "comment": "Malware payload (Loki)", "value": "e0fb84770503dfaaa0fc96d2375e4d6bdcea6f8808971ab8c170f8d78bb6c345e6851cffc1214ed7f48c92bbcebba2ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649236637, "uuid": "ff8eb388-1d9f-41bd-abc7-b3a03ef2a7fc", "value": "T1743412213AD4C6EBCA9205F35939AFFB8BE8E52A14AA4E1B47201629BD417C3D51F704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649236637, "uuid": "292ea3e1-4b86-4f3f-bf98-232b5b6773db", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649236637, "uuid": "5213ee76-e969-4ac8-89b5-3f053b4d0eca", "value": "3072:l1NjcVVnLpPunb7h2zmV6wk0wyq4exMHz/5GBlyWoW3C/jghr2qSgBh+j8w2bzTj:HNeZmV6w9a4e+9GBBLC/OTJwWvNTmg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649236637, "uuid": "df50406c-034b-4af9-9ad6-17c9100b9204", "value": 241412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649236637, "uuid": "69a6546f-c5d3-43c0-917c-b09705d679da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649236637, "uuid": "9e89aae0-aaf7-4c39-bd04-2cf25d037aac", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0659e10b-b5e8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649276868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276868, "uuid": "3fa99df7-7b2e-407c-a153-a42ae8f13a92", "comment": "Malware payload (Mirai)", "value": "b8e88f4691aaf8dd8811d770ec6aeb34", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276868, "uuid": "bd418bc0-56c8-46f5-be6a-81386f572f84", "comment": "Malware payload (Mirai)", "value": "a0c4bcacb3d81476ea457d9d36f2679e519336fbf493fa9879e6cf39279bb951", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276868, "uuid": "cc73e7f9-77ba-4cbb-bd1d-e0416c52817c", "comment": "Malware payload (Mirai)", "value": "d9af0589f9df858c33d649d9508fbacff26a87c9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276868, "uuid": "e9e2639e-3f70-4325-8d1d-cb492940342e", "comment": "Malware payload (Mirai)", "value": "4185cfe292c7151750a969d0ba94e981c50aa84c67b09be310a3b7cb39c5dc8e24e88a02d6798dfdf016e4c07397da0e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276868, "uuid": "7dd6e299-e3dd-4fa1-a7db-806423fb1546", "value": "T1D6D33B46FA408B13C5D61B76FA9F414A3322DB54D3DB3306991C9FF43F86A5E0E26606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276868, "uuid": "46edb7ee-5275-4000-82a3-b9f621812451", "value": "3072:VlvpxlZa14tuzbHJYYQwYkVGhuRaBSrM/94Vzv:VlvXk4+HJYYQNYGMaBeM/9Czv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649276868, "uuid": "e7d36a5e-f901-4d9b-9daa-434a3781437d", "value": 139648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649276868, "uuid": "2018a024-e0c7-4fcf-a158-dbb7a058a76f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276868, "uuid": "740af7a7-f983-4330-b449-475683c51a13", "value": "arm7-20220406-2027", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b869ec32-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278026, "uuid": "086e85d0-3a9a-406e-a2d2-730bc1be2db4", "comment": "Malware payload", "value": "5b5ba48bd1acb33174cdec299ee68866", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278026, "uuid": "795ed551-0b46-4cbf-aef5-a38f6e4bebb0", "comment": "Malware payload", "value": "a0dd7241a364d0df021d5d1ac175e195c683c2dad71be23585f958e063a40550", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278026, "uuid": "6a005070-1d91-4960-ae6f-87bf4f92e0c6", "comment": "Malware payload", "value": "7bbf1ff3e22791a372aa310f8c64db9398f9c80d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278026, "uuid": "08c2f9d2-6322-43a8-958b-341879395632", "comment": "Malware payload", "value": "6772db87f2fbbf8f136f34757b3e1d32e8432b56243d3cf7997f31a41ff4ed68d1285987da0fa228579c67992949251d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278026, "uuid": "d90ae3db-34bb-4646-b6ab-c9d6567588ee", "value": "T10EA1F850112C1AB17246597AD26FFB52B50EC81B0A777B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278026, "uuid": "286e2477-2d9d-4739-81af-6f5fd53d6650", "value": "96:9RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:9RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278026, "uuid": "bd6d8e62-f5a5-4526-8d31-068032f567a6", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278026, "uuid": "e941d0d1-83ee-4d56-8010-aec31fad42da", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278026, "uuid": "57d68031-bf66-40d8-8a8d-dce6c595527e", "value": "a0dd7241a364d0df021d5d1ac175e195c683c2dad71be23585f958e063a40550", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d70e38a-b5a0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1649246010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246010, "uuid": "4fa40384-be6f-4ba1-b64a-b7213f54c674", "comment": "Malware payload (AveMariaRAT)", "value": "e6be9ed6199aa2189844ed2cf6926c21", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246010, "uuid": "7ee9b253-d241-436a-8411-7725c2bef699", "comment": "Malware payload (AveMariaRAT)", "value": "a0e541496437bad633e17a042b3602a0e54bd65b11ec5c3f656d9b37307c9518", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246010, "uuid": "c2e30aac-3e9c-495c-99da-8031da0cd485", "comment": "Malware payload (AveMariaRAT)", "value": "563cd45c7c29da1a46850c86e8ede3a1a88ffa73", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246010, "uuid": "72ef1422-d2e5-4105-9e09-bb875eeeafbc", "comment": "Malware payload (AveMariaRAT)", "value": "19398ec2c2c222a606ba75f8bb1570e38ea2a1e8885c7e8e207a2ec244543bbee3533b9e69af39aa80664efc601487e2", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246010, "uuid": "daccc85e-b3d0-4b21-8399-596abcdbd197", "value": "T1358423B1BF5389893F1639B2584D3C230F54318BF948984DB08E6757E16EDB0529AAFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246010, "uuid": "d7bb6425-7624-47f5-a043-7617bbc7f42f", "value": "6144:2H3LuJZUwHQVGKDgA1eHiIODk3//8y5Fo0jAjj6C0HidBPiiukp+nzvpg0:0E5HI1QiIAk3/kuxsuCds+KW0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246010, "uuid": "f017b35c-2be2-4950-a935-4a8979b9b83b", "value": 402347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246010, "uuid": "9d9f76b9-0678-48a8-9129-c587ee1bf286", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246010, "uuid": "3d34bf33-291f-49dc-a4ae-bc36d6595275", "value": "Motox del Ecuador Enquiry Quotation N0_9011332.pdf.GZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ae030b-b5c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649260054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260054, "uuid": "9dc6b641-bf75-4f1c-964b-b4cfc6adb039", "comment": "Malware payload (RedLineStealer)", "value": "77cfefbfc6f83573ca5ec592270023db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260054, "uuid": "b391eedf-cfe3-464b-9a6e-6a004b4dfaf9", "comment": "Malware payload (RedLineStealer)", "value": "a0f546421046b449ca0f412438892027380bd3a94b07bb1904e816300e899ece", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260054, "uuid": "4a245117-26cf-406f-bf5a-dc926932e8c0", "comment": "Malware payload (RedLineStealer)", "value": "35b690a2b433fadac977272ca70ce1626a4acd8c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260054, "uuid": "7521775e-56fc-4e1f-83bf-97858cca6459", "comment": "Malware payload (RedLineStealer)", "value": "150662364570d6be8b6efafc8bdbf0215fbec3c6c455f0418d40cafd728b9759a0db1b88663a71e1d0fe836a27e135e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260054, "uuid": "5dd95e26-9ec0-47f5-9c1d-9d86bf6b324d", "value": "T14B74CF10BBA0D035F1B712F44AB9D3ACB93E79E15B2495CB62D516EE4634AE4EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260054, "uuid": "2c1750d5-9577-4c7f-b71f-d255e978b186", "value": "09b7cb9e514ec032fb567c3b682f1a2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260054, "uuid": "3ed8db0c-b418-4077-aafa-77ad6c517da2", "value": "6144:937tNu+6/mHq7L9wX4gmXvKrPZqhUJhDQmEZjKLX45N:93Tp6/mHq7uX4biLZnPDQmcjKjU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649260054, "uuid": "0c91053e-cb9a-4d25-ab77-7557695cdc3b", "value": 370688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649260054, "uuid": "13994d0d-9b0d-43d5-b581-661283513bb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260054, "uuid": "0a3ee044-288c-4219-9adf-a2f8812fd946", "value": "77cfefbfc6f83573ca5ec592270023db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84a46a06-b5f3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649281804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649281804, "uuid": "464117d2-260f-4b7c-9933-42e2451dc640", "comment": "Malware payload (Mirai)", "value": "1299e4d79ce33c68e65f79b36fd1e8e5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649281804, "uuid": "63e6a098-11f7-4e90-ba6f-b0f327dbfbf4", "comment": "Malware payload (Mirai)", "value": "a15e09b8a917752ddad386bc22a9c0d57aebfe385bd9c500e60299297ae1af10", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649281804, "uuid": "d3d17103-297a-48b7-9a96-72014d3651a0", "comment": "Malware payload (Mirai)", "value": "780aa1a74659bc57767ad3b5346125dbe20b19c9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649281804, "uuid": "4b1f614e-0d0a-42a3-83e3-f956637d27cb", "comment": "Malware payload (Mirai)", "value": "5fe401e2f4366150f52c1e202c543c6f3dbafd749e2fbb00979365a7db8e3c98720c950b95d8c01abb89fd62b82d259c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649281804, "uuid": "d8097bc4-9184-4a90-93a9-4a9308e9b820", "value": "T1F043F121E64F10B1CCF12837E99858D57BC9CBDAC4BDD091F2489A4CE99AE94F23CD51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649281804, "uuid": "e30fa69b-ab86-4c52-acb5-a74b2a787ea7", "value": "768:tXU7BTahejgb9FrjAqvmshZ9/szgRlrDWTiAI/MCqp9q3UELOb4ml6PhV6dxCbg:2lek8b9ljR/dRRdW3CTL3mloV6fCbg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649281804, "uuid": "fe4a499d-5059-47fa-b898-f4fbc67e46f7", "value": 56184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649281804, "uuid": "88af3d1a-99f3-4c30-b3c4-7d4fed59c718", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649281804, "uuid": "40740add-b201-4c56-b824-e7b80ee6d8a8", "value": "scorp.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2938359a-b5b0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649252875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252875, "uuid": "24751f49-38a2-4657-9559-684bbb4fcf27", "comment": "Malware payload", "value": "f57c51dcc9f1428a84c3b3a5e45b61c8", "object_relation": "md5", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "pw 123456ze", "colour": "#8B779B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252875, "uuid": "e2aa6213-a127-449b-864b-9023463b0c95", "comment": "Malware payload", "value": "a1b0b068d898ecbd5c166eabc372d57041d25e7f57ef640034b91fee2e5510cb", "object_relation": "sha256", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "pw 123456ze", "colour": "#8B779B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252875, "uuid": "88ec58c4-ffbb-4393-a3a9-5b5494d77af8", "comment": "Malware payload", "value": "de3f34f1745eb493a3ba31525a666cb815b91c1a", "object_relation": "sha1", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "pw 123456ze", "colour": "#8B779B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252875, "uuid": "325a7a11-e7d7-46ba-99a4-277db26812fc", "comment": "Malware payload", "value": "0ff1fb791bf8295567f999c8a8b9282cd35cc278ad70d8b700a5f621fede180a9f32ce21673f49d9f468dd9944e7ebca", "object_relation": "sha3-384", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "pw 123456ze", "colour": "#8B779B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252875, "uuid": "db16a7b0-9cda-448f-b6f3-c76dac5a7ecf", "value": "T107B63335919B0062C934EF7CE40A6596BD35190C11CAB70FF28C7768AAE2DE9FE457C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252875, "uuid": "ba3a962a-9b67-47db-878c-dd36115c14c6", "value": "196608:MxERf0Lj8kJp9FnXtf9tVfSfnfDA9/ubF5VIl/I4FNxsc:UQ0L5vnZ7lUnf89/ufVk/nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649252875, "uuid": "57fd63a0-3426-4a83-8a49-dbc251e21745", "value": 10561098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649252875, "uuid": "6579512a-357f-4231-8c03-2ab257ea5e27", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252875, "uuid": "7c37de4d-25fd-4347-8707-d0e0a020ef2a", "value": "PDVs1nver", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8eddbcd-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278027, "uuid": "1abd011c-1757-4663-9264-ce2c31816148", "comment": "Malware payload", "value": "f5fbfb22395ecbc09e82105df03665da", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278027, "uuid": "193e6663-b626-463e-961f-31ee156e9c61", "comment": "Malware payload", "value": "a1e2b51043364398beb932c2181df33ced3229cbf1b3e16b8e692e19ad796ec8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278027, "uuid": "03d3854f-9161-4e92-889e-71f24962bca6", "comment": "Malware payload", "value": "2ce51dd0c24a9d39b41e5b605d1a6eea6e73043c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278027, "uuid": "3330142c-8b77-4265-ab12-0849adfcf82b", "comment": "Malware payload", "value": "ae5cd793c4898d8a8ccb6a383186afed0cf5ad8a41e977560b282e15f5652e9b841c7fe48e9884647201060f46b44cc9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278027, "uuid": "e9cee11b-78f9-40b1-bf4f-6e7e00092f35", "value": "T124A1F850112C1AB17246597AD26FFA52B40EC81B0A777B358433A63C74F5DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278027, "uuid": "d9c413d9-f66b-4369-a1fb-e9f71821e472", "value": "96:rRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:rRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278027, "uuid": "a9a6398e-2a0e-4ce2-9665-61701382b95f", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278027, "uuid": "b40ab413-a96b-4435-9c31-2c4ecaa9d7f3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278027, "uuid": "90122924-408e-452f-a4a6-b2c7b4623128", "value": "a1e2b51043364398beb932c2181df33ced3229cbf1b3e16b8e692e19ad796ec8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f03a33-b593-11ec-8e58-42010a9c0032", "comment": "Malware payload (BumbleBee)", "timestamp": 1649240436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649240436, "uuid": "d046bd60-bd75-443e-a60c-67d69140fa2c", "comment": "Malware payload (BumbleBee)", "value": "aaf6ded96b838123fab2fa8ee649b1a3", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649240436, "uuid": "31654437-b58d-4100-8fc4-011307f55433", "comment": "Malware payload (BumbleBee)", "value": "a22c4f9df00887d5d329466f3cc94e71ca5f9adc23df15834a3001e404095aba", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649240436, "uuid": "6536f9ce-f3cd-4063-806c-9bf144ed5e4f", "comment": "Malware payload (BumbleBee)", "value": "0fe953bca9568b7ae9944c8235ea23ecfdfc5a11", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649240436, "uuid": "8f8a63f6-64b3-4720-b12a-64ae2910b3fa", "comment": "Malware payload (BumbleBee)", "value": "994218b2f140f656bf9f88f1c9f4dc3e50d077561492e63ace97a85295bcceac6114a2382fbfe10193c27a40d638cc0a", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649240436, "uuid": "a3c54769-f397-4b96-b28f-37f3348b5c0d", "value": "T17F957D55B7A800F4C976C27C8997950BE7F2B8151370BBDF0AA856BA0F23BE1163E750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649240436, "uuid": "8e3b16f0-4483-4dab-915b-c28ee65f8976", "value": "49152:G4qIzTDuP9e18Bgz6QJAhZGBo7K9cIMOqPGPoi:QTQJIGBRvMO1PT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649240436, "uuid": "6230b41e-c0e4-4f8e-a20d-6ae049d8e168", "value": 1974272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649240436, "uuid": "84cc0235-32b6-4887-a0ed-ac2f1d809a3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649240436, "uuid": "a83a7fd2-181d-434f-aef9-4b891673ac95", "value": "a22.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9650168-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278027, "uuid": "4a7fe62f-1a81-4239-a78f-21bec44041c6", "comment": "Malware payload", "value": "94d6ea51e0b92c7b12da07d0739503f7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278027, "uuid": "bf81ea46-7c01-4f66-9d96-8d7593dd9c40", "comment": "Malware payload", "value": "a233a7b946070ac861ba73e7699467f6f1589348b2e4d28c9f041cfa6cb96759", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278027, "uuid": "0945fd33-dcee-4e43-a0b3-5193be7cc903", "comment": "Malware payload", "value": "f38899ff5907bbb4523dd59ee4dd4df644c5f763", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278027, "uuid": "60a5154c-bdaa-467a-90c0-8e34a4c3b306", "comment": "Malware payload", "value": "d6768bb4c5c6e1e399cc4f0650542230989423cbaf81bf4ef22472c321420261e8b39d95f465c3e5f63f3ad95eb7c42a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278027, "uuid": "05157866-15d9-47fe-b314-3ea29360c6c6", "value": "T122A1E750112C1AB17246697AD26FFB52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278027, "uuid": "c60c19b6-35e7-41dd-a4e8-4957796e4d84", "value": "96:6RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:6RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278027, "uuid": "eee21895-56bf-4fe6-8534-e0d13ea65593", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278027, "uuid": "0947a934-4871-4626-b601-8375dc2905da", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278027, "uuid": "b61c41cb-1407-4e46-874a-f01c84c4efd9", "value": "a233a7b946070ac861ba73e7699467f6f1589348b2e4d28c9f041cfa6cb96759", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6ddaa2e-b5bb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649257944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257944, "uuid": "f1ddf389-c300-4a26-877b-919aa95d5af8", "comment": "Malware payload (Formbook)", "value": "0d988716fea4ccd73f188415a5b8c3ab", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257944, "uuid": "448262d2-3ba1-4ab6-ad14-b6b3ca996c8d", "comment": "Malware payload (Formbook)", "value": "a2603030a8290e393d554e4a1c5bd35a1d2e52fa501e118ab55bf852c892e98f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257944, "uuid": "d9b08e12-7645-491f-a523-cf1894db733f", "comment": "Malware payload (Formbook)", "value": "98fe4f49a4675966724b97ca694d764e45066575", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257944, "uuid": "99e9c816-cec4-406d-b8ba-3fc288954ad7", "comment": "Malware payload (Formbook)", "value": "24d5e29bbc6bcb42c397cedc33c58ba5135fd302134cbb56739cb387f35e57d93db8b9df2d1c4c2a59af26c2bde1d0c2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257944, "uuid": "bdd0fe3a-84af-41b7-9452-c931d9241df0", "value": "T11F1412DC396718AFC4ABEAB0CF1344427564FD6003A9A38713413A1EA735DE5A4CA6F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257944, "uuid": "1d022da2-a7e8-4891-8016-fad6d69f06a7", "value": "3072:wFP340Upb+fIFXMqwxRYCorY0RL+rJbnwsSGvi4xz1omx1kUlrm6n9RhMCTHmo:0P40UdXI6Co80RLoJNZvikoAkgJn9Rnp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257944, "uuid": "d768b842-dded-467b-afca-a29b9dbe997c", "value": 192312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257944, "uuid": "9212fee6-750d-425d-8b91-517ad7db809a", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257944, "uuid": "803bb4a7-32d7-4931-80c7-026339c596fb", "value": "PO# VP060214.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ecdee9-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278028, "uuid": "cb9dcf64-cbbb-4ad6-acd3-4aead9ef90fe", "comment": "Malware payload", "value": "f97ae427b1f74012784886d290289a58", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278028, "uuid": "aa954d91-030a-471e-9799-bff4a98d8c18", "comment": "Malware payload", "value": "a26bf71d7fa2ff687fb8825e9522ebdc1cb78bc2ad9551d7144b4aefce81b45b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278028, "uuid": "7fd439df-4bc4-4415-86ee-bea683c6ac11", "comment": "Malware payload", "value": "95958558cac564cb8ec6235d0a84ad36f8b69b64", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278028, "uuid": "20c8a1ea-6ce5-47b9-8238-e531cbad6a35", "comment": "Malware payload", "value": "a9a7d9ccee36cb7954dd897ed15c72dbab2f725eca880ea0f066394be41dd69b8cd607de5c2d99b44b94e4e79523883e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278028, "uuid": "19bf70b5-6ab6-41e9-9647-ddefffbe2c27", "value": "T195A1E850112C1AB17246697AD26FFB52B90EC81B0A777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278028, "uuid": "174f298c-d366-455e-b656-ffd01814e711", "value": "96:CRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:CRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278028, "uuid": "eb440a30-20eb-44b5-9ab8-b8b332f47e54", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278028, "uuid": "802f8877-22b3-41a0-b214-a623023bfe25", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278028, "uuid": "983bb52f-849d-418e-99db-cdcf41b40e05", "value": "a26bf71d7fa2ff687fb8825e9522ebdc1cb78bc2ad9551d7144b4aefce81b45b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "302adbd2-b5bc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649258040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258040, "uuid": "dae61d66-d7f9-4258-ba2e-8d244ba8080b", "comment": "Malware payload (Formbook)", "value": "77120b84d9f68f7740153fde5f73461e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258040, "uuid": "105eb1f1-9fc8-4238-abc2-54a3e64feb8f", "comment": "Malware payload (Formbook)", "value": "a2d67ab0acbe6f6a20a42ffbdd24b979fdf9d4386e98aed681f052973f28de55", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258040, "uuid": "4f9feb2c-5173-40cc-93a9-258193d43c30", "comment": "Malware payload (Formbook)", "value": "ab33bf825a0f796427859e2d9900c66b01efc46f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258040, "uuid": "d0abc783-023f-4e56-b98c-35ac523717ba", "comment": "Malware payload (Formbook)", "value": "aed20336c2af3596bd9d4c445f656cbcba7b7d47bab5b462aee3ab69ab9a84cbcc61ec78f1d47188ef68ac622012a8d6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258040, "uuid": "f4a5f5e8-cee1-4e24-a7e2-dbe1b0ef0d51", "value": "T1EE1402E2761D5B08CFCEAB7F642371B0A053FCC02D7AB2CA1BA2351546763565CA3636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258040, "uuid": "35a1c63c-4678-40d5-a3b4-d97d334ca22d", "value": "3072:M2TBi4HjJqKdk5T4aolU+0vK1E1vv/fYgffHbIzQE/eD+yWjQ9+:VBHdqKw43lP0z1vfrHMzQqeDdWU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649258040, "uuid": "7020cf40-1f39-4a3a-ab36-43604094d53b", "value": 192120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649258040, "uuid": "c6bb789d-032b-4046-8330-a51dcef6693e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258040, "uuid": "f7e0f91f-c396-4fa5-97fc-921a601f15e2", "value": "pedido de proveedor_83613.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba7ba157-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278029, "uuid": "2e2213bd-c9f1-4d68-ba3d-351c313e2006", "comment": "Malware payload", "value": "5ad3375abada5815a7b21e6c8a597bf1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278029, "uuid": "87144810-256d-43fb-94da-3d49bc9cf022", "comment": "Malware payload", "value": "a2e625c45772ada24a074d89d428f3d5906ec204762c2b0e79912a90a22a6ce2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278029, "uuid": "1b1c5c91-9a8d-4d1a-9350-38dd60bca5d5", "comment": "Malware payload", "value": "8f20387113d74f8789f421d972e4e0c5970c29b0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278029, "uuid": "dae9dee0-5b61-4e10-aba7-5fd2b51788b8", "comment": "Malware payload", "value": "d4bfd52a023d6585e620fea6f7316f42c002c6cf84d7c8e802e36d491a2b878f04a66a87ee54c8cd1ecccbff1c509a11", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278029, "uuid": "a2764a6a-3fbd-4c96-96cd-fff121793d65", "value": "T1DEA1F750112C1AB17346697AD26FFA52B90ECC1B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278029, "uuid": "c0876399-5c8c-4803-9168-2ea85daecb1f", "value": "96:MfRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:CRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278029, "uuid": "1a5e6843-3cff-4679-8111-511b0e12a7e5", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278029, "uuid": "473e6c2b-1e23-4504-850c-013da5339ff6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278029, "uuid": "b0d507a8-3a64-4639-9b16-77027a88346b", "value": "a2e625c45772ada24a074d89d428f3d5906ec204762c2b0e79912a90a22a6ce2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b9ea10-b593-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649240543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649240543, "uuid": "2119cc27-a5d8-4f9a-9616-8bc2f137ec0f", "comment": "Malware payload (Mirai)", "value": "5fa17eeaec3bd41c3988c27994d25404", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649240543, "uuid": "3cea59df-03a6-4a96-a6a8-70206dcfba5b", "comment": "Malware payload (Mirai)", "value": "a2e70b0e1aac4af775afb60bb0906fe6630b5b1e03243884ec345c2035c90d86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649240543, "uuid": "488bd063-781e-4c03-8d80-a692b61e0930", "comment": "Malware payload (Mirai)", "value": "351ba5ffcf92cf3f7ef0cab661ca950695d001d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649240543, "uuid": "e7be0206-db0c-4a2c-ae9e-167fa1d1174b", "comment": "Malware payload (Mirai)", "value": "3935121a82456f2f51e64ece8b9fcb138e256870210370c2a71fe9fb7138cc9d9a2273bce60bf497061f049c931850a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649240543, "uuid": "fff778e9-59e4-491a-b28b-aa4dc39c2bee", "value": "T11BC2E1214087B4B1C858A676DEAD91437B7E0470B9CE6151F1650B3CBEE78436BAE2E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649240543, "uuid": "bf6937ee-b6de-49c3-964b-19793bd4b827", "value": "384:+bPxlEOWAzEqcwPlhNbjoX9tzXEBzo+xCU6LEmdGU5EE:+b6AzEqcIlhBjoXXzXEFHCe3Ur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649240543, "uuid": "cbd3f443-9caa-481e-a7a3-7b03901aad7d", "value": 27956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649240543, "uuid": "1191ed96-437b-4105-94dd-1649e453407b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649240543, "uuid": "313b6a5f-1b62-4164-aff7-b0c21d017817", "value": "5fa17eeaec3bd41c3988c27994d25404", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf597bf-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278030, "uuid": "c3eb5b46-2687-4e37-8b49-8d452b02b5c2", "comment": "Malware payload", "value": "02b9d4ce885ff989c9ab6b7aefd1a805", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278030, "uuid": "86efc096-3d2f-49fc-a513-0e0a7a124370", "comment": "Malware payload", "value": "a2fc9684531b31b097faff9639e33f7c037b1786c2f4c2219e6f827d5b692dec", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278030, "uuid": "8b0c2964-6bae-43bf-a4ac-cd78a6603024", "comment": "Malware payload", "value": "4f9459ddd6065f2c5049a3b413c77a1b26eca33c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278030, "uuid": "271d7865-98e9-4bd5-be1c-b1e6482d6846", "comment": "Malware payload", "value": "c92b429fd7c658410cbb00974561673b1d71318f52f1b49fe595f018fa0fb8f0207a80c54363392890735a0935d02389", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278030, "uuid": "e5c3a371-3a9f-4dec-9957-bead6c64a7e8", "value": "T118A1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278030, "uuid": "4ab273df-d425-44c1-a3a8-a13d8973631f", "value": "96:JRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:JRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278030, "uuid": "65a95376-1ad5-486b-b0f5-b0ca4b606390", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278030, "uuid": "7a875b6e-a787-4a06-a6a0-5af4244a2ac9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278030, "uuid": "a6b39a8d-e2e5-4ba4-969c-06430ace58c0", "value": "a2fc9684531b31b097faff9639e33f7c037b1786c2f4c2219e6f827d5b692dec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0517b0ab-b5e8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649276866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276866, "uuid": "96446eee-ecaf-4320-99f6-816a4d2ff57e", "comment": "Malware payload (Mirai)", "value": "41db689e9f2fc2f9bd2bb39a76eb8824", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276866, "uuid": "af401758-f949-41e3-8a5b-c978057de95d", "comment": "Malware payload (Mirai)", "value": "a32d101b9fee2ef7f89be6863afc97132d1eb2d3b4a4079208320ed5394f6515", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276866, "uuid": "eca9db10-65af-4316-a8b9-320f7913560d", "comment": "Malware payload (Mirai)", "value": "177864dd8a4469a6a15d9b0ed19ef63cb232290b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276866, "uuid": "14f0632a-25ea-4b20-b0e6-0129e53690ef", "comment": "Malware payload (Mirai)", "value": "bfaa7cd905bd5a3ce101acdb7448bae89a11e51d492ddd02ee631ea5fa384dc6f4487abf12896053b0593b2a92f4abf3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276866, "uuid": "4fb38338-5e72-45cf-ad06-f380906d8d1a", "value": "T10B533A85BCA1DA25C7C053B7FE1F018D371497D8D1EE3202AD285FA476CB81E0E6769A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276866, "uuid": "753f7363-a1b4-4c95-88b9-27c85ceaaa9d", "value": "1536:rNb4bi5acCSCtYTRShpyT4F96Y8kwsy+BCV8U:rNb4biSrYFShWwhppBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649276866, "uuid": "d421b204-0ae2-4ad6-ad5a-80fa73298433", "value": 64996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649276866, "uuid": "f34d8414-7d31-43ab-934b-db7890139b1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276866, "uuid": "6af33dd7-1eef-4cc4-9e53-e07a3907dab2", "value": "arm-20220406-2027", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f596aa3c-b53e-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649204255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649204255, "uuid": "580915a7-6bf4-4d5f-afaa-c8963ba7c301", "comment": "Malware payload (RedLineStealer)", "value": "60b4d3e17c73c9985e6f0b127484a917", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649204255, "uuid": "b80e2a1e-7c98-4b4e-af9d-a6d5e996c49b", "comment": "Malware payload (RedLineStealer)", "value": "a3331913e3541c3cdd5bd525d238837e325b4204cd67dc0bbd6b0bfdbc293b23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649204255, "uuid": "519808f0-f91c-4268-8295-4aa014acfc87", "comment": "Malware payload (RedLineStealer)", "value": "e5aff9e913b983b9daafb17878e166871f5cb09f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649204255, "uuid": "44d0b906-80c9-44be-b6da-1fefb94c55d9", "comment": "Malware payload (RedLineStealer)", "value": "92216cf5ac9547dbd9fecf2e08140a7179db6d1561b16b261ca870bdf16fdff352af8454b5ec0d02883c2c3e2a571769", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649204255, "uuid": "7ad22dcc-eba5-41a3-b592-ff5102ed62a0", "value": "T1AF94E1C273929471C0513E30A866CBB1623FB832D671655BFB786B2E2E703E05AF5746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649204255, "uuid": "f0a2eedc-d3ad-485d-9e93-19a8a8da26f8", "value": "3e1371bce2a7dabfc48c6aff7cfba706", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649204255, "uuid": "1b1c13a8-6eba-43d6-81e4-958cdadd51c4", "value": "6144:pGKK/ubwJK49daHtTKv7qHVNIMwoiSdlA7dSBa1oRkIPxJ4U0Q7ITsq7igaI:pGKoubwsidaIOEWXKdOaAh4pQ79g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649204255, "uuid": "b910f46f-4a3e-4300-9e66-1d2124586e60", "value": 418816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649204255, "uuid": "74696cd4-6151-4e4c-b08a-989b82a2ebaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649204255, "uuid": "6502b812-fa8d-4974-978f-4dc5bedfde07", "value": "60b4d3e17c73c9985e6f0b127484a917.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb861750-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278031, "uuid": "648c32af-6836-4bfa-990e-2ee98cb662a0", "comment": "Malware payload", "value": "49d63e6319679e05279fad4469a03089", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278031, "uuid": "0b42e91d-100b-4f7b-b0d3-26c40cfa39f7", "comment": "Malware payload", "value": "a41c3ce67c7e011e7295e357048181472ca8d6863845d1280c512486037eafe9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278031, "uuid": "7d7e0505-aa5f-4285-ad75-aaddc9ad9ee4", "comment": "Malware payload", "value": "6f46ce5a2f7ace37611a8cba38fd1a2500a2caed", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278031, "uuid": "8250b7f9-507e-4341-80cf-2f8e469db269", "comment": "Malware payload", "value": "dcdfd63f15e7681b288e722b2e580a29e98e11bb7c4b50d9186866cc13175dde34011840789d09a30b437e29a3047ac0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278031, "uuid": "83b30e36-7a9b-466c-bcd3-cb88f28a027d", "value": "T19E518CCB436223703CD1D97F77FD160A7AA0E8A591D9BA04E9F8BEE5D18CD052340647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278031, "uuid": "ec91f4a1-ce02-4512-84da-19bcc8841b28", "value": "48:vF/g/q/lFnFSFraQGKvFkmRFAKFFnFSF7B+FGgrFsO93pFZnsFPt6FbheFPtN:vN82lmLvfFGCfLpU+iZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278031, "uuid": "1b40fd6f-3e1d-4c21-b1fd-ce5dc887bb86", "value": 2655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278031, "uuid": "6b1c5795-dea7-4883-905b-3e1fec68d1a6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278031, "uuid": "bce788ec-895a-4c51-9be0-f9631a0e2402", "value": "a41c3ce67c7e011e7295e357048181472ca8d6863845d1280c512486037eafe9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f613c44-b5a6-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649248590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649248590, "uuid": "a4cf032b-c781-4abc-80ba-62bed5dd17c9", "comment": "Malware payload (RedLineStealer)", "value": "4c654beea582e742c1cca3cc32a7a6bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649248590, "uuid": "2698bdc6-466c-4f38-bfbf-873dee4682de", "comment": "Malware payload (RedLineStealer)", "value": "a43281cf0d063b9593e114f62aac46346a1a377522c2a2e58c8a5275cb0887e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649248590, "uuid": "b5b051a9-7f50-4098-b750-cbf65859b858", "comment": "Malware payload (RedLineStealer)", "value": "27a1e345afef4d49ba886a6efe42063a9daf560d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649248590, "uuid": "24f4d9c5-c97f-4779-85a2-5ab21f95a379", "comment": "Malware payload (RedLineStealer)", "value": "cd129fdeee32a07653851f87b31878ab0d9a8d7de0d76afb2a2c488ee3e448da913277edf9dc85dc88d5265cafede4b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649248590, "uuid": "80eb06e4-a815-465b-8ebe-84e1dd2029a3", "value": "T18025BD1BA7A8D816D472D475D86BCAFCB620BE05E913816706F43E1FBEF012CE471A46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649248590, "uuid": "53c3e761-0baf-495a-99ad-700281bed610", "value": "12eb0292283efd2a658ace0a078570b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649248590, "uuid": "fdfb555b-9c26-4a1a-91f5-e139d2b0f404", "value": "12288:YepzApJNsQdsr7+Tma9e9juCa+aseRAmwrRsUauaRyaavtT41kzm9TBZ:Z1ApJ/laweQr+sJwdsUaua+4iu1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649248590, "uuid": "1021aaac-1c95-4e90-92d1-5a57395cb235", "value": 996824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649248590, "uuid": "620ad2e7-3b44-4051-afe6-aafc622d25e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649248590, "uuid": "1d21435a-cdcc-4bf8-9e88-9abbc2e0de2e", "value": "4c654beea582e742c1cca3cc32a7a6bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243a4913-b5a6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1649248571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649248571, "uuid": "1dbe2a7b-8c38-4d80-a83c-a3c608750729", "comment": "Malware payload (Smoke Loader)", "value": "67e7b84d89ebaeaf5dc946b623cbb3b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649248571, "uuid": "dd94b568-ecd0-4e3e-be6b-594db240bd11", "comment": "Malware payload (Smoke Loader)", "value": "a63dbe18cf6ff766405f06066655fca8fcdf2bfe2a0147006d3d29ef00734fc4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649248571, "uuid": "ccd5a567-bba3-413e-8168-8be601a17a83", "comment": "Malware payload (Smoke Loader)", "value": "5f61aa02ae5d156878e60fa926d19e67f8448229", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649248571, "uuid": "b3969c6d-daa0-4b06-a3ca-2a3139c0030f", "comment": "Malware payload (Smoke Loader)", "value": "9996cdbbcd74c2a2aba22c0ca20113c18861c930d7e769ad86fdb5d65e3a85718ba5f5b160c8d65bcf05d3e7e6bfa1a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649248571, "uuid": "3566bba2-0867-40ea-8892-1df901c3a56e", "value": "T1F054ADF132928471C0662E30E826CBB12A7F7872D6705517F778772E2E703D19AAE752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649248571, "uuid": "094b5a29-eef3-4a67-9a18-21e5663ba6b2", "value": "5cbd107a7eb6202007731da5377c40ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649248571, "uuid": "2e37ba76-9143-491b-a7e6-35e7fc47cc81", "value": "3072:7JX3bGpZa3rxYM8Xv/qkayY5GUnArfyIURimw3Wp0KtVggjcGkNIVqIpsxkgaBCh:BuaVYM8fifNwBZb3Wp0y7ITsqdiga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649248571, "uuid": "5af74410-643d-453e-80a4-ddbecd06c673", "value": 289280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649248571, "uuid": "ad3a573e-4055-4290-91a1-42df744a580b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649248571, "uuid": "a134d49a-feaf-4362-87b5-81348b92ab2f", "value": "67e7b84d89ebaeaf5dc946b623cbb3b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c864ade6-b5a0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649246270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246270, "uuid": "b8cb30e0-a77e-4f6c-a74a-0af821e36bca", "comment": "Malware payload (AgentTesla)", "value": "f7073086c59e22d15959fcab66a82802", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246270, "uuid": "95625b7f-9c7a-46f9-9510-6f220dbba3ce", "comment": "Malware payload (AgentTesla)", "value": "a6892d30d048fac5646d43d9ff3c4cd60270e9623d9679c544dfabaa674b2107", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246270, "uuid": "96fd34c1-dc40-49e2-81b6-5132cc5b93d3", "comment": "Malware payload (AgentTesla)", "value": "f2c532167c07a44679ea09c7741190248a07f32b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246270, "uuid": "c09a509f-b9de-4769-b22d-3580fc89ddac", "comment": "Malware payload (AgentTesla)", "value": "b71aa7474af8a2904fe79460f9e98f880fec73cc55704476141ddfb6718fdf0d4f12762124fc846e37033c2644741701", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246270, "uuid": "21cd748f-c9f4-4e2b-9a87-fd326ce2d068", "value": "T105B423608D94B3E5CC331D82849C9F892290677DF7AF6B5350BCC45AE87763A9F2B910", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246270, "uuid": "380dff35-e489-4dce-b6c1-810aca6b9ac8", "value": "12288:GdM3xfjLKlcFOpg4gx8Y5n1sajO6LmnfDOaW+8Vo0gK2pCg/xCv:pxfXR09gxTFSfa13gF/JCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246270, "uuid": "871d0e54-8292-4b2f-bc69-26017affe651", "value": 524043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246270, "uuid": "d7818e54-bf7e-4b22-9d0c-c20f59c3d8ad", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246270, "uuid": "485fca13-2abe-49e6-b20b-f6f03d1a9942", "value": "Signed PI April xlsx.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e96282a7-b5bb-11ec-8e58-42010a9c0032", "comment": "Malware payload (ModiLoader)", "timestamp": 1649257922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257922, "uuid": "07da629d-89b0-4543-8370-bb801e11bca9", "comment": "Malware payload (ModiLoader)", "value": "5ed69c82ceb255aa442677bd6003e7c5", "object_relation": "md5", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257922, "uuid": "440dbee4-3676-4b38-9d82-410a0d74c901", "comment": "Malware payload (ModiLoader)", "value": "a6cfe9a564fe856b4658a08f05802460622d1034a2e9e7004f85817e09e94c4f", "object_relation": "sha256", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257922, "uuid": "94d403fd-3cd9-4a06-b764-37961b65bcc8", "comment": "Malware payload (ModiLoader)", "value": "6292106d04dc197ed2db1cffa2dac26bc48f46a7", "object_relation": "sha1", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257922, "uuid": "ff685274-d091-46a9-99da-592918dede70", "comment": "Malware payload (ModiLoader)", "value": "5a1d801b9c1f56f4fe8e29fb4aeb9bca9070a02e8574cf6d0b2ff767bd0115164c1cfe996b651be2e72b156a51f086b1", "object_relation": "sha3-384", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257922, "uuid": "8b2162b9-bda5-4a98-9aa4-dd8c15056c75", "value": "T1801401C47D3672B6E1CA1D7C2574ED2AC970FD120786CAE2AA82362793B03D20560FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257922, "uuid": "45e1bec9-14de-43b5-aa99-a0d7d59c43c9", "value": "3072:omkeIuJihchU/I4plA4iITEll5TmaPxqiczSkKYrhBV6Bjy2pROWp/n:/kzwikV2lA4NTEllMaPxqXHKYVBV2pRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257922, "uuid": "8a447376-78aa-4d89-9110-870e694689bf", "value": 192152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257922, "uuid": "e1a32d8b-720b-4502-9c87-8ac51148d17c", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257922, "uuid": "3e0925d8-ca71-41e7-baba-44dd65f5c917", "value": "Pre-Payment Request USD25,097.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c26bfabd-b5c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649262151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262151, "uuid": "7b09b6b2-92e1-4539-bc2e-e23e22090948", "comment": "Malware payload (AgentTesla)", "value": "fce98939ba922e410e920acbf68c83ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262151, "uuid": "5245da9d-3dce-4487-8a21-19b7a58cfdfb", "comment": "Malware payload (AgentTesla)", "value": "a757b0fa35e7bb0fcf996241263b34d8890d9be20a8a05b1ae70412ebc2687f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262151, "uuid": "c519aa2a-4c7b-4624-9882-a65737872b66", "comment": "Malware payload (AgentTesla)", "value": "a34f950d56a7753a87d8e690b87176a25258fe69", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262151, "uuid": "6b9498d6-2445-4158-82f6-1b2364193306", "comment": "Malware payload (AgentTesla)", "value": "be21f810da9da1bba660e89a1abdab00e9328de1f09e76d7057a64d67a8c2b0fdf757d82b315e508736a69db6d74c3e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262151, "uuid": "e4f6dbf2-93f9-41bb-963b-f17b28b33002", "value": "T118C401197BAFEE16C16D96B3A4D2280443B0A702FA72C35F1ECD16EB57023DA49527D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262151, "uuid": "9df6b050-b136-44c9-b031-fb272c79fcc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262151, "uuid": "37342b0e-a9f5-433b-9feb-2b08c1011fce", "value": "12288:ldVsq8WTcNSD7gIP1iML+GbLWXhyQYrrgaKJYU2F:ldOjWAcYIP1iGPsiMaKyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262151, "uuid": "fa40d41c-9f88-49f8-a9f5-5a4f3f6626b5", "value": 556032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262151, "uuid": "9675b44f-4bcb-434b-8841-1dfa8765ec27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262151, "uuid": "d7668fb5-1fdc-464d-b91e-cc4d17848afb", "value": "HALKBANK002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fda4f93-b562-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649219439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649219439, "uuid": "00f1b509-1e26-4c81-9382-28571a517601", "comment": "Malware payload (AgentTesla)", "value": "0e36cb128a13a68bcd4237213bef2501", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649219439, "uuid": "b2f40fa5-bced-4efc-a841-d3db2b5281bd", "comment": "Malware payload (AgentTesla)", "value": "a7ba33c0613d364ab774e459e89e9b1ab6d9c9ef3f8520363c3c97b3052b2f1e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649219439, "uuid": "7703d83e-5596-4265-892c-e738c7928a54", "comment": "Malware payload (AgentTesla)", "value": "e8e907e0c2e7353be83a5d086cf47b58d3d3eba3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649219439, "uuid": "321ab22f-ece4-4e99-81ae-fc6a6e81695b", "comment": "Malware payload (AgentTesla)", "value": "ccce7c32b37b38b80ee3783a83de17f50a8c925196e96c25f9e997f64918e6bc6f5684fcddd96ef4e57abad87508f4f2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649219439, "uuid": "7aee301a-f066-4356-a14f-68cc4f0d1abb", "value": "T1FFC4018626EC9725EBBE53F3FCA505604BB99E135090D7F48AC5F3EA12F13145E01AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649219439, "uuid": "6f69a818-f3f6-481c-ac19-195e0e584e47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649219439, "uuid": "e200b31f-9d95-49e6-bca9-9fa096c311f0", "value": "12288:GucbkDrhnH1bGI/RovcXWkcbmXFcX5QVOOsl9V:eofhnH1dIbmlDsr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649219439, "uuid": "1bb1b1f9-8e33-4ab8-b351-7f6ebc88d24e", "value": 548864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649219439, "uuid": "6e8d73e2-849f-40f2-825e-c355d52fc615", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649219439, "uuid": "1ff1171f-b760-4a39-adfe-45eb9a193a1f", "value": "SecuriteInfo.com.Variant.Strictor.267077.19146.21417", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60851d32-b5a2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1649246955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246955, "uuid": "0850068f-9308-48a2-909e-eddd59655b32", "comment": "Malware payload (Stop)", "value": "c5579fb66c8879f6710bbc7ef11a1828", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246955, "uuid": "35055d13-5e5b-4a6a-a71e-d647723710b3", "comment": "Malware payload (Stop)", "value": "a7c4eb65f47cf8ffbdce873dc2f9ca0821fd755cb6d214b337b58f16b5d414a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246955, "uuid": "e2f22ad4-3fda-4dc8-a2ce-4d123ecfff49", "comment": "Malware payload (Stop)", "value": "5cf6d46eef09153d1ad0ee0ec643daa68f2cdd80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246955, "uuid": "183a3502-e5ae-4118-abf3-0052131163f9", "comment": "Malware payload (Stop)", "value": "89340efce65d212eafa444270a9ef012e015e2fedc6a59510e3dae42863d392fb0383f7911cc36c9bfe3e40cf7d5c058", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246955, "uuid": "d5c2421b-61c3-4fee-8266-2e36fb5b4a26", "value": "T1CBF40110BBA0D035F5BB22F849758398B93E7EB05B3091CBA2D116E95634AE5FD3134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246955, "uuid": "bff7b9b8-734a-40ff-9edc-230f1d688e77", "value": "6c738977a9ba132cd944bf8500fe1bed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246955, "uuid": "0be32740-8802-4133-8a7d-a7e49d5a0ce9", "value": "12288:burW5xjjaU1KWi+H//qnyFdl1ZMODqtjrEYPZlDu8by9QhotjoT8aaVH4:bgymuKaSyFrcC8G9QhcEAH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246955, "uuid": "9ed23c1d-1efd-463e-994c-a5e9f9144e5e", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246955, "uuid": "9f0d1be5-0b47-48dc-a199-05cdda0a4603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246955, "uuid": "f9dbbc1b-1e02-424e-9e25-626dc036bfb3", "value": "a7c4eb65f47cf8ffbdce873dc2f9ca0821fd755cb6d214b337b58f16b5d414a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fc38266-b547-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649207762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649207762, "uuid": "903de6a2-8437-43d2-88f5-1a055919ce62", "comment": "Malware payload (Heodo)", "value": "4762d0a5a18ee8b3d009e41406f0f349", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649207762, "uuid": "ce36be88-6591-4d58-8c86-8c99c54263d4", "comment": "Malware payload (Heodo)", "value": "a81a828cfd06b1e537b0e47034d39575be3a8b0d0f27e2f436434b996cb1f205", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649207762, "uuid": "43b3bf3e-0447-4994-a0ec-95a76a018f71", "comment": "Malware payload (Heodo)", "value": "956647ae054e584239f7af4446d5bdc66fb5bb38", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649207762, "uuid": "941ddfca-ff13-435c-92f1-c4d7f2cfb71c", "comment": "Malware payload (Heodo)", "value": "3067a33d90a858c1b05e17c43e5c42520dfecfdc8ff59a1c6de689ea7be78fc13bbf734b77dea385d14936b1809addcf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649207762, "uuid": "6e00a8f0-8335-46e1-9c97-4478d9ffd037", "value": "T10E74BF2275D2807BC6F321728646A26FB3F5D750473A6EC35BE10D586B38593D338B8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649207762, "uuid": "19926de8-f9ce-4e97-987b-1faca0972d4f", "value": "6144:g6FVcu+sW+Iz4TXVjPwSQ9ahaY85Z2pYxCCFJuf07vBkd1EK9uGBdDtkx:g6O4TpP0XjxCCFJuf07j+Xkx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649207762, "uuid": "0a5d1eb9-5e5f-4a50-8d13-54c03ae91455", "value": 360448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649207762, "uuid": "bb9649f3-65c0-46d9-bf3c-bf46d17b69bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649207762, "uuid": "198b68b5-a740-41c8-8913-823cf18cd16e", "value": "emotet_exe_e5_a81a828cfd06b1e537b0e47034d39575be3a8b0d0f27e2f436434b996cb1f205_2022-04-06__011557.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23cb9de1-b586-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649234827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234827, "uuid": "a7401495-82e8-460e-b5f2-e7797790fd79", "comment": "Malware payload", "value": "cb9f2e147d8b584625cbc1bd81d5c096", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234827, "uuid": "d596467a-b8f9-49a8-842d-305443a82fcb", "comment": "Malware payload", "value": "a859faa756f30fa11c8a0ef6883376c36beb636e2ad8e22117ea35ff4c03c33f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234827, "uuid": "7bc9612e-f9a8-4738-8be5-46ca37f22828", "comment": "Malware payload", "value": "4d085c5d0f6bb28153fca07d1d418aeed0969e83", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234827, "uuid": "6585da4b-ea4b-45e0-bbd8-cb45b0c0cc22", "comment": "Malware payload", "value": "64608a39e102e31df22730f399a5cb48842e037eded08f120a50549efff234a612c3ead48187df7c8b32ad866dbc2da1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234827, "uuid": "739b35aa-7de8-4472-b5aa-558a5c025b00", "value": "T14A4423421E064157C7AC3DA8268280B1D36EB3D58827B7307D197CDBE76A197EA0F7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234827, "uuid": "462a4162-d65f-456c-ae94-2a51b11ae36f", "value": "6144:Vz6NiUXPfijfiOpP5S4zzIU6sKvq+Xpz2gqEJj:d1KfmT1jn6sKvq+Xx2gN1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649234827, "uuid": "c6768216-dd71-4d02-845b-063ca95576d0", "value": 254395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649234827, "uuid": "7a6dbae5-5034-48f9-ae20-6c8aa4a674a1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234827, "uuid": "7ce70f9b-600a-4193-814b-b47929a4bc97", "value": "e0c8fbb2-f4f4-4a3d-5fe6-6de7595813f4.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc7601e5-b5c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649262571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262571, "uuid": "ea62d5bc-4b1e-4dc1-8d35-ced4e40ccd5f", "comment": "Malware payload (Loki)", "value": "d881dc55267153466b251102b51a62be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262571, "uuid": "97feb193-6e57-4124-9770-6ba18375c7d0", "comment": "Malware payload (Loki)", "value": "a8c095750b858bc7f42b1cafba38ad0436ce042bbe3f3e71b04d1c1cd4676df5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262571, "uuid": "d65f2b40-4243-45ae-85fa-22bf92680ea5", "comment": "Malware payload (Loki)", "value": "f6c5b1b246b083788d0086d31a78c9ae5f3de60f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262571, "uuid": "91026cc1-d7b6-4c64-89ef-8e541f1ab6a3", "comment": "Malware payload (Loki)", "value": "e9f4817b27cca9e975b43019fe43502023aa7293040e186a22fa974b4f357decedddf6af377211db3c84e46e2bc5b080", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262571, "uuid": "2681177f-997f-43c7-9d6f-589e5b34adfe", "value": "T1DB34126A2290DC67D4A282711C7F7BB79EB64A131829E60B67145F8F3D27B01DB1D3B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262571, "uuid": "43742768-859d-40d1-8a32-1fec1ac8deed", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262571, "uuid": "3e4c7329-29e8-4021-974b-774cea11a6ef", "value": "6144:HNeZmTUtxKG7Z3eJ6yCDFnmqRIjz/L20XHVKSd/:HNl4tgJOcZbXHVK+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262571, "uuid": "e4c084d6-e5b1-46dd-80df-5aea8aecbc6e", "value": 236778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262571, "uuid": "b486f78f-873f-4b7c-8033-304fb57334ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262571, "uuid": "7278b845-b264-466b-965b-09485623a172", "value": "d881dc55267153466b251102b51a62be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00ad87ab-b5cf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649266121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649266121, "uuid": "99af77a6-6672-48f0-8fd5-0c71147ca707", "comment": "Malware payload (Formbook)", "value": "628a7485ff121976a776a305616581f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649266121, "uuid": "2bc2dcf2-043d-4020-ac60-7503015b921e", "comment": "Malware payload (Formbook)", "value": "a8e45b2b0117e0a1e195a054667fca524862223bd2838a17f2ac9f47fe6191cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649266121, "uuid": "5ddf715d-02bf-4f65-a883-6f58e6e9626d", "comment": "Malware payload (Formbook)", "value": "b14a8eb559a7a28388b7cede334ccc08914c2516", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649266121, "uuid": "469c763f-e353-4b08-9816-9f933c52afad", "comment": "Malware payload (Formbook)", "value": "a69a7fd299028248311aec4d9071fd7f4fabd248ea444bdd34f6ac06eaf3fe2f01206ea794bbc3da41ee6ac3be416672", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649266121, "uuid": "c54960bd-8f15-4da6-8021-11b86fdbbad4", "value": "T1C9B4128627E86716D4BF87F2F02241804771A65B3475E62CCDE274EF1A23791AA06FD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649266121, "uuid": "782b0bf5-4a26-4cfe-9fd0-ccab6bfb20ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649266121, "uuid": "72a1c201-afe5-4fef-9dcb-45cd21edf0bc", "value": "12288:83r9bKr/rOu8gXNbS7jFQGFKutiCWlc28zbZ4cqtpvF:UeTOlgXtYFoPBlc2kqtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649266121, "uuid": "393e4db4-1d6b-45af-b0a1-45fe87015931", "value": 510976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649266121, "uuid": "248cb943-d47f-4efe-9f21-e335d40aea23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649266121, "uuid": "5cdb3a8d-3c9d-44cc-a765-09930511d306", "value": "new order pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfaedde6-b569-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649222660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222660, "uuid": "b983c211-473d-464e-90e4-2dcc70cf7e33", "comment": "Malware payload (Formbook)", "value": "b6252fc8d17a690fd8e0c2540ee09533", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222660, "uuid": "fa3769bb-64ab-46ca-8e8e-97eb4ea55efc", "comment": "Malware payload (Formbook)", "value": "a90737113be153e1970ae4e61b373b1764afe8f27c4550a48acb4770b85fabe6", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222660, "uuid": "c98f717d-44e5-4eba-951a-78cf48856237", "comment": "Malware payload (Formbook)", "value": "115c92f014bbb72b3d0483a586700bae88c42234", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222660, "uuid": "f8fbf00f-cb58-43bb-88d4-025c0b514fd8", "comment": "Malware payload (Formbook)", "value": "04438e43352865ee48aa596d406a151b13f5e92ab869d3710ed940211f57906e969b18c89c168eca4541a993adfa72f6", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222660, "uuid": "f5f6912c-20a4-4934-8ce9-11ce53c0316f", "value": "T1A33422542A90DC679123E20236327DB26B772793276B3352283B36DFB835C034B7956B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222660, "uuid": "6df0c25d-8b53-4dec-827b-ffef4bc1434d", "value": "6144:Y3O/L3JovPzDSzkF9OAcBxLckKnirwbVbZqJMeWq:s+yvrDSgWAcBxLVvUbZqJMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649222660, "uuid": "374212c2-2434-4886-b18f-c7705a14ea5c", "value": 232861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649222660, "uuid": "518a6a00-445b-4876-9349-2f278800768e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222660, "uuid": "c86fd555-cf12-4a2a-a494-f324f75580b1", "value": "DHL SHIPMENT DELIVERY-PACKAGE-INV-AWB247634563576.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593826e7-b5bc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649258109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258109, "uuid": "ccb28532-09e2-4245-a2fe-a4d453835163", "comment": "Malware payload (Loki)", "value": "7778ab235d69f853671117fb936a2482", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258109, "uuid": "9bd22f38-8b31-49db-b3a2-ca0c87cec040", "comment": "Malware payload (Loki)", "value": "aa9d523c96cea5318bc4f06e56434e903dba96ac198cc8e553908bb7b23f41aa", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258109, "uuid": "0bb03029-4db0-4221-93be-c63d5a03753d", "comment": "Malware payload (Loki)", "value": "77f35fc8573b639a069fbc65c66bff75deaa4151", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258109, "uuid": "dd518173-9b7a-4b7e-a59f-a7f2a3854722", "comment": "Malware payload (Loki)", "value": "56f1bc67d5c63a7f15cef4e4168fb7e1749de496ce291eaea2126b3fd61020358cd9fcd62d6bdeead90bca11ce715f66", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258109, "uuid": "248487e2-355a-4fa7-a6fc-a1ce93476a12", "value": "T1E11422897352660ED2422F33BA50AB9ADE00FCC6AC5973D99F2731AF6EBC515C391061", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258109, "uuid": "37b18482-63b8-4c12-bac9-ceca30f4e07e", "value": "3072:qoeq2N2pNF13XwNZUdoV4WGmwBHVWH37OwiGCXC0vd0n7AyAACsQzZA4F:Kq2NwNnHwNZc5tHIyPGCXCN75AAlaA4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649258109, "uuid": "8a24de6b-35da-4012-9a76-143c3fb72827", "value": 192104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649258109, "uuid": "bbe6b17b-ba2f-4bb7-96fa-4cc866adbd47", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258109, "uuid": "46205aed-f4ff-4a1e-a2d1-2cae68214a8a", "value": "SHIPPING DOCUMENTS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a2724f-b5e9-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1649277667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277667, "uuid": "0d7111a5-4cff-4d49-83cf-66cef6fb3017", "comment": "Malware payload (RemcosRAT)", "value": "00a432963925fff6e3d41e6fb39d494e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277667, "uuid": "31c9fc1b-157c-446f-ac77-e785b2ab7a3f", "comment": "Malware payload (RemcosRAT)", "value": "ab6089eaf0b6e157fd74eb677bdd1e457cbbe9cc1b97699dc7e8dab7989eab2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277667, "uuid": "c1791708-d182-4a7a-b393-10e0242d4210", "comment": "Malware payload (RemcosRAT)", "value": "3591baf771be6b11f3e6e60431b19ca5aad4b594", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277667, "uuid": "db79fd50-71a3-4e31-8f48-0f9b25743d94", "comment": "Malware payload (RemcosRAT)", "value": "3d8f4f4bbea2d837f93cefad1b4dc057f76b361fad8f9d0890cea30416dd4e61764315c2811f1e54b38f170c4b097e1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277667, "uuid": "0ece7013-bdf0-4d8c-83d5-361b446ef81f", "value": "T1F9455CA1B2D0D436D1225A3B3C1ABE7067B56E10FE3468457ADCEDCCAE39E913B15243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277667, "uuid": "a1cd0531-33f2-47fc-a675-3d14e99e5017", "value": "f5ef87918d0e8c87fd8d7a368f835b77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277667, "uuid": "35a4e18b-06c0-40b3-8bd9-c06f8368c447", "value": "24576:I1H0798GPywlA05Kn4wMSSFBL3O9osgtARoCGEzEYcfqwcB:ihGPBTFBL3OaF3fyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277667, "uuid": "8266acba-5b21-4b65-bd21-40a217801113", "value": 1233408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277667, "uuid": "34a0e98e-b8f4-4441-8a92-775b1d585e21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277667, "uuid": "9808848e-64e2-4053-a874-5458433932f6", "value": "Waybill.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcb69d50-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278033, "uuid": "bdbc54bc-085b-4a80-b33a-4f3962371fd7", "comment": "Malware payload", "value": "ec912ef4d1708360ebc0577037ebc030", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278033, "uuid": "4995c2ca-726e-43fc-9545-f997b1ee6964", "comment": "Malware payload", "value": "abf1650bf17c318b386892ba12b6bb63f6dae04efd1e2e7f9eb4e3307379c295", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278033, "uuid": "8d5dafcc-5675-435f-be79-5f9ddb46df19", "comment": "Malware payload", "value": "4f4a829d8e048284454ea70a845ef79771aa14d1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278033, "uuid": "de9c0103-c925-4619-9034-9f8d68ad0bed", "comment": "Malware payload", "value": "2d3258818490ae2a3f574b2e21a78e81ef76eb7830bf35ed66673ccbce383cb127ec1d41a2f940a7a8ea3eb95a4c2882", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278033, "uuid": "5c15e2d6-0eda-4025-8ba6-34c7032a054d", "value": "T198A1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278033, "uuid": "09b99b30-b428-40ea-8740-f0274eb48ca7", "value": "96:wRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:wRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278033, "uuid": "6f7097bf-4534-4327-9f32-4174aeaafa4b", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278033, "uuid": "144b097d-03af-46b4-adc6-07d503e90abe", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278033, "uuid": "777824c5-ca8e-418f-b8a2-58b3f454d967", "value": "abf1650bf17c318b386892ba12b6bb63f6dae04efd1e2e7f9eb4e3307379c295", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1574756-b5a6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649248915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649248915, "uuid": "2af190e9-c5e3-49ca-998e-663c773a5251", "comment": "Malware payload (Formbook)", "value": "5b1841d0c18e89d5cf760f1fe01f6a04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649248915, "uuid": "d9c5907b-9ed9-4a5f-9e8b-b350ff8cc3f7", "comment": "Malware payload (Formbook)", "value": "abf6e4dbdc36900f0f2be2111c9431704d2e770a92eba6bf9210cd39e18f5139", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649248915, "uuid": "7510919f-7586-4b5e-aa2f-075387a4023e", "comment": "Malware payload (Formbook)", "value": "d038924a9f0fe2fcdc0b4ffa1d812d65ba05e0c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649248915, "uuid": "e1e241b1-e76c-46a3-a5fb-6c81f0205a46", "comment": "Malware payload (Formbook)", "value": "8a4395cd6cad1a9a4917dbf55a1166817cc4f07e62643ad743cfb60bdf039a8df49edd3fc3256fc4f02c5437c52d65f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649248915, "uuid": "066b9563-bcaf-4e20-ac7d-742fcb698eac", "value": "T195A41247B237DA61C9A653FA84C08050133663476627C74FEDDC2258FB527FB8AB1AE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649248915, "uuid": "09ef4879-55fc-4594-bf50-07edb6ebfb3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649248915, "uuid": "361424b2-5873-4c31-b82e-1af5bb5bc923", "value": "6144:kNc04eEJmA2Sa4jcPbXys+ERDGO3zcFRTpbDzmsSGG9TmGm17MgO9vRMYUQx0O5m:p0TEJmbS1Gbis1DAFnbmDP4m6YUQjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649248915, "uuid": "20ef6819-f12a-43de-af32-dc3f38610786", "value": 473088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649248915, "uuid": "9d674874-5674-4da7-a82b-4c5eb05c72cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649248915, "uuid": "5423f902-4eac-4798-84f8-61efcd7451f9", "value": "RFQ 37 - DR106305 - 5827764 -ArcelorMittal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6cd8c38-b56e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649224846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224846, "uuid": "61d8f744-ca3f-4a1b-a4f0-4e380a7e6cc0", "comment": "Malware payload (Formbook)", "value": "1b3a8814b9f39a427c75119176e730a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224846, "uuid": "d683be52-b962-4dce-aa1e-e92885f1e22f", "comment": "Malware payload (Formbook)", "value": "ac4f54c754e6522cc5d4348a6c138718700ec82097225cae5b46a1eeffdfd094", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224846, "uuid": "bdcb9a7c-26cc-4a51-9752-5475e426e6e5", "comment": "Malware payload (Formbook)", "value": "c71724de45d4f75d19fbb7e5f6567d05eabd60db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224846, "uuid": "a0489f94-329e-463d-8744-05dc641b0d19", "comment": "Malware payload (Formbook)", "value": "e8d8373a48b87df804b24e49707f9ec598203dfe26f2f18669c1914f5ebbe3619d309a2e74d4de5c3f2dea168881a51d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224846, "uuid": "7fe9e10c-0639-44ef-8f12-63e77b025116", "value": "T1A013E6567891661EC5D47BF86DB1A29366357CE10124C18FACF97F2AE933213CCC226D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224846, "uuid": "6d1b6d72-9922-410e-ac20-6272971bb8b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224846, "uuid": "8d38d71c-26cf-4c50-b66c-e8517ac2324b", "value": "384:4HmJYguTiBQeaeTblJEqAQEulai+MwCKPEH2S3dd0hUADkak2CR:4GJY7TWTbC8lsMwCK63deVDS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649224846, "uuid": "9339d2f8-a85d-4ce1-98a3-bcd3d15bf14d", "value": 42496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649224846, "uuid": "81ac8420-c6b8-466c-9eda-bfdd5f742779", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224846, "uuid": "ace97412-b86e-4b59-8fdc-0368dbae894b", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd556b43-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278034, "uuid": "882d83f6-d5aa-475f-bfc0-9b36a975398b", "comment": "Malware payload", "value": "8c47caf854c18a53c0bc8b7eb5fd76dc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278034, "uuid": "a935dc0b-33e0-4d22-9688-5b70b40e8f3c", "comment": "Malware payload", "value": "ac582bf1be8993da53bbc18c92ee867d23e443a5517d2326376326addd1c5099", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278034, "uuid": "3e8c231a-e5b7-4f77-827d-a70de492cb5f", "comment": "Malware payload", "value": "96dfbb76280cc9ff0366a5e99cbd9d705e8faf9e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278034, "uuid": "57fef5be-2498-4103-8f55-736d72cf0abb", "comment": "Malware payload", "value": "c23190840e304d009033af2319769b65a52a60947d6368b68602fd0442a5d46bc4dfbda0b0b27febac0784de12dcf6e0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278034, "uuid": "6999902b-bb2e-48a5-850f-4cc3d07cf228", "value": "T12A411F8671A148B02EA0E8EF72694C8436C0D09B7CD65FF91CFCF8E502ADE947461BD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278034, "uuid": "61508519-b60c-4e13-bfb5-e5dab6b9e553", "value": "48:vKb0hEKoJdelRkmP8LJmbOIdKUNuVvMJq8L/2bH0oX:v+6RkKCuO6qvWq8L/2bH06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278034, "uuid": "5b064421-0829-452b-a166-1f5aaed85a1a", "value": 2260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278034, "uuid": "cedd4734-aa32-441c-848b-0bf400e47dba", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278034, "uuid": "da2ccaac-5ccb-4db5-b525-6d6489b03804", "value": "ac582bf1be8993da53bbc18c92ee867d23e443a5517d2326376326addd1c5099", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e27d8c5a-b543-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649206370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649206370, "uuid": "da3466ab-9021-441e-8693-6726debe1d65", "comment": "Malware payload (Loki)", "value": "0e2c180b6a319d84e3f52007e1becdb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649206370, "uuid": "249b47a1-2cc3-42f2-9c34-d5368d7a26e3", "comment": "Malware payload (Loki)", "value": "acb0e018ff099cbe5d4041ca61472ba2d1c48dbee0064c26dcc6f7a58c15c0c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649206370, "uuid": "409f0cc9-42de-47ef-8ed3-605ac7e22b46", "comment": "Malware payload (Loki)", "value": "0e4192a8899e183aa985b8b914cde2215d2d7e78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649206370, "uuid": "707c0a79-f6c7-4ac6-bb49-11b1d021b7f1", "comment": "Malware payload (Loki)", "value": "f9e095b0449af6d22a2f5f7e3877bad71001accf387fbe2d189ca775a3a7944beb5389c21e2f3ff1c4609e868dfb9451", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649206370, "uuid": "b4d30eab-d19b-47e0-beb1-ddf51c59946b", "value": "T1209469743A1EEDA7C461073E3325B64215651DE328A9C7CD4B83B909267E2B74A1B3F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649206370, "uuid": "84d7b1ac-25f2-4175-b6bb-03a9e31c5ae9", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649206370, "uuid": "52ab2ad3-8dad-4984-99a5-e6207fd094e3", "value": "6144:eNeZ1hm+Epw2npANNgWfOYjKGGedNtNo6qRVp5Mele:eNim+EyIAIWfNjKmyRBle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649206370, "uuid": "e1df09e5-3ca2-49ba-96d3-541a5ea7cdc8", "value": 408424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649206370, "uuid": "3d3b6da3-d18a-46bf-8dfa-acbd4cb90f8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649206370, "uuid": "8385d81a-ad77-435f-b023-3aa05a60d529", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4041e0c9-b566-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649221131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221131, "uuid": "3a1f738e-224c-42ac-bf69-28b9c276b8c7", "comment": "Malware payload", "value": "ecf5fe82924144df91b0ae8495247fac", "object_relation": "md5", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221131, "uuid": "e44ec8cf-2de2-4f68-8665-47efc9f11f88", "comment": "Malware payload", "value": "accb6b7f0cf949b35ce48fc284ab1b2c400cc1586f7643847583eba28084a86b", "object_relation": "sha256", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221131, "uuid": "8ec35f1c-13d7-4843-a7bc-e28cb7808e1e", "comment": "Malware payload", "value": "5d37de38f7b930c4644661b49206a4722599fb55", "object_relation": "sha1", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221131, "uuid": "8c4ea6d0-6cfa-4db7-a2c5-9d60e44457b2", "comment": "Malware payload", "value": "c554f96150659842b14b2bdb20226f06f0a2cd06a587f854ea1586e2c85a032849155cafcbc0d0c05c2d46105ff4587d", "object_relation": "sha3-384", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221131, "uuid": "67c5eeeb-df13-4710-a2ac-26314d18c341", "value": "T17E16238BF986DB3FC1EB8B31655BD33680B9E13440A345666364B40D7DE3280A3DB1E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221131, "uuid": "3bcd9218-f8bf-46a4-a913-eeb890a777a8", "value": "98304:XrY5AOIFrBvf/jMkQ0WWCowEUKIFrBvf/jMkQ0WWCowEUFIFrBvf/jMkQ0WWCowH:XXFrBv/QbWCoyFrBv/QbWCohFrBv/Qbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649221131, "uuid": "eb220508-ed98-49ab-beb6-7602b9ed7d19", "value": 4063232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649221131, "uuid": "313d7d3b-7725-4600-a9ef-996fe481a60a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221131, "uuid": "afb3b94c-7ab2-4628-bd97-dd5ae9ee303b", "value": "jkh467n2d8j0qh 3an2w1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be26b630-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278035, "uuid": "4d30d663-0a9b-4930-9563-d6b999f7db65", "comment": "Malware payload", "value": "ec137117e7bb0d820ca2442bc74783a2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278035, "uuid": "63d57289-e687-4fa1-8140-fb1f211522a8", "comment": "Malware payload", "value": "adc675f971f8225092ea92d4f3237e9e0ef31c5d953d5e15e06572984431b26f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278035, "uuid": "c0a6d236-4bc5-4cec-92da-5b7e5789d2c9", "comment": "Malware payload", "value": "845ebe4a546ac580b38e0e774e5a354c1faa030f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278035, "uuid": "0630b406-0cb7-4a42-a3e9-775b35ce67f5", "comment": "Malware payload", "value": "c2ff1330961a421e85df60c69ca807da6385bfcbac6245ba9622fe21168c14f951424798d87ada430ba451cab178c8bb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278035, "uuid": "4f18f7f9-24e1-4e24-a7c5-28fdc29a6829", "value": "T178A1F850112C1AB07246597AD26FFA52B50EC81B09777B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278035, "uuid": "b00f31b7-98ba-462c-a177-e0670c02cba2", "value": "96:TLRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:TLRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278035, "uuid": "e3525084-e256-4634-b6e8-1ca154e23d33", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278035, "uuid": "9cb6a174-ee6a-4101-85a4-dab6c1c2ae41", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278035, "uuid": "6b65b150-a7d1-473c-a709-30fc7ca29d08", "value": "adc675f971f8225092ea92d4f3237e9e0ef31c5d953d5e15e06572984431b26f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09e7b0d3-b5bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1649259265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649259265, "uuid": "402f7d3b-fcc9-450d-b284-af4c2ca3a78a", "comment": "Malware payload (Quakbot)", "value": "ea33aa4d46457e04a2f2fd63c1d099cb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tzr01", "colour": "#8ED4F7", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649259265, "uuid": "71013d32-5894-4ebd-8ef9-779557edac90", "comment": "Malware payload (Quakbot)", "value": "adc9222b2d104cc7d66fbf95f8095ca719a363c1b3a053c48faf669e69c50c9a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tzr01", "colour": "#8ED4F7", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649259265, "uuid": "b6d19fe4-aa14-40c3-b29d-1e68f36446de", "comment": "Malware payload (Quakbot)", "value": "7b4cb63cbf62e2d12dce1aa20b5082a876dce50f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tzr01", "colour": "#8ED4F7", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649259265, "uuid": "49de5d9e-86bc-4ebd-b929-d03347679ce9", "comment": "Malware payload (Quakbot)", "value": "535db4405bbb9f927c8bcabdd5f2d67cd7f9591510fd8b50de227c34e7553bcd88b1e6d5ca03a565c989dfa2cc0ffb2b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tzr01", "colour": "#8ED4F7", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649259265, "uuid": "a01f44b6-c45e-4179-9608-4ee887bed42c", "value": "T145769D12925C4D7FE249EC35A14AE34332F3FED5A668DF5A24981CA1580F8F0F636AD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649259265, "uuid": "0fe800a2-86ef-4723-ba7e-3d04d60a1ecc", "value": "7285048754dea1996ef8dd3b183f492f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649259265, "uuid": "55355fdf-85c9-4ced-92c4-d1ba3a84f574", "value": "24576:+Dm6C8PopK0PNsr/Tdvq4c3xwfirGnjYfnBsM1HtLOqiggOJopirMrmch42OiCJT:nVo8ansBqMMjS4r+qNLqJkL6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649259265, "uuid": "e9b82d9b-2f56-4867-9f60-e2b70d6bcb9c", "value": 7164928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649259265, "uuid": "e0f26dd4-8178-4735-a54f-0d76556c7da5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649259265, "uuid": "5885e7e6-e40e-4327-8d3f-c0f8bfbe3552", "value": "DCF[2022.04.06_13-11].xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a7a2fa-b5c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649262638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262638, "uuid": "5b5446f8-2a03-4250-8850-6da9abb30f50", "comment": "Malware payload (Loki)", "value": "f69f794f7f02b87a916e818e66fccbf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262638, "uuid": "0e27b46b-13c7-42ea-aca8-a835e37f1125", "comment": "Malware payload (Loki)", "value": "ade19f797e084ef6424ffba70fc3a3af4f002b0e1be4639dcbe89913bfed49d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262638, "uuid": "0361013f-4319-4718-af6d-00369344333d", "comment": "Malware payload (Loki)", "value": "e4cf110b851a25fe1443270cf0dd74d2786971e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262638, "uuid": "52203731-591f-4046-9628-127208744192", "comment": "Malware payload (Loki)", "value": "ce842e40d14fa6ed9afa747f1aa2c694584290ec9a7f5ddfa66b5ebfdc2205abe39a6a25f31e56e28c378d147392eaa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262638, "uuid": "6c8041c0-4904-45d1-9553-a3a579ede523", "value": "T1FD34021AB6B1C047C23327311E76572383FAB9242465864F57A06F2C7E632929D9FB37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262638, "uuid": "726505e6-7249-43b9-b99d-c2de18eec2e4", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262638, "uuid": "d202e6fc-b65e-4883-a076-c2be6e88fc90", "value": "6144:HNeZmY+jXV/s8JxXyTQn1Lr8KljPhNtja5vq8ttz:HNlDXV/LCTQ1Lr8EhNtjOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262638, "uuid": "bb5ffc52-efcc-41e5-8beb-ba53850173b0", "value": 236470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262638, "uuid": "d9688a9c-88d4-46ac-814a-b60dcf9509a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262638, "uuid": "ba0fa749-8b7a-4c06-868c-c4e6d788c59b", "value": "f69f794f7f02b87a916e818e66fccbf2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f365b1-b5c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649262566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262566, "uuid": "5e8217e4-dec5-49f1-af9b-2b0754a1dc87", "comment": "Malware payload (Loki)", "value": "0935e589dab1ee98a88c01e7af252060", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262566, "uuid": "d5956f6a-14ac-4ba4-963c-7623d1f07a9f", "comment": "Malware payload (Loki)", "value": "aec6c89c520fea88f2952286ccdea851dcbca259c4719d6d00afc723966fee83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262566, "uuid": "3a8b3c55-fc6d-405c-8687-cfcb6ac3651d", "comment": "Malware payload (Loki)", "value": "b8dd5a2809bb365ceca3b4cd5ddc64dd707fcaa1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262566, "uuid": "3a706f46-9744-4754-8d27-1d32f1233298", "comment": "Malware payload (Loki)", "value": "c10c15cacf54f99dc8fa7e94e39a67e01c3b697963e9fcd5cfd38606f8241d22d6ad9a63c1439534322a40c7eb8e5e52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262566, "uuid": "6d2b5755-1dfb-455d-abb1-8a12347ea430", "value": "T1AD341254B7A9C497D8820D355E3AFB658AF7A82710B1861F3300BE59BB315C3CC1E7A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262566, "uuid": "25c72ae5-ed68-4918-b9bb-48587373e566", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262566, "uuid": "0824adf6-7fb9-4861-998e-fcc2dad2302a", "value": "6144:HNeZm88YOsAU5BUN/3MBeSVBmnjL18ouP4Y:HNlXY/AUHUxc1B9oW4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262566, "uuid": "08d3567e-eb6b-45aa-b6e8-94e38b492494", "value": 237508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262566, "uuid": "ee491142-709d-44aa-a812-8ec949c2c3c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262566, "uuid": "11aede0c-f344-4d80-94a7-e8db94c19eed", "value": "0935e589dab1ee98a88c01e7af252060.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea8ec4a-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278036, "uuid": "52cb5128-2124-4eb2-b5fa-2ab3246c56e1", "comment": "Malware payload", "value": "dff30a31e4d8e898c88088e4db832431", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278036, "uuid": "5195cdf8-4e5c-4804-8b56-fede9bb8421a", "comment": "Malware payload", "value": "af9e68205295634dd5fcf5e8f8cafa62f478ee4b804ae3f521c8f5a68b0c82b9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278036, "uuid": "cb2bb483-1e56-4724-a96f-2a64c9789e78", "comment": "Malware payload", "value": "ea95602d8fe03b56f3f5ea86e6ceca5334db2279", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278036, "uuid": "638d85fe-ddf1-4d29-8b0e-28d62e0ef3e0", "comment": "Malware payload", "value": "48d039fbaa9c48961ce457704efaaf7c5020624677b3a65d5c0f13e51b160047ea5e851dfd93bf037581fcfe38259689", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278036, "uuid": "b6edccfe-b55b-4471-9df6-1a81d40751f3", "value": "T1AFA1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278036, "uuid": "6b4eed7d-8ad6-4055-b8d3-64150fe15d84", "value": "96:ERYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ERJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278036, "uuid": "f4996168-2fb3-49d1-a50b-9142c9421aec", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278036, "uuid": "d5c0cada-80fe-43fc-82c1-d59149eea7e0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278036, "uuid": "db7a9e58-57ab-49bf-a29f-06db0d85697f", "value": "af9e68205295634dd5fcf5e8f8cafa62f478ee4b804ae3f521c8f5a68b0c82b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08922540-b5b1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649253249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253249, "uuid": "068fa895-b082-4201-ace9-3efa79939b83", "comment": "Malware payload (Formbook)", "value": "82f9e1aebd57dbdb4de800b2bd835535", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253249, "uuid": "af33c639-b587-4283-afe6-49eaaf72cc90", "comment": "Malware payload (Formbook)", "value": "afa78bcaf75938acfd9cad522dbe582d2997eae52d9f7d8b4acc6b66e10c632e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253249, "uuid": "4f6aef9a-898f-447c-b843-b100b11ff2db", "comment": "Malware payload (Formbook)", "value": "0bea67292c231d56f555d97f3b75cdec5c468f35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253249, "uuid": "e01fa2f5-b29e-4d16-8fea-70ae2f1814c1", "comment": "Malware payload (Formbook)", "value": "6506115b4c9b515d7f3ee8233d34f07e04a6518c8dc062fb954a8e0a93a49bd5263e4cbadd8da91e46e691689d77dccc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253249, "uuid": "9730296e-07ce-493a-a85b-6d6c72637958", "value": "T1A834120B76F6D067D16387B3AEBA4257CAA3422231E1475B0B20FB5D7931A43DE1A353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253249, "uuid": "e0441071-d059-4e04-ab0f-1c5fbd2e6302", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253249, "uuid": "a2ee0959-c36e-4b22-a76b-9ed1a67e2b63", "value": "6144:HNeZm4a3piESqKcyRbuTDUIGqJG8jxQ8hjppgUw3Z43W+vxrc:HNl3EcyRb3IPdXO3Z0jvxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649253249, "uuid": "dce4df22-5b3e-43a7-84e9-a9c5ea086420", "value": 246532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649253249, "uuid": "4915b074-8f91-4d43-8b62-30685f42d407", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253249, "uuid": "e22a7498-a466-49c4-a67f-2ca2964d0220", "value": "ikst.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b03a1f-b5b6-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649255743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649255743, "uuid": "06e63a62-acfb-4a49-b048-243453729463", "comment": "Malware payload (SnakeKeylogger)", "value": "a95e3cbf8c24d7836c6e41090e6088e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649255743, "uuid": "13ae2f57-56c2-4b21-9cfb-7ec6870d524b", "comment": "Malware payload (SnakeKeylogger)", "value": "affefdbcdce6871a3d0bf9646340a26ca00424fe19f75ce5ba72c0c1051d30bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649255743, "uuid": "8679bed7-2c26-458d-821f-6f80eb09db83", "comment": "Malware payload (SnakeKeylogger)", "value": "83133ab6d1e29b1e33c5d9510534096a01b1ce2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649255743, "uuid": "e0c091d9-1142-4914-a5de-58acc2afc6ea", "comment": "Malware payload (SnakeKeylogger)", "value": "76597f2c2aef63fe91991b1cc5cc53b9d12b920c8f50fde9848c764fa7e73fd3b6ab712dc8993e0191a072dcd3fab98c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649255743, "uuid": "ddccc341-6f78-4746-9de1-495748d81fa6", "value": "T164F4BE29FAFACA12D2680BB7C9D7582843B5A901E11AE70F37D16BE605033AFCC45757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649255743, "uuid": "c2e112fb-9778-4f81-8454-41025eb831e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649255743, "uuid": "b2722ac6-39cf-40ea-a60e-d47a0dc29802", "value": "12288:9+o4qK67zgCDkZOMAefMEmqvpfaOyiXygiBSw9q37S8N3bR4+evy2a/fW:v4qKgsXOMAmAqRaOyvDFw7PN94Rvpa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649255743, "uuid": "5c9cadce-a522-4f17-8354-3a8490a9f695", "value": 771072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649255743, "uuid": "b1a95f80-40eb-4b40-9ac5-603e6bddec2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649255743, "uuid": "575f6553-a446-48e6-a236-4d6c954b1c74", "value": "Payment Copy#2265110.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be79e958-b544-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1649206739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649206739, "uuid": "24035dc3-2929-4f99-9016-83a7c2e9f753", "comment": "Malware payload (njrat)", "value": "79bb3776371472c8a14897893c2c17e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649206739, "uuid": "b3f35d43-06b5-498d-80e1-17d2a51e6e26", "comment": "Malware payload (njrat)", "value": "b017cdb6f137cd3e72e7524470ebf2ff2712cc5f78db58d6eb87b15b4a84184f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649206739, "uuid": "2e316c2f-bb4e-4b29-9c89-9dfcc34959d2", "comment": "Malware payload (njrat)", "value": "8aa42ff563940254ed39e8397e08bb2a2a91fdd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649206739, "uuid": "ad0a9092-05b9-49fe-860f-5cad8b3c7ff7", "comment": "Malware payload (njrat)", "value": "4404b98fa368fba538825ac7822752a321612eafd77fa3c53ac8dc8569f5f16c94e86728eaa5a3f17dc1c367006bef1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649206739, "uuid": "d9ac7267-caa2-4d6c-a197-7caf9888555d", "value": "T1D4C5BF52B581C872D0A20131827ACBF209BDAD30DB2554DBA7C43D5B7E345D27B3A7AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649206739, "uuid": "32d92f51-224b-4953-accb-fbc64349a2d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649206739, "uuid": "c3075615-e734-4dfc-aedc-d632731a2af3", "value": "49152:/hCQGVrh9tSBzKPBc0IQekGPlUXd07t2vM/M:5CQGVftSBePBc0skGPlUXdRUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649206739, "uuid": "29020dd2-08f6-4da2-8e38-1583c40172b0", "value": 2568192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649206739, "uuid": "4f69252c-15c6-4ad6-8168-7946cc588e7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649206739, "uuid": "a0c41180-623c-483c-bbf1-88c898b535eb", "value": "B017CDB6F137CD3E72E7524470EBF2FF2712CC5F78DB5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bffd0649-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278038, "uuid": "1cf31fb3-c93c-4583-8923-a84b38864ce2", "comment": "Malware payload", "value": "1897d37ef10e254beee80f06f5a97da6", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278038, "uuid": "01d0681f-111b-4d44-8d31-4a260c405588", "comment": "Malware payload", "value": "b05db1a59f1e713c297b4e06455de56d9da107a708004811240b0e7f39a07230", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278038, "uuid": "c5e3ebac-755a-48d9-a12f-73ed49df50fb", "comment": "Malware payload", "value": "ad0dd8e7df6be57561a3ebee657b10e005b847a3", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278038, "uuid": "39d42dcb-ab4a-4f47-96c9-0b8277c59a37", "comment": "Malware payload", "value": "335fa50b4347fdebca0c34e0ea9728cd4a5deb7a09b937df4db7869bb8f007d9323c2addb92d5604add25a552140d840", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278038, "uuid": "7fc28a16-a31b-4a82-9919-c030240c2a9a", "value": "T1D295333AB0FAB8B83645F7F64940DA3475F6C34A75FA37222FF89CC662241067675058", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278038, "uuid": "c523c1e3-6fbe-42cc-b016-47facb62c2f4", "value": "49152:ijoGN5J3sAs+aa8d6q3RKNhvqa87NXcHnSySdkOFOd+LR:ijn5JcAsHYqsnvqZ7hcHVSdkOFOMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278038, "uuid": "f030734c-7c25-4583-aadd-45d234c5f16c", "value": 1961984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278038, "uuid": "071483ee-9fd8-49d8-8da5-3ad7bddf4053", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278038, "uuid": "0046c2e1-1343-4fda-be9e-cab113459498", "value": "b05db1a59f1e713c297b4e06455de56d9da107a708004811240b0e7f39a07230", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0841966-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278039, "uuid": "692dd030-da73-4602-96a3-5de54351caf9", "comment": "Malware payload", "value": "8f32d5c3163470fa0d9737ca71c291bb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278039, "uuid": "be14b2dc-a7d5-4959-a90d-37c4a1a758d6", "comment": "Malware payload", "value": "b06eb0b8e743a9479917938b36b32533c99cb84485d8e455af384a6631016fdd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278039, "uuid": "1f1ab25d-f856-4cdc-9a87-7855dbc026ee", "comment": "Malware payload", "value": "84c9809deacd689f2ce0a26ff73ebdac8233921a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278039, "uuid": "776774b0-e7da-438a-8e3f-c6fcb67a05e2", "comment": "Malware payload", "value": "07b33f4849e8ce7c4d827d2cfdec7781d5a384c75751e912feebd346694790ed6b40d67ff4a6e40e71d30382d677e5e0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278039, "uuid": "2a962edc-35ca-4aca-931a-5ed405d62fba", "value": "T171A1E850112C1AB17346597AD26FFB52B50EC81B0A7B7B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278039, "uuid": "5cd20456-2983-4b91-a953-40bed0980ff5", "value": "96:QRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:QRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278039, "uuid": "31baffa4-7788-4679-a193-d795ff98d0d8", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278039, "uuid": "3887f533-91ce-4d62-9f60-a1b970597036", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278039, "uuid": "7a4a7d07-af92-4cfd-aae7-5425f8d5efd7", "value": "b06eb0b8e743a9479917938b36b32533c99cb84485d8e455af384a6631016fdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a86eb4-b5a2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1649246960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246960, "uuid": "3adbec4c-2892-4a86-81ad-215db3f7ad2b", "comment": "Malware payload (Stop)", "value": "bc8cc984fa865a81b9ed86f64260b739", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246960, "uuid": "06e88add-afc6-4049-a2a5-f0ff0ec9d476", "comment": "Malware payload (Stop)", "value": "b093323a99e89532c9d7891641f8c1c9fefd56f1270748ebeb88f29506b67e58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246960, "uuid": "70f885cf-8a6c-4580-a8bf-462c62ad85da", "comment": "Malware payload (Stop)", "value": "e22d230d83c0089f3210810c56d8af554247296f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246960, "uuid": "350b7683-05b4-4077-b6f3-d70ee643f4b5", "comment": "Malware payload (Stop)", "value": "40ca350a48d4e66a4fcd408426c34b6294f636c4b0b3cd559f351204c55ae9edda6d4700d6f3957fa425db05491942a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246960, "uuid": "7aace5f4-2aa0-4ce4-a9c4-3ec7eb65de53", "value": "T184F40100BAA0D036F4B716F159BA9378A93E7DE19B2091CB63D516FE46396E0DD3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246960, "uuid": "d5ebfd00-896d-4e14-8999-5eea85e37be2", "value": "09b7cb9e514ec032fb567c3b682f1a2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246960, "uuid": "064881f5-32fd-4172-9f71-929ed287944f", "value": "12288:BNHlJ/OmEUkULih7Kmnj1y9Drdt4Pxux8wU2Hi0+fDuCYf7OPEn/yl/8rB2PO1o:BRCfbUaIZ5t8xuLgfDef7Ou/I/COO1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246960, "uuid": "6a334221-e8d2-4162-932d-552c3dcf80c9", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246960, "uuid": "3a5e0ac2-358c-41a3-9cc4-4e8ae99ece35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246960, "uuid": "16802b1d-5e50-4b0f-9751-68d781369152", "value": "b093323a99e89532c9d7891641f8c1c9fefd56f1270748ebeb88f29506b67e58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c21853bf-b5e2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649274606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274606, "uuid": "1e4e21b6-445d-42c0-9e14-356686804ce4", "comment": "Malware payload (Mirai)", "value": "8321170aed1d4a780cf56c2aa5bf3d3b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274606, "uuid": "3b243cde-6ee8-43f0-8c60-4d1cb1b6a2a3", "comment": "Malware payload (Mirai)", "value": "b0d4a08060f4028acd0f87e755a21b3ef724084ae5efe9f1f607503442355742", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274606, "uuid": "aa08efe6-96dd-4acb-92b3-b1b716f853f6", "comment": "Malware payload (Mirai)", "value": "8f5c1ee57338243e7ed8875e12b3758aabb5821c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274606, "uuid": "648426e7-c5f1-44e2-a3f7-ae943a22ec43", "comment": "Malware payload (Mirai)", "value": "b63b2201ac6a2cc4f56df4e1404e53ea98ac79a848516facc83e7b06fed3c02423afc711ef558df14c21a9ddc4f6a0cf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274606, "uuid": "ec7a63a3-e7d4-4f9c-8b5a-51840d5021ca", "value": "T1A2733AC5B841AB12C7C15577FF0F028D771A4398E2EA33039D295BA5778B85B0E3BA49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274606, "uuid": "96d8dc5e-ed42-4944-993b-0d4f4afc49a0", "value": "1536:Wuboy+GswdT268kybKgV3TLHOXr9Fbc8eevt:Dgc6Sg9Te9uWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274606, "uuid": "e85ed47f-4a6e-4e01-9cfe-81a76b44b9a9", "value": 79220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274606, "uuid": "043cf096-b0b7-4722-aae3-96aeb3117be5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274606, "uuid": "85ad3444-3d3b-406e-8296-8ae63578ea61", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b3a27e-b5c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (STRRAT)", "timestamp": 1649261509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261509, "uuid": "a568512b-9ccc-4115-98be-cb9ee52ca5cd", "comment": "Malware payload (STRRAT)", "value": "e9bf2b172d34637c332d87e04455acea", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261509, "uuid": "12f6737e-dcab-4830-b234-6f1309653c31", "comment": "Malware payload (STRRAT)", "value": "b1086cafbd26bf4f6c27e7f45527d86c8dc53328ca450a7ed76f6f26f6d9c7e3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261509, "uuid": "2253c963-15ae-4643-9b53-d440df6f9a1e", "comment": "Malware payload (STRRAT)", "value": "d3e1e59feacaedfa483c59aed66fcbb1da438a7f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261509, "uuid": "618a0aee-38ac-4b12-a215-f515654a3959", "comment": "Malware payload (STRRAT)", "value": "ae283da897aa1b5e0f5254a9863f14738abb7bbeb8f5058f07786834ebee601d5df0922f539aff7c528b7d2070a91599", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261509, "uuid": "7ed4e5e8-fffa-494e-810e-3940aef73f92", "value": "T13405D8C37689AAB7B7F3D680C23257139639C2A7594320117AC63E4CCF6A94529F8DDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261509, "uuid": "2214bdac-69f2-4a23-ae69-4dc400413a33", "value": "768:6VEISq9VJhw+JcMqA7f6nYdknW3nWTrEot+ckj2NiBA6yJSDShzE7nXh4zs/7W2S:9vohrDtLscOLcWhkcs0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649261509, "uuid": "d772718a-eb8a-478f-bde5-3536e0571d8b", "value": 819789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649261509, "uuid": "4f18e122-7dfb-45ca-91ad-9e36e64603b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261509, "uuid": "8cd60627-4822-4c08-8dfb-5e369fa35c7b", "value": "Inv2303.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d73428-b5a1-11ec-8e58-42010a9c0032", "comment": "Malware payload (BitRAT)", "timestamp": 1649246455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246455, "uuid": "13c9ab7f-c698-4cbb-aa3f-647098b580f9", "comment": "Malware payload (BitRAT)", "value": "022a77bffab5d8ec1be996abe6d4c33e", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246455, "uuid": "9b8c3c89-b9fd-46a8-83ae-c83c13324a93", "comment": "Malware payload (BitRAT)", "value": "b2fab34e628b367bc6520abc456cbfc90c4b8ac8307ad87b91d3016c2bc479d1", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246455, "uuid": "a00d8769-f30e-4b8e-bb75-c19c73c362be", "comment": "Malware payload (BitRAT)", "value": "228037bc20c4a55cef4fc48a715849efa68d8565", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246455, "uuid": "8071b2bd-8276-4ded-88be-c8fd68cc00ec", "comment": "Malware payload (BitRAT)", "value": "46f72a3251ed9c62a5812a691adb3ac386cdfe7cb02a4ba8aeb46d71c77ba15240d59c73ba7d04bcfc7b305aeb54d106", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246455, "uuid": "5935508c-a429-46cb-ae37-6b81cdd4f81b", "value": "T174532029E7404C26436F19D4E16D2ADD7B0407CA3342CA64A6FEF81BB594C7979E32EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246455, "uuid": "22ae3c5d-9dc3-4095-81d5-ee7b52998d48", "value": "768:3wW9Wk8otnKKYJ2rsIXM8Oi0D7D8D8DMwDFDkDBDWDDDrD0D8DzD3DEDbFDAsDlc:3wW9Wk8oLO4/o3chTk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246455, "uuid": "df7d1af8-f24b-4318-ba23-3637ac09ee14", "value": 65053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246455, "uuid": "8bc9dbe2-fdac-49ee-987d-299106bd070b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246455, "uuid": "7ce96cea-d0b9-4b3f-ade8-a3bfe9d1ca28", "value": "KV-Autohaus-DC332-0i22030217220.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1fc7584-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278042, "uuid": "f3d888d9-d2d4-4a95-b506-e8082ab9fbbc", "comment": "Malware payload", "value": "a2d2500d921b414598363caa629f3516", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278042, "uuid": "2516607e-c820-434d-a1b6-778eed4f0e23", "comment": "Malware payload", "value": "b33c057e5d357f6020b2e4f4195e405f2f6d5dced8a3a57d229c25b54cfe8cf7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278042, "uuid": "d48e072c-2563-49de-b22a-5e4005b9b8b4", "comment": "Malware payload", "value": "00b3213b2f1ebbdfe831e1db5553269a2e6d55ec", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278042, "uuid": "69667d18-85be-4b56-96ac-aa6ec1164640", "comment": "Malware payload", "value": "6d9d2d4dc72d4a34e9ce1d77167e267bd637932acd9c2c24b0a00941313c7f3ac93e73dab294f75490d1b85fb582af7c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278042, "uuid": "f328d7e8-a24e-40d4-987e-f37b7529ccaa", "value": "T16BA1F850112C1AB07646597AD26FFA52B40EC81B097B7B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278042, "uuid": "d7d65f47-e821-44e1-9a1f-f453fb47e1b1", "value": "96:ERYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ERJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278042, "uuid": "145da687-30ce-4082-b7f4-73804d7f6a2f", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278042, "uuid": "5d0e9196-219a-43c4-8dc3-0eadd14f671b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278042, "uuid": "b2591a0f-3db6-4a36-a55a-6a9cf936a206", "value": "b33c057e5d357f6020b2e4f4195e405f2f6d5dced8a3a57d229c25b54cfe8cf7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b0fad6-b566-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649221172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221172, "uuid": "92f09acc-82a0-4905-99d4-598a51fc22c7", "comment": "Malware payload", "value": "8ed7c8a79aa732326d156086fe3237ef", "object_relation": "md5", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221172, "uuid": "cbadd1c1-ad12-4fe3-9061-963c1d8d648c", "comment": "Malware payload", "value": "b351c6a53204c2668f492c751a44d4c3c34a524941270f42b46f991815ef1bf5", "object_relation": "sha256", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221172, "uuid": "cb9427b1-e92c-4667-ba84-f4ae6c74b7e5", "comment": "Malware payload", "value": "8d397ee7499af295192590294a176982a490e4d7", "object_relation": "sha1", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221172, "uuid": "fdb8744b-c8e5-49bd-a0ee-fbd9e574d7e5", "comment": "Malware payload", "value": "2cc638ce39593a55702521066a0fecff1c129fa270a71de47e8d19e16c05b85ebdc279af6b896e5d2bb255810e9d4fd2", "object_relation": "sha3-384", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221172, "uuid": "03b0f867-1844-401f-aa7e-439454c4f5b1", "value": "T1E3447C07B3D7427AE4D703312B8B97628B72EC748663422A1649750E3EF1594B7B72F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221172, "uuid": "c1aebd7b-0aa7-4f16-a589-3c1e481adc91", "value": "3072:VB97NIA+/WQx5TYD9yOePn7JN7glwgz88ereWn/7w05g0a9oYu3DaAIjZr3:VeL7gw8er1nzTxYu3DaAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649221172, "uuid": "71316ed9-5c3a-4a8b-9bfd-4da864ef3a2a", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649221172, "uuid": "df263c6f-ba60-49a9-92f9-4abe2ab6657c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221172, "uuid": "48fd25ac-a31d-45ac-ad8d-edf5e02e55d1", "value": "comprobante-fiscal18022022.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "982bd8e1-b5ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649257356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257356, "uuid": "275cd39d-ca23-4de2-904b-effb93551cfc", "comment": "Malware payload (AgentTesla)", "value": "a515a234d29dfae49ef392cc837ea324", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257356, "uuid": "386b7798-4ccf-4d71-81c3-b240c223e74d", "comment": "Malware payload (AgentTesla)", "value": "b4870d6753a5a0962512a60dad707fe92774feb952c3cc01a87c3a9979816822", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257356, "uuid": "df4a4606-ec9d-411f-b328-b601ba933950", "comment": "Malware payload (AgentTesla)", "value": "47b9a0c30967bc86c013c75e7396e26783ba67f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257356, "uuid": "65ea4e3f-dde2-4006-b348-055dad9b1b25", "comment": "Malware payload (AgentTesla)", "value": "89b32eef31243782de861a2f2de51045098c13102dbe428cc6b109ee0f2aaabf3fec721212b4e284ace20458c100b5b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257356, "uuid": "7ce37b73-7597-439b-a95f-f40bff4deb51", "value": "T1E42502A02960A597D7AA9B744CF3E674073C3FB6AD94C30E79B430DCBB757964812322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257356, "uuid": "f1f983b5-0595-4793-94e2-6d09f76ecdd3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257356, "uuid": "9e4fb4d6-da72-4f48-8e8b-4402f3500c3f", "value": "24576:x1GuyRlZpPIbWyWhgcRwF8ZIsOQ3X0RT8vLe:xIDIbWyWhgzFSlOKqQvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257356, "uuid": "4dd90d6f-0087-4329-98b0-dc5a6ef0c616", "value": 1038336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257356, "uuid": "ff813f0e-68a4-40fe-b787-13e31dcd343d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257356, "uuid": "089bfae9-470f-41ea-9b3c-8f3c6aa9aab4", "value": "Urgent Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c295e9e2-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278043, "uuid": "9404607f-2ff3-43c0-9800-e3b1a703f302", "comment": "Malware payload", "value": "3b58c112975a154962948ffaf6fb5edc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278043, "uuid": "5206b3a4-2013-45aa-b58b-f874b4de576e", "comment": "Malware payload", "value": "b4cbc01ef78d6e36d470d2f6df077b4e4198ac0fdceb9f8087d9a20ed696cec0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278043, "uuid": "046502b1-ce92-4a11-b47f-4b8ed649c85d", "comment": "Malware payload", "value": "3afa30d34f2a687d475f1f5d2fc760b39b795470", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278043, "uuid": "7dd28de6-92d0-4c51-83e6-5ff99272ead1", "comment": "Malware payload", "value": "a99cd547acf0581b6eb6dda7e7217bfddfb73559bb2f754d4741426551bbea5e0e6557374736fcf2a4b25637abdf441c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278043, "uuid": "f607cb95-333e-4f08-9b44-a56459b3128d", "value": "T1C3A1E850112C1AB17246597AD26FFA52B50EC81B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278043, "uuid": "b73a79ec-1d86-40cf-a48b-94fe97ddd158", "value": "96:mRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:mRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278043, "uuid": "9f67b12f-d31f-4ae5-aac0-82bf7a25ae80", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278043, "uuid": "bce9b509-5a1b-4461-90e8-6aa61e590f77", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278043, "uuid": "54b846f9-0a06-41de-8849-11d79fb1db94", "value": "b4cbc01ef78d6e36d470d2f6df077b4e4198ac0fdceb9f8087d9a20ed696cec0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3f03cb5-b57c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649230881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649230881, "uuid": "947b2097-9a4b-4b11-a8a1-0ba6456c4107", "comment": "Malware payload (Loki)", "value": "1f0a3b732ec55737947bf6c793627e24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649230881, "uuid": "5debd453-ecff-458a-8515-dde466624bbe", "comment": "Malware payload (Loki)", "value": "b504d2ea204829f0b45547ee8deb4cbabf1deaad864e1e61be2759d34baadf1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649230881, "uuid": "4f258963-5e9a-4b72-bb8c-a7da5b37a974", "comment": "Malware payload (Loki)", "value": "3889e5ae3a6ad9cc448056755fa1de4fc656849b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649230881, "uuid": "8b00489d-7def-464c-a4e4-f1b3646cdf13", "comment": "Malware payload (Loki)", "value": "e39b31dbfdfd8a34c22e392add1093f1d32d20d5337bab771dc631583c45e39f0d117434558a655d99fb966677094d1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649230881, "uuid": "1006622a-1722-400b-9d10-fdb3a72ae537", "value": "T1B4341252E664C427E8B244722D713FBB67EB020624781F4F3B50A75ABE26287DD1F352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649230881, "uuid": "70e75e0e-2b1a-49e9-82d2-cac26210ed0c", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649230881, "uuid": "389eda4d-0ee3-44f6-a6d8-79bc6132eb5f", "value": "6144:HNeZmgD+oMBKtgddfGmogBrutCgE7z6WtmF01cAWk:HNlqnAKtGN5rsCgEP1RWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649230881, "uuid": "b3a913a7-97e6-4c94-8785-659f9c0d4af0", "value": 236506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649230881, "uuid": "4ed6f941-7c27-47b6-b6fa-d245aa35c4bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649230881, "uuid": "b5c759e3-d866-479f-a210-ffbb0187d4d5", "value": "1f0a3b732ec55737947bf6c793627e24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc359952-b567-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649221795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221795, "uuid": "27ef9505-3810-4229-96e6-bca50abb1f2a", "comment": "Malware payload", "value": "8546e790103b7fafb804fef430b35413", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221795, "uuid": "e7ee5d26-5120-434c-9049-d44fa7b8b900", "comment": "Malware payload", "value": "b52bdda60fbd8b70733a9ea18d238bf73100b2c941bb39aec904a163664cf6cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221795, "uuid": "123e2629-4011-4e28-944e-1003931f04cf", "comment": "Malware payload", "value": "e40c0a46ce4fe5e6a740bd76dfb86cb3254f5aec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221795, "uuid": "409c06f0-2fb3-40b2-ab54-40ba48f7282b", "comment": "Malware payload", "value": "1fd399494ce1014a9f5788db44fdd0b7c790bb839844e29c21c44d00f15c27ce9ec0a8d35a16ebce7e4fe30e82636b38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221795, "uuid": "df9bfb2b-43df-4d94-b38b-87685f08a997", "value": "T169147C4437C49BA4E56D1B38C162546203F7DE06AB52F70F7DCDBCAA3A7378282116A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221795, "uuid": "3ecf72d6-f1c8-401d-9fef-40118f4ac7b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221795, "uuid": "4dc3de82-9c7e-4dc3-86d1-c0019e8d0c77", "value": "3072:GOv0h5N8AIQtJ61SPVJ4p7XbD0FpX2wPFqG4Z2s:Pi2aJ61SfeDiMws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649221795, "uuid": "47b94624-26b6-48fb-8ff3-699211a326e5", "value": 208344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649221795, "uuid": "44a31db0-73a4-4d18-93ef-a9f5b673554e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221795, "uuid": "02e3edc0-c2a5-441b-9834-7d52108a58cf", "value": "taskms.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "293d4c8f-b58f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649238701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649238701, "uuid": "2402168e-a25a-4d07-bf3e-2302ca4f0358", "comment": "Malware payload", "value": "c31ca58e67d55bb20a06e0f986cf04c1", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649238701, "uuid": "2d1de187-e3d0-457e-9abb-fc935c012e55", "comment": "Malware payload", "value": "b5a32a74857293dc973057ccb5c26d71543c1d8bfab5c231ac10b341e5cad75f", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649238701, "uuid": "e2a80df2-bf8a-4db0-be16-8bf3997cdf81", "comment": "Malware payload", "value": "a8388a43791041b6470e7bcd200e6c279995f842", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649238701, "uuid": "32ca327f-9301-416e-9264-72a48a2a1145", "comment": "Malware payload", "value": "68610baa4b8cd4264f023843fbdd06258e9f29504ce355d3108cd57a208c04aa45cc072d3444d07634e3be9aba686c0c", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649238701, "uuid": "ab94469f-c513-4161-bd2a-1cbd3c0ae3d0", "value": "T10BE6228BFB98C52FD9771632C927453372A31E082492ABBA2314F3281977D415F56BCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649238701, "uuid": "9f7cb824-de43-4659-a578-60b7617ee99a", "value": "393216:+gPFE+5macX7X52NWdXJq2TNR3fw9pMrfum7t:+EE8qgY5CTqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649238701, "uuid": "03ce09c9-460e-4458-8739-206847b4bbe9", "value": 14078933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649238701, "uuid": "82c7461b-2675-4b94-8126-c50921f7345c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649238701, "uuid": "d16a52d6-99aa-4cb6-8998-08041fbeb149", "value": "B5A32A74857293DC973057CCB5C26D71543C1D8BFAB5C231AC10B341E5CAD75F.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef8d97ba-b53f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649204674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649204674, "uuid": "aa707c81-568e-4b9d-a109-36923bdbe5cc", "comment": "Malware payload (Heodo)", "value": "1e81932da7abf16c482185fdc88de644", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649204674, "uuid": "cd8703e3-c5e5-4663-88df-09a0a78d124d", "comment": "Malware payload (Heodo)", "value": "b5ae317b9e02a3b0bdd388070bd8e6215db22c5b750a46affb80592ba6e7fff2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649204674, "uuid": "58a7198e-2b8e-4352-add4-003da167d9e4", "comment": "Malware payload (Heodo)", "value": "db90573f3c644ca8da4758730ea6028a84d64c0d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649204674, "uuid": "c7a13d51-6298-4616-ad44-0f8b14ad6614", "comment": "Malware payload (Heodo)", "value": "f77914f149999ccd45dacad2608964fa77785d6d75cd72f338ba993da1448353a829288c5c5e79867a2c55b4ed2437ac", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649204674, "uuid": "5649e88c-5739-4ebb-8020-6e0ecbb2484a", "value": "T11DF4AE1235A3C075DEAF12744A566FA966E9FA14AB708DD3A770CB3CCD304C68B36217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649204674, "uuid": "fdb67a0a-f452-45c7-8b65-1ffb693091cf", "value": "078cf8e17700d87242408b8588acd2dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649204674, "uuid": "01510a68-a1a0-4954-a281-c5647f729e8c", "value": "12288:y73FgbqIjZbwqHUM6Ay7rYj2azO8BOg1s3F2r/:y7osqenYtzbO53F2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649204674, "uuid": "6ce27ff8-3f9b-4068-8673-0d00830ac485", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649204674, "uuid": "0c5da702-adbf-4383-95c6-4e80b9a10002", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649204674, "uuid": "99f2e719-1ea0-4403-981e-55ab57bcac21", "value": "emotet_exe_e5_12f5ac9916124859b8c4195d64280dc2528bc26c79a4a888b688552856b01c50_2022-04-06__002429.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3759b9a-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278044, "uuid": "c7601032-df58-4d53-b6d8-a062f90aacc8", "comment": "Malware payload", "value": "bb9f75fa570de0af20efc384407766e6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278044, "uuid": "c23c2373-67c7-45ba-a043-83dab8060c2a", "comment": "Malware payload", "value": "b5b5f934bb25161dfaedd7cea4895ce9803f0cf63c564a00ea11d7861ff2549b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278044, "uuid": "f5441d7a-d24a-49a7-9c37-554ea3029331", "comment": "Malware payload", "value": "d13f0c7ed487b363bf9c985916d4659e2d2e3aae", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278044, "uuid": "0df32c5b-da0d-4b49-9792-b0af889f9ba2", "comment": "Malware payload", "value": "2a5c15fe7bdd1e3fa9fd57e212aad01c70b3e6210ff4fd6d0be720746455ca13de990a86675861d1346a7a91629e631d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278044, "uuid": "ed4513cd-0b45-44e0-b9a6-51672e02871e", "value": "T170A1E750112C1AB17346697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278044, "uuid": "28bbf496-b0e2-43dd-9cd4-f7c47dddc733", "value": "96:VRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:VRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278044, "uuid": "a4dbb2ae-c9ce-49e0-917e-37544b4b2dbc", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278044, "uuid": "d4ef0f7c-ff4f-44af-ae9d-b5a58ba9157a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278044, "uuid": "a6055e22-19fb-47f0-936f-ef954d0d14ce", "value": "b5b5f934bb25161dfaedd7cea4895ce9803f0cf63c564a00ea11d7861ff2549b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c46bfbb4-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278046, "uuid": "6850c62b-bade-4e64-9b57-b6fa4bd72ef2", "comment": "Malware payload", "value": "cc7905d88df382d5276fa01df1e50a3e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278046, "uuid": "6cd98fb6-7c96-4320-9c9f-1173916fa120", "comment": "Malware payload", "value": "b6ba24ff7f1b3a851fe896136086f39c7d11db7f60223cf87a4fe029469ce776", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278046, "uuid": "f49a2f84-28f3-4b8c-9d7a-c3fe5ab618ba", "comment": "Malware payload", "value": "f046a655a48ef6a7fa88b0ae2d4703c5ba05ab93", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278046, "uuid": "c1293608-2d20-4bd2-b352-f922dcac4f97", "comment": "Malware payload", "value": "e8f50688f02c5563a13e1f9822a8e27f5d6c4facec4bab18fe4692e48aa34eb622ca03352d34a79467d895e79a709b16", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278046, "uuid": "eef7f40f-32d2-4f3d-a809-4c82b376b35c", "value": "T1C2A1E850112C1AB17346597AD26FFA52B50EC81B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278046, "uuid": "1fb3221a-dba5-4cb7-8bdf-cf31a6a94580", "value": "96:ERYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ERJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278046, "uuid": "e777f262-8d1e-44e7-8eaa-9bbbe8055b9a", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278046, "uuid": "6eb87248-d7b9-45a1-9b83-1948dabc4e96", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278046, "uuid": "022b1226-6775-40c3-a7cf-7ca95e47a627", "value": "b6ba24ff7f1b3a851fe896136086f39c7d11db7f60223cf87a4fe029469ce776", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc5a507a-b5c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649262141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262141, "uuid": "ad7e4f8b-2d2c-4073-ac2b-57002ba08752", "comment": "Malware payload (SnakeKeylogger)", "value": "2915f0f1954edce0bc7c424bef346459", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262141, "uuid": "83e819ea-e8d6-402b-9e2d-01a9d03c8ebc", "comment": "Malware payload (SnakeKeylogger)", "value": "b6c5381ca4842df5f36898a58053bcce17919f059a84432dbeb60bdef9968a2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262141, "uuid": "012e0761-db57-4b0d-94e0-77dfc691d38f", "comment": "Malware payload (SnakeKeylogger)", "value": "3270c67193792ebdfe919451bed55f948658877b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262141, "uuid": "172be7bd-3832-417f-803a-7556d4e09847", "comment": "Malware payload (SnakeKeylogger)", "value": "308b2cbd7170f3e69e4aa0657beef57c020b6c1d45275353a9145fdb617302f55b2cf3e77431eae9f46a9a5e115147be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262141, "uuid": "90f53345-8b1f-4cdd-80eb-b0908a9758e4", "value": "T13AA40108B77BE926E2BD4673E4D6450003B0A617D063E74F6BCA15EE1B173D61A81BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262141, "uuid": "e8079473-c31f-4b62-adf4-3d4b08092ffe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262141, "uuid": "a4255645-5db2-4caa-9d9d-6f080473a6c3", "value": "12288:rAGy95x5pjH4LYafWkgJ8Pz0akyWF5A5tzyGdF:1Q5bpjH4L37PzhPWFS5tyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262141, "uuid": "3ea4bc71-ac42-4c55-9bd7-87b0f2aaaeba", "value": 475136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262141, "uuid": "72d20cbe-e959-46a8-845d-302e1ad4a6b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262141, "uuid": "88c0bfeb-1a5b-4408-84b6-3e7222cffb87", "value": "HALKBANK001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0cceda1-b569-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649222715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222715, "uuid": "a26d7b99-ec25-4ee3-8ac9-3fd7a713e147", "comment": "Malware payload (Loki)", "value": "a0070aa55af76c531e23393ef9bdeada", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222715, "uuid": "1a302efe-b8af-4a90-a949-0171370c9605", "comment": "Malware payload (Loki)", "value": "b6e94a1a320d2e4f598538eabd5dfef0bd0a19b13df97b3356a94e3ce484d60a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222715, "uuid": "ff80bf7d-560d-441f-9222-8387596dd1b4", "comment": "Malware payload (Loki)", "value": "864845f2b2d4e9874c26ac4f231ddb5ff4ebbdd4", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222715, "uuid": "34abc852-ac10-4878-8f81-54a82b1fcf5a", "comment": "Malware payload (Loki)", "value": "57c75e36b2b7ffe72cfd5e9ebcd835f9895a3742ec2ad90935f9362a9980a8ae2a9bbb4a1807e876c262fce2ef980e3e", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222715, "uuid": "db0f0cb2-a535-48ac-9757-89336912ed71", "value": "T1F51412EB78C087B7D24E42F8CC1C954AA7D79C368D53D8B3A52A732C11B5792E122D36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222715, "uuid": "8b2d6405-254b-43f4-8619-dcd7d7675c73", "value": "3072:YWU63M9U8eiI2JTn43joysCiiJ8Z0yf0SWaJIA6EFXUXrofz+UT9bT5atoZN7X:TUekU8eiI+nCnsd68y6ZJIA6E0ro7T9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649222715, "uuid": "c24266de-981a-4e23-89ac-4a081dc4deac", "value": 191912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649222715, "uuid": "0808f063-9d7a-49ba-9bab-726fb78be030", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222715, "uuid": "c2a109ea-609d-4025-8019-94935b6325bc", "value": "NEWWAY SEA FREIGHT.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6da2ce9-b5c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649262642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262642, "uuid": "fbac6749-d147-432d-ad90-320da9017864", "comment": "Malware payload (Loki)", "value": "9a438bc1d2e08161d0fade11ff6c39bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262642, "uuid": "679fb145-2f4e-4f34-9d18-747985c4003e", "comment": "Malware payload (Loki)", "value": "b77f6786b940f40b4eebd492b925ad174b28b50fbf9ead3a1b1000189b530704", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262642, "uuid": "e6341a6d-8936-4209-ba49-f189eb20e62c", "comment": "Malware payload (Loki)", "value": "9522e356bba95728046ced9c7071b58cdb5a6d76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262642, "uuid": "4ffe3930-9230-4133-acb5-3b07ba9fe55a", "comment": "Malware payload (Loki)", "value": "dd9544820f48b85797368c75aa7c3712c299af71d27ba50352f3e90ea6418c5038589b0b0290f407a7af9f58ed3bc668", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262642, "uuid": "c37f2905-7d9a-4734-bb12-4b5babad9fa8", "value": "T1E0341314A3B0DCA7D9E257300C35669997FD6E0D2368824B83116FFE777A900E64F762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262642, "uuid": "cf358468-100e-410d-b265-8cdfe160f762", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262642, "uuid": "6d5b097d-55b7-45bc-a800-b99a67ce3e6f", "value": "3072:l1NjcVVnLpPunb5AWOGVQurbu9wVL16oqjoKDqsuoSS4wNPiZeEHO3My6H+sUPln:HNeZm5A9GSgVL1jq7U7wpjtp6Hfq//Fp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262642, "uuid": "e56d7061-313c-4d0a-a83d-3c928fd30abd", "value": 239458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262642, "uuid": "53c58d6e-1906-4efa-819f-5d549ed8a01e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262642, "uuid": "9c5533bc-c83f-42ef-8149-0e1db83cd923", "value": "9a438bc1d2e08161d0fade11ff6c39bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24c56ac-b5b3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649254420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649254420, "uuid": "ebc94435-7abe-4ebb-809a-950348c98ae2", "comment": "Malware payload (Heodo)", "value": "c5d02278739c4f900bdda09012fe3847", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649254420, "uuid": "2b025c88-4f4b-4119-926a-43aee742b055", "comment": "Malware payload (Heodo)", "value": "b8ac2bfb8cba7253a06a921b2d5a33ff1bcb9c678c407a382c6b54fec0d0b02b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649254420, "uuid": "38375c0f-c30d-4ca1-8002-cbac81fec2fb", "comment": "Malware payload (Heodo)", "value": "a38efa81c288b0923e6b1bddfd5a0ec85fc626a8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649254420, "uuid": "76530e23-6782-425c-9e81-36c80d34058b", "comment": "Malware payload (Heodo)", "value": "a3713f6900663c277bd8c21bfba8fa133a626eb1a1d297867c142eb9eed67b6fa7e56a46b7a854ba9cd567a3a06bbc07", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649254420, "uuid": "334088b7-6814-4b41-9ec0-7de018173df9", "value": "T1BB64B451956340738BF775F2C7F512B76AD59B91C33B096E02A8C43EBA28E437762E20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649254420, "uuid": "5e89c0e7-1d1b-42b2-a9dc-27f959c7bb46", "value": "6144:U/L5tYtXZ1BpFHyFjJmP/RbV1M2lvMOeL/gC:UWBpwupxl0OeL/gC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649254420, "uuid": "f35596e6-cbfb-406e-9ab4-8917738af3fb", "value": 327240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649254420, "uuid": "ba726be2-2437-4a7a-8fe8-8fe868ce9851", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649254420, "uuid": "8660feda-d77b-4281-a996-5c835e6bc233", "value": "emotet_exe_e4_b8ac2bfb8cba7253a06a921b2d5a33ff1bcb9c678c407a382c6b54fec0d0b02b_2022-04-06__141336.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf633cb6-b5a8-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649249718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649249718, "uuid": "3f3d9616-645c-457b-8265-9797ab77c9ee", "comment": "Malware payload (AgentTesla)", "value": "0b8613ed28e9c0b65e22f94c50c5345b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649249718, "uuid": "42497bc9-0814-462f-a9d7-2d8f54cfcaff", "comment": "Malware payload (AgentTesla)", "value": "b8c5f7418d9d98a90fc966c8796c54238f5de69a7e04eb19bdeec52457152c41", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649249718, "uuid": "718f2d14-63fb-487b-86c0-31a4401998f0", "comment": "Malware payload (AgentTesla)", "value": "905ec57c6de97f01a0e3646319f11dca756b5e92", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649249718, "uuid": "3d12d10a-d6fc-4dec-92d5-5a8b7639d615", "comment": "Malware payload (AgentTesla)", "value": "b3570f8f4a7680efe4b7eeef6415fd36ce19629e61061c3cd3d9fbd2080558f93e43f3bdd33b77ad2e0372de8a7e9157", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649249718, "uuid": "100f6fc5-dd09-44f4-9ca0-ed003f13fdb6", "value": "T18E05CF09FBB6DA16D258AB77C0D7A80843B0E501E617D70F7B91A7E609033AF8C4665F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649249718, "uuid": "5c081b50-6eb2-4f30-b167-6f9a67b8958c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649249718, "uuid": "8c83e963-6628-4fae-845c-7484d25b8b04", "value": "12288:V2KJjg34FcrkVEN+LGMuCyDDrtAV147RZ6EMS9sHLqb:pJjQIVEFXfOGwEMSuHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649249718, "uuid": "09ed9196-2b7b-4500-8eec-c6e893ca27a5", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649249718, "uuid": "ebb1a8bc-6ebf-4d74-b371-6a65eca96b98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649249718, "uuid": "ba858d10-ae61-46bc-be89-2c84abde348d", "value": "RFQ-1bCNiGsdW1SeDO2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f52b3da6-b585-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649234749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234749, "uuid": "46be4078-179f-4605-8582-7f24fbc3cc26", "comment": "Malware payload", "value": "cf72e87c1a69d00ef720f3a41787ec77", "object_relation": "md5", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234749, "uuid": "4685882a-223f-424f-b201-3cbdf74d98b9", "comment": "Malware payload", "value": "b91ad13ba834be069a9394b7ce257e65c3e81551fa09e18bedf81353ce2e8886", "object_relation": "sha256", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234749, "uuid": "92212bd5-46d1-47e7-954f-fdd878a79df4", "comment": "Malware payload", "value": "84205389087723be40bdc60ec45f1353358e71fd", "object_relation": "sha1", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234749, "uuid": "b88e6778-481e-4210-a67a-77dc73870301", "comment": "Malware payload", "value": "8d332a0330a2afe0948e62fddf284d16787fec1ac32feb439d521b85fba9bf0d86131859e3e9c1e0a75e9f0b82b8565b", "object_relation": "sha3-384", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234749, "uuid": "9bc952af-dc1a-4f3d-a837-88ec3025f021", "value": "T16D4423422C267CF2C721F946A0DF3B77D59B2C8E6B30D9746A91C4F51FA009A619A8F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234749, "uuid": "10be0ca6-9c21-43a0-a0cf-62d0cfb462f7", "value": "6144:IS6az507gisjTf0XZYol4XEB58l7mh5ErTrjrD2w45H4+L:ITaz5UgiMsXZYxXEcl7msvX2T5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649234749, "uuid": "46aabda9-8bec-4aaa-b8fc-81cc8959ef17", "value": 253883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649234749, "uuid": "915a30e3-9b5c-4af1-9525-6892c7a5fc2a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234749, "uuid": "f50867a6-7358-47b0-a344-f144e60f4ec5", "value": "73a047e8-68ba-497e-544b-1d53e255a090.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c52e74bb-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649278047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278047, "uuid": "4c4d01bc-50c6-4bcd-89e7-5a6d77b81e26", "comment": "Malware payload (Mirai)", "value": "4295fcb665c3680450cac0e899f7669b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278047, "uuid": "9d5a4e52-322f-49ac-b344-c00ac9645beb", "comment": "Malware payload (Mirai)", "value": "b93a6252725a42cfdeeac3273eabd02cdc08245bb44750124b56bd915f535ac5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278047, "uuid": "7269ac92-201b-4587-9fca-a5e946d9a27a", "comment": "Malware payload (Mirai)", "value": "1b5aebf6e941326107493e1d5808ef7d416f485c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278047, "uuid": "9fd87853-af28-4059-b47f-7d7de510b185", "comment": "Malware payload (Mirai)", "value": "f26720bfe3b23ef3302cf54e908579ec83607f94d059e8fba80dc3a14f7542d55eefb01e4d7f5a7100ab15eb13a98144", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278047, "uuid": "7ba53ad9-501a-49f4-bb80-d41406823ece", "value": "T1DD244133F11249A6C05A0CF122AA7F536C5382FB96A271C3FAB50AB4BF7544B2975DC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278047, "uuid": "3a80e6df-203c-41c9-8273-c7b389b2efb3", "value": "3072:kXJpBohwYG/99Z4WXYPWG0d5fmrmudGIJ2lop:qJvYG/fa10dxmrmudGIJ2lop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278047, "uuid": "791e6882-38f6-4828-a877-45e08456901f", "value": 229029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278047, "uuid": "70ba982a-eab4-4cbd-91c3-c4f63942d8a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278047, "uuid": "30fc28bb-13df-4975-99ad-4aae7e3fa3db", "value": "b93a6252725a42cfdeeac3273eabd02cdc08245bb44750124b56bd915f535ac5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b3cbfa-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278048, "uuid": "032ba91e-c9de-4f5e-83b0-c544c230d701", "comment": "Malware payload", "value": "796fb2ef110dcbeae49a81d5d676223e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278048, "uuid": "3bfc16bc-dc31-4354-bfe9-816555dd5b54", "comment": "Malware payload", "value": "b994d4ff65398a66ba9f4cc9dfa82e552759fec7d50d100304f184ca61dfe678", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278048, "uuid": "530d9e19-4032-411a-978c-67bdccb9aeef", "comment": "Malware payload", "value": "e9603b78711dda8b0b3cd388ba8e96bc1ddf0f14", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278048, "uuid": "cfebc1ce-2539-4a92-b3f6-c1c23fdf9176", "comment": "Malware payload", "value": "682d1d61a95b8b4d91e74fc6693cb9dfa5a54ed97e5e020d081930e50585c55819852373f06eebe06f869ba244dd0d1b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278048, "uuid": "ef14221c-8004-4268-a0ec-75d0cfb6f2ff", "value": "T12B11F61E33D1FCBC79A77950870EC124E550D75B907F6792769A49EE7494084812C43C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278048, "uuid": "156eead7-cde4-479f-a29e-ce79fe16bc76", "value": "24:hXJWnNJP8PmdPxSJoasYIad9YYIBYI8u0aNP1FzqoA5:tJQnkudUJoa4adCYQYyP1FGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278048, "uuid": "f4879e51-a613-43b4-b955-7562ee85f6c2", "value": 1059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278048, "uuid": "f13fcdd1-d41e-492e-9b9a-fa31c7da7793", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278048, "uuid": "879936d9-249f-4715-8ca4-2aafb9cabd04", "value": "b994d4ff65398a66ba9f4cc9dfa82e552759fec7d50d100304f184ca61dfe678", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c62d3216-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278049, "uuid": "e3174249-9073-4442-80de-2e77b523cbdd", "comment": "Malware payload", "value": "48ecec25dd23a9c2c55998db21bbcc28", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278049, "uuid": "800149fd-297e-4a2b-b018-44c787bd2431", "comment": "Malware payload", "value": "ba124cd8c20f3e683609073e6457dc8497c793ee31e621889eaec5e72713ea55", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278049, "uuid": "e9ffd611-e632-47cb-8b88-00d8a2dd3c67", "comment": "Malware payload", "value": "2fe74dffe3383ae51a132b43a9d238c778540bce", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278049, "uuid": "f788ccf6-91e4-40bb-95f9-2c8c02a6e76e", "comment": "Malware payload", "value": "7e14b9dab4a994b379940290aad9769229d4deadc889dc43a40fa0118af6f8e80c7d2c19520acd55a3d6dbe428fd2a53", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278049, "uuid": "e70f0187-32fb-4125-8649-ef4720beb8f1", "value": "T17EA1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278049, "uuid": "edef6028-00db-47a2-8b3d-2da9946f9951", "value": "96:GRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:GRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278049, "uuid": "8a8ffd09-c54b-4a1d-b78a-93d2add9ccf9", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278049, "uuid": "b77c8766-945c-44c2-bc85-7aa251d7794b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278049, "uuid": "99f0d5b6-7e8a-4611-8541-b840be8552a2", "value": "ba124cd8c20f3e683609073e6457dc8497c793ee31e621889eaec5e72713ea55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a9600f-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278050, "uuid": "4addd5a9-5d38-40e1-bc68-c739c4b16810", "comment": "Malware payload", "value": "0af8ff76ae774e37eb69cb513a3b000b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278050, "uuid": "238d54f9-0c3f-40ea-981a-3ace32989b68", "comment": "Malware payload", "value": "ba78754af41624dcb5a44b89540d72abe5efbe3f69ce5fb78451a47b8acf6b13", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278050, "uuid": "fa90c901-c7ea-40dd-bbbe-dab032be7967", "comment": "Malware payload", "value": "b4d5d68233ddd9b3b0528a747f70826f43319586", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278050, "uuid": "d91eaece-6605-4ab5-a7eb-74772ecb358a", "comment": "Malware payload", "value": "0904f63fb16407827b2c0ae73e9ff6fd6b0417167e6d06a9d97f6bdb05565a48da89e4e8a901d497d5724032598bbcb7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278050, "uuid": "edb5c857-7d77-4b69-846c-b4e48e08cd2d", "value": "T1BEA1E650112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DA8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278050, "uuid": "ad473eb3-dc8c-4b35-b223-cc7d1fe71439", "value": "96:KRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:KRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278050, "uuid": "6057d412-6483-4d7a-8119-213a6670ef03", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278050, "uuid": "ff8cf39d-883f-4e23-8afb-5a48499cd211", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278050, "uuid": "9ab81495-e65a-4002-b83a-bc723182fc12", "value": "ba78754af41624dcb5a44b89540d72abe5efbe3f69ce5fb78451a47b8acf6b13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f5065a-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278052, "uuid": "79e96201-4889-44e2-bbc4-f117da5bbe6e", "comment": "Malware payload", "value": "e0e5526de7dc0df6c1a15af124dad6e0", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278052, "uuid": "dcfe29e5-b969-4156-ae25-edcfdafcfd75", "comment": "Malware payload", "value": "ba7e5cd946d56c5563bce926caba628de4a19250c680aaf3adec6fb5997dd1a5", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278052, "uuid": "a500398e-bc57-4b1a-b23f-af7da0469db3", "comment": "Malware payload", "value": "6386b8c8e474c9ff2424146f398e05ed156316a6", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278052, "uuid": "1bb60114-58c7-4ba4-8bba-4d6f09c7e905", "comment": "Malware payload", "value": "876140d1247dcacede797d63a924d40bfddaab723830fee173dc89558472ee60efaccb2de1c03f8fde6e4c847e4fb525", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278052, "uuid": "4b98f3dd-8b9b-4b07-968c-cf42f6570651", "value": "T152B5330C4379BCFDF95E46292B634EE0C5F9A1E1F44260A2D27409A85D3F1BD13AF962", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278052, "uuid": "95dd509f-af20-4896-a40c-83aa5842d9b9", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprcM5c:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278052, "uuid": "c2f9c755-b4b2-4355-9b8b-ceb60510ff10", "value": 2449408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278052, "uuid": "17ba5418-05f2-4031-8cab-932679728838", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278052, "uuid": "b144136d-dece-4d2b-9ac8-d537f2c0ff24", "value": "ba7e5cd946d56c5563bce926caba628de4a19250c680aaf3adec6fb5997dd1a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8852f10-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278053, "uuid": "79dee0e6-bcb8-4015-8d9e-4ed9c19bdee2", "comment": "Malware payload", "value": "c35c4ef641e90a5866d5ac80b0f50a90", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278053, "uuid": "3fd72b2b-e9d4-41a2-95c5-6674a34057a5", "comment": "Malware payload", "value": "bab8bbb139e7891061e85ede4afed3facdc1022c9749d14509ba61aa3f98ecc3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278053, "uuid": "a3799b3e-0caf-4029-84c6-31ee9d6ee37b", "comment": "Malware payload", "value": "1c62872d25d72c15a950dec67fea0545f1f2b435", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278053, "uuid": "e4b28d42-a043-486c-85e8-a74636c8bf9e", "comment": "Malware payload", "value": "bb05c986a21d67be08ec05c5d0f8ac1b183f67d0914d8b202bf44bc09a36a32f7967c7018af0cb6988a83242af7da541", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278053, "uuid": "11102778-863d-4834-a95c-91e4482ac2be", "value": "T158A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278053, "uuid": "b4e9a1bb-e945-4e9f-b271-5847620cfa51", "value": "96:FRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:FRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278053, "uuid": "35ae3fd0-2905-48af-ab1f-93e21ce65820", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278053, "uuid": "2f4ff593-25d1-4c7b-b8e4-22c08e3ecbf4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278053, "uuid": "4884460e-8b5e-4a73-aef7-c5d00ff59c2b", "value": "bab8bbb139e7891061e85ede4afed3facdc1022c9749d14509ba61aa3f98ecc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "261cff4b-b5d9-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1649270479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649270479, "uuid": "ba29715d-5e51-41a3-a15a-e68a879c9125", "comment": "Malware payload (njrat)", "value": "594669f7763a6229909a5be8a26403d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649270479, "uuid": "f9643bb8-b327-451d-b194-a29f4430451e", "comment": "Malware payload (njrat)", "value": "bae3f127e01fcbebb80de8abecd3f41eece9a4a904324e7d3c68fadc609ae9f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649270479, "uuid": "84f81c0b-581b-4c17-ae36-b0cea7c41527", "comment": "Malware payload (njrat)", "value": "6a29f64fb915aa6bb4539c166e507ac7f949fd80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649270479, "uuid": "542afae5-43c9-4747-9adc-2b2b7eef8ab8", "comment": "Malware payload (njrat)", "value": "b02c26ad215ff7498136093c03c8ed145ed82dd5873eb95b64b1dff9f52fb5ab5ab0375706eb9647270ec56d495b9194", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649270479, "uuid": "604de114-8df1-46c8-be61-ff95f1d37511", "value": "T14D033A4D7FE18168C5FD067B06B2D41207BAF00F6E23D90E9EE564AA37636D18B50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649270479, "uuid": "948f852b-5fcc-4735-83ad-5a55a44fd993", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649270479, "uuid": "02a21760-c305-4649-8378-c9124f2ea03e", "value": "384:/gMp1VSikmn0NVtv/Vey0bQiHZIsuGp2ZrAF+rMRTyN/0L+EcoinblneHQM3epzb:Yy1jO1VV0bQimNGCrM+rMRa8NuUyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649270479, "uuid": "e8214c0f-76e4-4d66-91f6-fb19c668ffa9", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649270479, "uuid": "8b989358-b3e3-4551-9606-938313c33a45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649270479, "uuid": "564fda1e-0390-45f2-85e3-541acbfcbd87", "value": "594669f7763a6229909a5be8a26403d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d82fb7a-b5b2-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1649253848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253848, "uuid": "818b6778-e081-429b-a625-d3d73ca14cff", "comment": "Malware payload (NanoCore)", "value": "b024bb046b09f3060cd3b5f5143706cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253848, "uuid": "36ae17c4-8d89-4ce9-86db-6848acfdfb17", "comment": "Malware payload (NanoCore)", "value": "baf8e236476a6b0340139a2b1db14038faa96d8319399f2ef14fef201018e232", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253848, "uuid": "27236657-4843-4bb3-a847-07b808797dba", "comment": "Malware payload (NanoCore)", "value": "038a2f0cb01f290cb94ae2778a636c62a00648f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253848, "uuid": "4c77b241-1489-4e9b-bfb8-d8cbf53b928d", "comment": "Malware payload (NanoCore)", "value": "7b8f8104fc0a8d861ee20a09b26a42521883ce7c94d2097ef8816bed44860848a1094eda76180f894c3b0a01d346b1db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253848, "uuid": "3defb549-1e0d-44b1-99b0-595b52c89a5c", "value": "T1EEB4234983746622D6EF6F7034B9D64437F0B25AE742EEDDDE8811887905BC60B30BE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253848, "uuid": "061461a3-e84e-4c82-bec5-28dd5a469542", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253848, "uuid": "1b71b5ac-ccda-4d41-9216-d8be0753a716", "value": "12288:b0liFLLTR5gds3nz/apWtPB6P5qVGnMlR3F0Eq:4cLLfyWnz/awpa5q+MlR3FD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649253848, "uuid": "e726fad3-de07-49bd-bcc0-a9699d06c4fa", "value": 503808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649253848, "uuid": "049a0d89-fe0e-4766-978e-466e0526611a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253848, "uuid": "45b6138e-50ae-4b4b-bce7-6485c2583cdd", "value": "CV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad678a1-b5bc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649258058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258058, "uuid": "2faa3f30-550e-4ac5-b60f-e2bce76fe5c8", "comment": "Malware payload", "value": "29f331431ec4a5d880b8cdc468a7df9b", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258058, "uuid": "542292f6-73fa-4ec5-848d-1c7c6591dc5d", "comment": "Malware payload", "value": "bbb87b159770672158d5a50a29451faec20bb7d7209e054fee48f2504b630dc4", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258058, "uuid": "1fbba4b2-09c5-44e9-bcc6-b2135952bf42", "comment": "Malware payload", "value": "f54ed458a8979ff032096a34a60273a679569d64", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258058, "uuid": "30ea6b62-4d2e-4429-90dc-63c02d298e3e", "comment": "Malware payload", "value": "e6736071beb14edadfb88cb7add51daed059b9a12df27064e1b397f24cbc785961529efef3326a0f7b55159e55a59071", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258058, "uuid": "972d19fd-1580-4a4b-a61f-fe5cc4b22071", "value": "T13914120EB5B42051E4BF96B8F3DA771C5D0ACC2FB2A9E375111A358CB4788E047CE65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258058, "uuid": "5d20f843-a7ec-411f-aaa8-8dda5ee94bab", "value": "3072:6oUTv/pczKG+wDIy8rvQOOqbvS+W/LU9InSiSjeiua65Xgh7lIhHBmWqypq7gn6:KZcMwDIy8ROqbvSxjU2SZjZuaSXghu6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649258058, "uuid": "d6f1aee9-5423-4219-82d9-9919b1e49b6f", "value": 192120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649258058, "uuid": "bc39762a-9425-4725-8386-e1531a540faa", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258058, "uuid": "ca17b475-ec8f-4bfa-b73a-bd08f3d62616", "value": "Payment voucher.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9094e6f-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278054, "uuid": "543dddde-2738-4128-9d62-a88e4cec4a9a", "comment": "Malware payload", "value": "787e52a3a5240c677ef2f4199d50259c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278054, "uuid": "91142a9d-c73c-43a3-9e88-1e0a2990b217", "comment": "Malware payload", "value": "bbef11865cc4cd2b11e98fd5046c6a2793d295276e3fe2d4df69500ff940748a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278054, "uuid": "0d48173c-b499-48c1-af57-e6249e9cabd7", "comment": "Malware payload", "value": "9e84c3f2ccc3e0214dade48d2613709bc354121b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278054, "uuid": "c0037219-33d1-4a53-b74d-b2c85970c3c6", "comment": "Malware payload", "value": "4b4c57da6f9cb7b496a3d9798c7d5ab7df54cb83023e306d8617e39d63d3a25e5d7e6a683d28abb74cfd0fa16097a584", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278054, "uuid": "817ab602-b813-4c7e-ad34-4d65f8b45eac", "value": "T13BA1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278054, "uuid": "b05f3cdb-a6cd-439e-883a-500629b7245a", "value": "96:lRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:lRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278054, "uuid": "64fc0af5-8c10-4910-baff-e63a38a27315", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278054, "uuid": "91264f81-e878-4ad3-bb4c-1ce57fb75e77", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278054, "uuid": "fbfcdb9a-c6ef-4625-bf3e-0e675271cd11", "value": "bbef11865cc4cd2b11e98fd5046c6a2793d295276e3fe2d4df69500ff940748a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a2f276c-b59a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649243427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649243427, "uuid": "2af1ba2d-c303-4a34-8dcb-1b097fb6e8f8", "comment": "Malware payload (Formbook)", "value": "37eb832927fcb0a1256e6b63c041ceca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649243427, "uuid": "bef95dbb-b343-49b7-92ff-66e8fad9d2a6", "comment": "Malware payload (Formbook)", "value": "bc2ddac40ce341d13e48f7d4bf82d31a6a150339e1928e64ecd3d71522874fee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649243427, "uuid": "45a3f0b5-346c-4f7b-8c7c-0c85a57e4452", "comment": "Malware payload (Formbook)", "value": "c2ead80cd7000e50639f66f056c468ce6e927e1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649243427, "uuid": "15cd4300-1cda-452c-8650-b5b8d8caed5d", "comment": "Malware payload (Formbook)", "value": "711165cbba0bb2adc39810e4ce002f04428c4c7f691f680aff63f3f60951fc2bd7e58c95a3f4fe3f98697673f6dc9f6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649243427, "uuid": "3370a078-ee9c-4454-8dad-859134696ffb", "value": "T1833422796FA4C66BF8E292310BBD2F732F78A51224E1D45B531022EC7A24791CF0EB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649243427, "uuid": "33c00d83-a58f-42b4-ba71-296b70dc3995", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649243427, "uuid": "a0c763f1-9ad2-44d0-82c4-b67d445cd0ab", "value": "6144:HNeZmeOJHD/iYktrwAXb687UMF9/pPP0W6:HNl9JHD/zkFwAXEs9Rn0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649243427, "uuid": "93f4500d-10be-4bc1-bfa5-04698a4d147b", "value": 248669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649243427, "uuid": "b499f141-c70a-43c7-8bae-4b4cd0f1f03a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649243427, "uuid": "3628a2f1-401c-4497-801f-27d7f7b3c8ed", "value": "RFQ Project in Libya.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9931658-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278055, "uuid": "98ecf581-e752-4c59-acbb-6cbc1c88d154", "comment": "Malware payload", "value": "68faf8bfc47ed0b69173230f5d22d934", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278055, "uuid": "efd0f5fc-2e45-4980-8ba5-8b475aa383cb", "comment": "Malware payload", "value": "bc5c0a8f0a38f3cf19e8504e65aac2d438f73fdf5d19dcc4f3ed4cd1b66438ba", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278055, "uuid": "71104576-f6e4-4437-927a-61c89715c850", "comment": "Malware payload", "value": "2fad08d04e3ec27c7e406da4cf369480731286ff", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278055, "uuid": "ffca4171-d2bb-48b4-bf7d-d18721b5f028", "comment": "Malware payload", "value": "d91b1fc8862ce29c7cdef4a6513308d44588915e69a06611f70effd54a8d17c8869f7d54a486c9ebbf0cda2f84e95d9a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278055, "uuid": "0dec718b-812f-4999-b949-bf6d2922eb04", "value": "T157A1E650112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DA8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278055, "uuid": "84448522-73d5-4dc2-89ac-9674f7783849", "value": "96:wRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:wRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278055, "uuid": "e3dc9aa4-e67f-428f-9b2b-6a1327876a04", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278055, "uuid": "1532a52d-a595-4df5-858a-95df437407e7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278055, "uuid": "36210538-0db6-4387-9a59-50e5478ed004", "value": "bc5c0a8f0a38f3cf19e8504e65aac2d438f73fdf5d19dcc4f3ed4cd1b66438ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f1e34ca-b5c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1649261636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261636, "uuid": "0551e8d6-bf12-452a-8d9d-97fa1963cf1f", "comment": "Malware payload (Quakbot)", "value": "aea860a2c9b5de2e6a9619affef59ab6", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261636, "uuid": "153b3679-97be-4d14-9d63-1477a18bc5c0", "comment": "Malware payload (Quakbot)", "value": "bc5f0344277a72a9e4520f49150e00ef3ccefe916e08ef248ab6b762621b2c98", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261636, "uuid": "bec37156-eb6b-4248-b88b-6dc252fbc71d", "comment": "Malware payload (Quakbot)", "value": "c23707053d15eee4393b3e17390c45e958dad561", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261636, "uuid": "51ecc3c0-645a-4134-a945-4d516a705c9c", "comment": "Malware payload (Quakbot)", "value": "9fde7f9e35b7b4db241919c79fc54508d711af08a82dc8437e83ed3889db11c6f12e9f8b0f860354b9acebdb3ffa1f6d", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261636, "uuid": "eb52064d-40a3-4d4c-9a74-801c6a68bf3b", "value": "T12505AE72A2D194FFC1723678AC2A61909C35BE902D24CC8CB7D91F5F4E3A792272525F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261636, "uuid": "741b791a-b2e2-4cc7-a98a-d457f401a94d", "value": "49475e98a322cf931bef4088d7fe32a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261636, "uuid": "a16c322f-a1af-4884-8663-d807c5ebb68a", "value": "12288:w4Z52dj02g1PG9kBQLCygwjHItQOhcrga114QFdy4unYkAi5QVhP3v82xidH7FKb:Zrj9RTyEtQOhygaFdyHYkANb82xilFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649261636, "uuid": "89c3ee73-9c03-4a35-a55a-99b831707b81", "value": 871579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649261636, "uuid": "57950f55-47f9-440e-ab46-2d482c52e404", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261636, "uuid": "cd1d1398-782b-44e7-b512-fca006d9da0e", "value": "winnative1.ocx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca333900-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278056, "uuid": "b161dd16-9e32-47bc-90e5-b883845e50d4", "comment": "Malware payload", "value": "3b5734500a37d42b3d7f7d8ff1296cc7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278056, "uuid": "c73fc8eb-baf7-488c-8493-d6b2b05fe8ff", "comment": "Malware payload", "value": "bc8a067d1078ddfff3bb3f9cb578a7cdb38a8621ab8fcd888b341889801810e9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278056, "uuid": "18213bfc-cf45-4ccc-a3f1-9857bb9a8a2f", "comment": "Malware payload", "value": "1bd3a98fe3efb18830c5f831a9c2bc360e913ea2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278056, "uuid": "a7f777cc-d18b-42c4-9acb-4e0c4f3bb529", "comment": "Malware payload", "value": "dd9010cfff2162b357131ea8d40037c9c71d82df8fe2e12bb5d4be8af3b6221508c815d271ef37a44c742896606f79e4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278056, "uuid": "35649f1a-0d03-4281-9314-6dd8dfebb70f", "value": "T1673117FA10314C39A102CB1973B59A88A26F89DD956A4BB5DFDE3E69C04CC9C71F1F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278056, "uuid": "8a78ef86-96b3-463a-8c86-9549b0e11f73", "value": "24:7fy4SCndCMvPWHgtnRzpoTLrZAW5jXKkVZR8fm:764BnL+AtndpoTXZAomkVZu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278056, "uuid": "84d3ed0d-dd43-45fe-8d51-0ab538368702", "value": 1481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278056, "uuid": "ab50ba4b-1247-41b0-bdde-3b82f56174ad", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278056, "uuid": "2aa5d986-e97b-4760-b8c9-342af1d8c78b", "value": "bc8a067d1078ddfff3bb3f9cb578a7cdb38a8621ab8fcd888b341889801810e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae19ad0e-b5c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1649259970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649259970, "uuid": "9da09cf9-4596-4dcd-8cb6-40ea35cd6726", "comment": "Malware payload (Quakbot)", "value": "203699e7484d7c46a2c545a19b31f614", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tzr01", "colour": "#8ED4F7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649259970, "uuid": "3dcedd97-6f00-4b98-a4c6-2a9f12a2de33", "comment": "Malware payload (Quakbot)", "value": "bdd605f7dbe00d45eb8e8927d70a30d9ee646b5c18c13f7ae50ee9454217739a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tzr01", "colour": "#8ED4F7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649259970, "uuid": "3f71a5e2-692e-4373-a511-8150613b0d0b", "comment": "Malware payload (Quakbot)", "value": "2e2fe711787fa7a86957f601f9e3e3e4eea8d259", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tzr01", "colour": "#8ED4F7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649259970, "uuid": "27cfdea8-80b7-42fe-bd74-b910adb90c30", "comment": "Malware payload (Quakbot)", "value": "9fff5bd2a006c03077e66116dd31bfc613c3fc3675c53638296760f445ee2bd02ae49b10cb6eff6c902e2d4f5a247c41", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tzr01", "colour": "#8ED4F7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649259970, "uuid": "4f468395-7f33-4988-a204-f8a60cde0e2a", "value": "T12C05AE71A2D294FFC1723678AC2A61909C35BE902D25CC8CB7DD1F5F4E3A682272525F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649259970, "uuid": "7698eb58-180b-456b-96ea-3a36bd7529a6", "value": "49475e98a322cf931bef4088d7fe32a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649259970, "uuid": "c6a2ec26-9b98-484b-a4bf-8cb717941142", "value": "12288:74Z52dj02g1PG9kBQLCyh1jHItQOhcrga114QFdy4unYkAi5QVhP3v82xidH7iKd:Urj9RTyAtQOhygaFdyHYkANb82xili", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649259970, "uuid": "cbb15d19-0e56-4279-85a5-5029c474f6b4", "value": 865280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649259970, "uuid": "4241462d-4919-48d4-b31d-515e0030e5b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649259970, "uuid": "9dfca76a-2507-4c28-999e-6d9d01754e19", "value": "Glitter.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc8f22d0-b5b9-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649257014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257014, "uuid": "5c041aaa-9431-4d67-8059-d2905341532c", "comment": "Malware payload (SnakeKeylogger)", "value": "163b81677ddb2175eedc52e2bd49839e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257014, "uuid": "b3a4dead-a24a-4cf0-a70a-256f38079aa8", "comment": "Malware payload (SnakeKeylogger)", "value": "bdeac28541dc023cdc4291a4159c7ffa8a90c3187884884423f1c4d2a47ff430", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257014, "uuid": "8e6bd056-4ebb-46de-8e31-45553f95eff9", "comment": "Malware payload (SnakeKeylogger)", "value": "f90966f5c950460ab5ab0fd13f4500e49d096976", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257014, "uuid": "8b6a59bd-f6ab-4ba6-b09f-5ba2abeb92f3", "comment": "Malware payload (SnakeKeylogger)", "value": "bd75fd3919bdaf27a65ea89173f2c1c379e7d45352fde6fbd2e19090c362078fcb8b6f397b5b40cd5cd57ac810f1fed4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257014, "uuid": "49adc0e7-0f58-4169-9658-6b0d9ffe72e1", "value": "T16174AE95CA0458F7FC29077088D6470FEA706E96A61FC977787432D1A83B19FA4C2B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257014, "uuid": "310689b8-7fc6-48ea-9db9-e3d7d562a708", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257014, "uuid": "c08ccdb2-41b8-4854-b8e5-94365f7c340c", "value": "6144:G3gZ1MYICxnVOvBDm/VwaRsP0pRensPGZOdVZNdpV+kgJD3KPCSoAsS7:AYPxEvBDwXRpReFQ3jVHCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257014, "uuid": "b714d8a7-95be-468b-ba15-a173159883d7", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257014, "uuid": "220bd3b7-edd4-465d-b547-46acf39ea4ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257014, "uuid": "82181d22-93a3-4ad4-a5cc-27b205037c9c", "value": "PO42022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cbc0938-b5c7-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649262920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262920, "uuid": "407c9355-acce-403c-827e-c18bbf3c55d3", "comment": "Malware payload (AgentTesla)", "value": "27da62083a24958f251482cf7ee35591", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262920, "uuid": "b9aaabac-7f6e-4b4e-9cff-04541168fde9", "comment": "Malware payload (AgentTesla)", "value": "be14032640d78c053238dfffef6ca1ded878a2d3d187b5edbe8fdd7171b7faee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262920, "uuid": "2e5d4e95-27f9-489b-ad6c-129c7ae2fec9", "comment": "Malware payload (AgentTesla)", "value": "6cb5ca116e6c0d574b6ff919e677ec779647a66d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262920, "uuid": "2b62a81a-3331-43ea-b102-488e8920bf8f", "comment": "Malware payload (AgentTesla)", "value": "4f44f3c7f3dd8866d343108d5667754dc5ab8e645b78832e0cf5bd41e5128beb1f9bb42247247489f5c9f16e1de89612", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262920, "uuid": "cdd3068a-b92a-44e8-8fd4-c0e2d2092a04", "value": "T1B5C41228B7ABDD12E5BDA6B3E4C2551A07B09B07D4A2D60E5BCD10DD57033E91E82BC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262920, "uuid": "5b18f56e-337c-451e-b7f4-b482f7edbbed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262920, "uuid": "cb0f1182-82d7-41fc-8400-366c76f0e533", "value": "12288:Sm8aj1WM+YUa+wUQKs1vRxgQ+Pu8DlHtCgF:hJW4Ua+Nwv7gfznCg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262920, "uuid": "0b0ac312-1db4-4c87-a50c-d11c141cd831", "value": 566272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262920, "uuid": "47a02a23-d155-4abd-b22e-de45d7e72885", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262920, "uuid": "95a93f40-4ed8-473a-b4d0-c6e0d59a528f", "value": "27da62083a24958f251482cf7ee35591.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90140e3a-b5a8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649249611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649249611, "uuid": "0af31933-9016-4e71-a70a-f39ac2083ed1", "comment": "Malware payload", "value": "a4ba3137b69098286e4b69c200355d0b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649249611, "uuid": "d08d131a-22b0-4d01-8a22-ad1dc9bf1acb", "comment": "Malware payload", "value": "be1892349c136e807fd5b3dd3a3ed5c66dc9da9ef875dc833f2ec8b28c74188d", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649249611, "uuid": "ffb0ec9a-3558-44fd-a32a-8b9c02efd3e3", "comment": "Malware payload", "value": "bb98a1c112883e9278044d3ce575ea950e035243", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649249611, "uuid": "6f3bbb52-ee0a-4c39-b03b-f4ab382a773d", "comment": "Malware payload", "value": "14218f32958100fc76c00a8c204aedf834605d463a166a25da17da6948352a08a13726649aaa522e10834c6c820a4759", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649249611, "uuid": "85072349-0dde-4580-b3ae-2cf156c14cd5", "value": "T1360439263CEA80D9A3A3BBD36FC7F4FE56BEF5B7152D61B610800A0907D1A548C12776", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649249611, "uuid": "ad2878e1-2e14-45a9-949c-6c2f09609c4f", "value": "768:gUUUUUUUUUOUUUUUUUUUmUUUUUUUUUQUUUUUUUUUhUUUUUUIUUUUUUUUUAUUUUU1:NVMcNYz8FOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649249611, "uuid": "9c389c3e-11f3-48e2-8d37-e0df1bd5b5e1", "value": 189116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649249611, "uuid": "61e4ddb9-8073-4f51-b73e-d1313605780d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649249611, "uuid": "27bda96d-14ae-4014-b8aa-c13ca1cfd240", "value": "xxxx.jpg.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf3b24c-b58f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649239005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649239005, "uuid": "43fed5cf-9a94-44a3-8b51-cd6ce87e44ed", "comment": "Malware payload (AgentTesla)", "value": "109a3aa41aee40392871495ebc68996e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649239005, "uuid": "8c4f2580-e2fa-45c3-bb10-e46a64f18d36", "comment": "Malware payload (AgentTesla)", "value": "beb91319717fc14a7eace369c0fb2dc4c74f6fdbfe21e96ab4c451a215fe4c2d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649239005, "uuid": "055de0fd-fa32-4050-b800-70d786cd8502", "comment": "Malware payload (AgentTesla)", "value": "8a555884d5fa75b64d881b2425ffac2cff52d854", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649239005, "uuid": "c97d24ff-1603-4941-8b4e-02a6b2e0ada5", "comment": "Malware payload (AgentTesla)", "value": "8b82dec1cf1fa57c9f0b8bcff571245c1225a1e93dd370dd47deb2abc0fa4fcd05aa8f95850c8e8d8f944e479e09397e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649239005, "uuid": "a9502983-fd26-4701-8e7a-979e3c066eb0", "value": "T1AFC40248B3FBD923C16E5773E0E305050370AA57E5B2EA4E0FDD56AA9E023D61942BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649239005, "uuid": "7e2e237a-e1c0-442c-9328-7a0b7f035455", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649239005, "uuid": "96cdc059-8388-46ae-82cf-557be9d65214", "value": "12288:35srIoBTzToFocHE4Cc5U6ziLkH+zaDNqqe3HgF:psEoZzTOoQRUvKFNMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649239005, "uuid": "bee95479-287f-41eb-b0e0-6117919df33d", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649239005, "uuid": "a75e84cd-d040-4748-9b88-d80252f8f89f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649239005, "uuid": "b786fe16-3930-4e0e-a091-544285ff5485", "value": "RFQ_List_3003847.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f35b065-b586-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649234953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234953, "uuid": "f56f6f31-888c-4e31-87c9-d5f4aa5a1e02", "comment": "Malware payload (Loki)", "value": "e879f74fc90b86c3e3e00812124fa280", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234953, "uuid": "117861f4-bafd-4e94-86e1-63ac18be119b", "comment": "Malware payload (Loki)", "value": "bedb9c3644572b0181d4d482b24085b19b3b8708bc882b7944912536fa8ad728", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234953, "uuid": "23f6e9a7-90b0-4891-8db3-d5218de26a5a", "comment": "Malware payload (Loki)", "value": "be260dc257aa5989f07ac7e5df6c294faa7e182f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234953, "uuid": "c58710ac-7c09-4e1f-822b-86ec622bae56", "comment": "Malware payload (Loki)", "value": "f83445cbbaacdc46a052f9a5006e335f57e1bb3d41173d43bd75105db516b62e2d70997e7bea0141aba54f6dc0a9c7f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234953, "uuid": "0a3193a6-b443-45c8-b6cd-ab14f55d6848", "value": "T1F7940118B76BD913C95D66B3E1E21A0603B0EB07E097DB8F2AD955DE1B033D628027D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234953, "uuid": "71888e6c-7948-40c2-88d7-f0ce862b32e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234953, "uuid": "02a27200-cb3a-4d42-8155-e22f18d8b9c4", "value": "6144:2OOh2l+WVu8/+8NkjmupBpi82NkzyPAyF1WOwB56CQH8e3Z/G2XqqRu5f7tZG9R3:Zl+WRNk/V9kXFc69Dp6qRuLCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649234953, "uuid": "190a3d45-8dc9-41e7-ac27-36d14da38641", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649234953, "uuid": "42dfae62-6686-4f35-a297-f55bea83d9dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234953, "uuid": "1c573870-54d5-4a74-9dcc-38fcafa50d0b", "value": "csrss.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "018e892a-b5c7-11ec-8e58-42010a9c0032", "comment": "Malware payload (FormBook)", "timestamp": 1649262687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262687, "uuid": "15a00415-4529-4e45-92d7-ad73063a3d1a", "comment": "Malware payload (FormBook)", "value": "26b9c883e0b42a0da369401d2a4f3fd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262687, "uuid": "1f163519-bc3b-4b99-aa56-d40d597fc088", "comment": "Malware payload (FormBook)", "value": "bff9f8e4fb678a405e05a729c9649fb5097ecb4c4a02a87ace28401ad22072fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262687, "uuid": "4e8bc838-7795-46e4-980e-5528100236c1", "comment": "Malware payload (FormBook)", "value": "0ae3ee0b2970e065110a44540df4f4f7209f2827", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262687, "uuid": "68ad9af9-52d9-4e91-8a1d-640f4b07f4d1", "comment": "Malware payload (FormBook)", "value": "a8337aa65e72c68bfba619e83ff95dc90ae8a98f631b974161137ba55fa12e1af6b780aab5beffdfddaa2a6e6e2ee70d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262687, "uuid": "199aaa51-3c57-4b93-8c24-9195ced8f2be", "value": "T1DB159E22F2924577D1331A7B7C5B96A45836FF412E387A0A3BE42C485EBB642353D2C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262687, "uuid": "3e613a9d-5703-4854-84e7-519cca245b81", "value": "e2cb83827e1125c5618e1207782dc0e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262687, "uuid": "cf8356f4-d70e-4551-a19a-6752cad6468e", "value": "12288:emdY/VmgU/BLiB+neZyCMc3501+5QKj1u6XU3OolQn5TvEkQ2h2+AnwcBz:zdEgGB7/9+1+aK9U365TvG5wcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262687, "uuid": "51d9d829-b6d0-4c4e-a6a0-8fe229613e19", "value": 933888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262687, "uuid": "6d62b3dd-d9b3-4744-9eca-23581b0b055e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262687, "uuid": "c56c0de3-8e33-4bcb-acbf-254199fed740", "value": "26b9c883e0b42a0da369401d2a4f3fd6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab20fa1-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278056, "uuid": "db7e9021-a4ac-49b6-9076-8852be1708cf", "comment": "Malware payload", "value": "ff833c70b7e9e6b5ca06e209cedb1d35", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278056, "uuid": "86d5b040-14cb-47e7-b571-c87fd456bceb", "comment": "Malware payload", "value": "c033b290ad36c9615c7cd5cbac139240160d7d99004dee5c35882e30ee144590", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278056, "uuid": "cdaa6089-7e37-49c4-ba0e-35410b64e53d", "comment": "Malware payload", "value": "b03e054c72bbaccce938eda83e31b64ea9a75d2b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278056, "uuid": "39454c53-ca53-4804-869d-f28d2bc5eafd", "comment": "Malware payload", "value": "8d1091753154f66975d1210b035eec20b7aa977adf6ac1f374bc24100e5ff691ca3d92d230acd3b2f626b7a4c4b8c98f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278056, "uuid": "d6d56c4b-6bb3-4a14-838b-276a8d1bdd6f", "value": "T150A1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278056, "uuid": "b0c048b9-6e07-4b3f-851d-06fcee297491", "value": "96:bRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:bRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278056, "uuid": "f47ff596-06ea-4547-96e9-e4977528296a", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278056, "uuid": "c2fd8451-3e15-4452-bdbd-00975a2b7f92", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278056, "uuid": "b3021219-349c-4f3a-b2cd-4e57aa1b0be1", "value": "c033b290ad36c9615c7cd5cbac139240160d7d99004dee5c35882e30ee144590", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9d5eb0-b5c3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649261071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261071, "uuid": "b79cb5f5-2c5d-412e-80ac-5c5a16d218dc", "comment": "Malware payload (Formbook)", "value": "39266f074edcf22e84e6e4f7438e5b89", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261071, "uuid": "b059de80-0588-4087-bf4b-cf1b5bdf8d49", "comment": "Malware payload (Formbook)", "value": "c08029bf515af0b640fb4fcdd2d0805cd88f953cbff0315f325a4869d662678f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261071, "uuid": "11c03775-3d5b-418e-b329-5e23d3c32534", "comment": "Malware payload (Formbook)", "value": "ac1ddae103a284072ab68f3f40ccc162c7cf864c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261071, "uuid": "09a72de1-c6e1-44f0-809b-3b7130507dfa", "comment": "Malware payload (Formbook)", "value": "27744ab0bfe2fe2eb4d750b364ccd4a4e1db2d2fd06d3f1f526e558abd865d9cb8f3950614e36ebde7877fbd880aa1f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261071, "uuid": "e082ab44-5a0a-4166-8f84-f72ee6c2d47d", "value": "T1CAD4F162A65A9936C45C0E73A0B1060447F11F17B526FE8B1AFA719A13B3FE52913FC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261071, "uuid": "034af9c2-1a5e-455c-a653-d7b57d6eb1f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261071, "uuid": "071430e0-7424-40c7-9220-a4a3268cfec4", "value": "12288:sCvjeTKguUt9V0Xscgl/fPHCVTzCQqBQXeb/e83Rx:EKuSXsh3/UT2dyOVx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649261071, "uuid": "d50d8769-6c39-4531-9dfb-8536a0711739", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649261071, "uuid": "1f50a437-48ce-4383-b573-a1e88e23703b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261071, "uuid": "3c225be7-64c3-4d88-95dc-0bd7ab7ef1cd", "value": "39266f074edcf22e84e6e4f7438e5b89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c7f7ed5-b5ad-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649251565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649251565, "uuid": "14175b02-be49-44e9-ba01-467207ce38a6", "comment": "Malware payload (RedLineStealer)", "value": "a92b1ec2af31531e8a693ae0b9ae45db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649251565, "uuid": "3c1bccbb-ee24-4052-8ab5-5f024b90f0e8", "comment": "Malware payload (RedLineStealer)", "value": "c0b1a4bda37ab7e23b8bf2b83ba6e0b0b2c11dc59919f87ea475fd15ddb95585", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649251565, "uuid": "daa74e6b-6355-4456-9a50-ddd5f2644244", "comment": "Malware payload (RedLineStealer)", "value": "f1785e4072abf6a86d6aeb1303ae4721d39460e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649251565, "uuid": "fb7811ad-4630-45bf-979f-4b6f30030c35", "comment": "Malware payload (RedLineStealer)", "value": "a7726d8b660f3e825de2bbf66cdc9219955f1d8e6b12981d6397ac737cb8502afdd30cef4d136a9745eed72dc329b7cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649251565, "uuid": "647e7ed8-6e06-4f0e-8720-2ede25ba34ed", "value": "T18074C010BB90C035F5F716F44A7992A8B93EBEA05B2495CB63D516EE5734AE0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649251565, "uuid": "f0e96040-ce69-47c7-918e-9f1acfe9e704", "value": "6c738977a9ba132cd944bf8500fe1bed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649251565, "uuid": "f0003fb3-fd6d-4618-8687-abfcb11fa87d", "value": "6144:FRsJLRqbHRdvKrHv4mmGvagUzC0Sw0uoEIs89/RiBuFpkkEJ:FRGLEDRdvGHvDSJIDJ9JMapDE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649251565, "uuid": "3e34ddb0-fa0b-4689-b7ff-1a75fcf1088e", "value": 370176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649251565, "uuid": "5b1c4d56-a322-46f9-9626-b7e87dd0edc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649251565, "uuid": "3d211300-f01f-43a9-8db1-85a6cbcb1d46", "value": "a92b1ec2af31531e8a693ae0b9ae45db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd1f31e7-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278060, "uuid": "1deb15ce-4044-4a53-ae2a-4ea7f7ccc6d3", "comment": "Malware payload", "value": "f15a415bb236831a29acbcc217e94d0d", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278060, "uuid": "20a09a3e-bf02-4a3a-b163-b9651ce1af3f", "comment": "Malware payload", "value": "c0c7f9814b9bdf01cc4cf0a6ce073de85da9c5ce3ec6a12c28038d34e15b6925", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278060, "uuid": "fcf1db99-aa5b-4ab3-b1a8-c56858842c8f", "comment": "Malware payload", "value": "1d855ae8dda3494b28cf94820a4ab64c0140f945", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278060, "uuid": "3660aad4-e616-4b07-8bde-46021932e8db", "comment": "Malware payload", "value": "93e319cba1d501099cfe76c92157ea92c2f44916985780a460dce2ca2b46769e8b5b47d2cd560cb22f6c9afe5b859e37", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278060, "uuid": "4b054962-c8d2-4dac-9d58-377a3e6fd777", "value": "T1004633082325F8FDE8560A2967234EF1C5E015F4198119F28B7D7008597EAFE5BEEA73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278060, "uuid": "b23515ca-3ed6-463e-b97c-f0f679960eb7", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKSAFE225K/g+7+C:0XSxVJG2fLAqFOfT9sMYNM29SAFN25KH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278060, "uuid": "b800811f-acaf-439f-9da2-21af00a8ef1d", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278060, "uuid": "1f6c256d-e82c-4524-af1d-74d4bf4d9c85", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278060, "uuid": "0ba0d584-b6d9-4a31-a09f-5961c7f60b3f", "value": "c0c7f9814b9bdf01cc4cf0a6ce073de85da9c5ce3ec6a12c28038d34e15b6925", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3307d2d1-b5bc-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649258045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258045, "uuid": "4c86fbcd-8a52-49bf-8020-80708f51b5bd", "comment": "Malware payload (AgentTesla)", "value": "ddde6f1bf66b11cafda7266e3d37f532", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258045, "uuid": "3dd3d720-66d7-45d0-a30a-687a883a900e", "comment": "Malware payload (AgentTesla)", "value": "c0fd0ca75d656494b9044882fef7d87983a9386e84ae370ea88da7249daeb007", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258045, "uuid": "542c6cec-f4dc-4182-a2c0-db58a4281df1", "comment": "Malware payload (AgentTesla)", "value": "e8d9c33326ea7c8b3f6e0c0bbc683ed22a17c9b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258045, "uuid": "3d6ee1cb-79b0-4171-9d64-1fa963313a5d", "comment": "Malware payload (AgentTesla)", "value": "659e45c22cf0da93b5838b63f4a6941086d0d6037be8d4bec749417e8718b133868d0fdbd1a3fb987bbbe60c781a7c74", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258045, "uuid": "96d328a4-492f-4279-9685-44f361456b0f", "value": "T18A1402922BA0C8D8DE725A745E9448297AE0EC128C46B15FB146B21FE0FDFC949CD37D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258045, "uuid": "2e9f60d5-1251-467a-b5d5-e2dfc744d285", "value": "3072:ZA1xIyddy23cL1zis1RSPHt9gqMGfIOHaPwrZkCjTdCuCMrIpFheXhtIksj9:0y2Rs7S/ttIuMoCu3cX8sR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649258045, "uuid": "d31755d5-2360-48ad-8cf1-ac5c9f9472ca", "value": 192072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649258045, "uuid": "c6b58eba-9e75-4199-8a9b-3794d3ae7ea5", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258045, "uuid": "03fc8c8a-732e-45ac-9774-488a515d41ab", "value": "new quotation.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd8fb80f-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278061, "uuid": "a1f2a44d-b8cf-4b33-a39f-eab343768d82", "comment": "Malware payload", "value": "2f16ec8ff937f4899b60b678a04bd58f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278061, "uuid": "e3dff539-7c56-4e22-a7ac-7fd9206b1576", "comment": "Malware payload", "value": "c178d6c641f0e5d7d664f0d9182cc3c20b920043cfc03110aab7cba1367c1c31", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278061, "uuid": "5efd34e4-c3a0-4caa-bb93-5cdd548e88b4", "comment": "Malware payload", "value": "99fcef0bc75ab6fa0025524b3d93062d85e1c127", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278061, "uuid": "e99a2312-a200-41bd-acc0-7e51bde3f129", "comment": "Malware payload", "value": "3679e41743ffe3bf079a087f0bede86d4373176af0a354d1a9df6225ddb8bf7f2541c1edcace0ad8ef0358330e0dde88", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278061, "uuid": "1b913808-3c7f-4c8e-b819-37d9605ff526", "value": "T192A1E850112C1AB17246597AD26FFB92B50EC81B09777B358473A63C74F5DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278061, "uuid": "3b399686-05c1-4482-9e6b-a6ea95674779", "value": "96:FPRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:1RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278061, "uuid": "b53f3cc5-8a5d-4097-9dbb-11184f617b39", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278061, "uuid": "fd7cca33-f375-4228-bc00-6f57d07eeaca", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278061, "uuid": "a8e905f4-ead1-41c8-bcd0-af23faeb1dad", "value": "c178d6c641f0e5d7d664f0d9182cc3c20b920043cfc03110aab7cba1367c1c31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22f6677-b5e2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649274606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274606, "uuid": "1f99c7e6-b178-477e-bb83-e67895cb4519", "comment": "Malware payload (Mirai)", "value": "d85123e9eb033e77ec0960a4859734e3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274606, "uuid": "b6a3e63a-81c8-4d84-ba53-b05f99c632cb", "comment": "Malware payload (Mirai)", "value": "c1b9a3bf3b6cf2ac3ead59874a510a417b7062b0ca6c8fa903f6e1a071a9815b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274606, "uuid": "3983622f-c4fe-4c74-9dec-96cb55876c73", "comment": "Malware payload (Mirai)", "value": "e1a3e61b40309bb0b3a45cc10307cf47c4fdfb5c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274606, "uuid": "e53837c0-1250-489b-bf9b-efe0c7fd43d3", "comment": "Malware payload (Mirai)", "value": "86510fe5ddf368fac9c3e3f1c875b4029f6d826888de29f6340122b373d4e7b2140c41a5f0695a533553a652b50d5b65", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274606, "uuid": "004619df-5aa7-4bec-811c-419ec20064dd", "value": "T1E8B2D1653B46A874CBA20536ED39C1C31F6752EEF4FF3069A3409E4863859479A7118F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274606, "uuid": "027ab728-23b9-4888-87a2-2e1d7aa90655", "value": "384:5fI1CGGdTC4bPWnHakO1DHF94LUDsaQMQusmlPVK1OhymdGUop5hM:5IgXdTC4bWntOVIAGXWaOs3Uozq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274606, "uuid": "4f6b7cf3-a955-413d-ba8c-2880a81db055", "value": 23456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274606, "uuid": "c655de93-3346-4d67-ae16-e5a2cc466d8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274606, "uuid": "85fc556d-6b21-42be-9b4d-5e9485676cd4", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "250df91b-b5b0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649252868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252868, "uuid": "1786dfb0-f0d1-4a29-bd7e-2c1a5b0dfdfc", "comment": "Malware payload", "value": "9b4c63cfed76a2036fcf8d27a4f2d206", "object_relation": "md5", "Tag": [ { "name": "dll payload 787MB", "colour": "#62426B", "exportable": true, "hide_tag": false }, { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252868, "uuid": "cce5016c-e05e-401e-89c9-60898d546af4", "comment": "Malware payload", "value": "c1c18a8a94ff170c5894836c5f55f0c5195385904429c9b73e354b6fdb9742fb", "object_relation": "sha256", "Tag": [ { "name": "dll payload 787MB", "colour": "#62426B", "exportable": true, "hide_tag": false }, { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252868, "uuid": "f6a09cfb-fe57-4061-9a0b-008c4db0a6dd", "comment": "Malware payload", "value": "92b0ab84f164bc53e2f2d86a74c0fd3d61fad3f2", "object_relation": "sha1", "Tag": [ { "name": "dll payload 787MB", "colour": "#62426B", "exportable": true, "hide_tag": false }, { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252868, "uuid": "54c6ca68-459a-473b-9a1a-288b4bba5673", "comment": "Malware payload", "value": "87bf40923699805238eb8e2c9c8d9a319c3512b2a2e6329c90e4e1103caf1e0ae57fbe326972a93cdfe534d273de2b64", "object_relation": "sha3-384", "Tag": [ { "name": "dll payload 787MB", "colour": "#62426B", "exportable": true, "hide_tag": false }, { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252868, "uuid": "fd0951a4-ad37-40ec-acd7-6abbc78c68ce", "value": "T19475453AF4493660FC4DC2F409B01DE403E53E75122BA7C422B6759F96A7E3DEA60936", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252868, "uuid": "ecb9dce2-ab25-4255-aa39-a11d579443c6", "value": "12288:rw8fl/CaLj/kvEj1IlvF3u/fobWjiVB4BUEW4erdu5S0+9f/2vP0z:rw8fl/CgsvEj1I0a8QzBu5r+Z/i0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649252868, "uuid": "c439ab78-4e1e-43ee-9022-3de64c1d417b", "value": 1646930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649252868, "uuid": "e320ef49-512f-4d4d-8fd7-819dfedbe018", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252868, "uuid": "b0457beb-3f2e-48c8-8c4a-7a479284afd3", "value": "htmlayout.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ca3e4a1-b5aa-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649250384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250384, "uuid": "8af06b98-c214-4dc8-a556-07efa75ec994", "comment": "Malware payload", "value": "9fa67dbfc8e9cb360827d1b37307b9bf", "object_relation": "md5", "Tag": [ { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250384, "uuid": "0439c1fa-53df-48b1-93f9-4b869d7c0fdc", "comment": "Malware payload", "value": "c1ef33f32b38922d15e1d6dadfb7e4534d3fe844fe5d668ba105fb8715f42693", "object_relation": "sha256", "Tag": [ { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250384, "uuid": "586f8e05-baa0-4332-bc16-2d00cbc4de41", "comment": "Malware payload", "value": "ef644c73817f1f48edae760206d1306ab33db5b9", "object_relation": "sha1", "Tag": [ { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649250384, "uuid": "a5811cd1-ffeb-45a3-950b-8b8a5c0214e3", "comment": "Malware payload", "value": "53e4cfd73d865be203b5c32a9eb3cfeec2f756259f0b8f0a944c778d289cdaf9a7cb1831652d005ac18f110b258d55a7", "object_relation": "sha3-384", "Tag": [ { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250384, "uuid": "91d85975-84f3-453d-b633-13465a1f753b", "value": "T11B551236C8E05991CAEFD73315186AF983182477CCC9E5BB0E6B36DA2CB6431536B06D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250384, "uuid": "086ae2aa-3510-4d78-8a1e-cafbdd32f6c3", "value": "24576:zF+BnmJkeGC2PbA/HMoNYIPeuVe2HHCkm6CyIwl6hafINeWHWR72vF+BnmJkeGCf:pymaeGC9YSeQHCkXC/wl6LcW2929yma0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649250384, "uuid": "1f71ae85-5f69-4cee-b140-a3ac519cbec4", "value": 1282468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649250384, "uuid": "c5d880e8-d1ef-4a02-9518-1bb7de1e1acd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649250384, "uuid": "5fd2ba0b-a8b1-4b3e-a187-16fd32110c94", "value": "SNC-715311593-Apr-6.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf573ae-b5a2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1649246974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246974, "uuid": "736da7df-b4ae-4c22-bc18-f0596bbda74e", "comment": "Malware payload (Stop)", "value": "51f6a54d7da35e3fa4ad315a0ae61bcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246974, "uuid": "028825dd-e48f-4091-a224-b71101f58747", "comment": "Malware payload (Stop)", "value": "c20421a2e632d8bd82991594c5c8fcff34b071746266ec42093deba17ff7c8fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246974, "uuid": "cac15268-f85c-4df2-a031-bad11dbf3eb2", "comment": "Malware payload (Stop)", "value": "2e59265870931a22147b315c44c6e4b46b205763", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246974, "uuid": "6d3be3c0-96c5-4bfb-a4a7-5dc369b457f0", "comment": "Malware payload (Stop)", "value": "15e6014fbb6c81d9365d217b3ccfd8570f75028442de756432a5434e46ffabb3122a6d13b9e426ddea2eb01487c14f30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246974, "uuid": "41ceb4bf-34cd-4654-bbfd-8007412aaaa2", "value": "T18DF40200BA90D035F4B766F4597A83A8B93E7AE05F3890CB62D51AED8B385D4DC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246974, "uuid": "ca50a1b0-ab86-49a3-bfc1-4b3052253a24", "value": "6c738977a9ba132cd944bf8500fe1bed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246974, "uuid": "9a1d192c-3b4c-4b1b-86ee-2bfce92bdff0", "value": "12288:TVnnL9lM1JL5ZdySU03qc4SRJAOcx3W5y3gN/gGwaDxfzaSEeRriGRSf6:TlBkfd0GqcPAOsQyE/rw4FziUuDf6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246974, "uuid": "35aa2859-cbcd-4277-95a9-32da22a673a1", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246974, "uuid": "602db839-b862-4813-ae46-c0486a01329f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246974, "uuid": "7e0ec4e8-04d6-4350-8623-01fbc4b2f727", "value": "c20421a2e632d8bd82991594c5c8fcff34b071746266ec42093deba17ff7c8fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6988a76f-b5a2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1649246970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246970, "uuid": "af8a63bc-eede-42cf-814c-da3b8b216acd", "comment": "Malware payload (Stop)", "value": "2b5bcca5145aeea15940bb017fbc4fb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246970, "uuid": "f2539c48-3b8c-4b85-995f-87cd40890c5e", "comment": "Malware payload (Stop)", "value": "c2732bf220926fb3f10675292a7d8bb19e8ae4e8632fb73358676004b8f3781a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246970, "uuid": "983f1d17-75fd-46b5-97a8-1af677f4f721", "comment": "Malware payload (Stop)", "value": "749258da0e8adaaae247292573c10ef501cf391d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246970, "uuid": "19b3141c-a505-4944-b50a-cfb0f58a9f44", "comment": "Malware payload (Stop)", "value": "739dab68b4e28977646ff20afe78490b1e63d3bd7cb5bdaa7ffb0c3ab50143cb8a2f8c90a70bafd5005b93888943d59a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246970, "uuid": "24a27b0a-80cf-4b18-952e-8aad2478d089", "value": "T1CD0512C577D2A070C1563E346861CAB0053F78A1E570297BFBB8AB1E2EB03D166B5772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246970, "uuid": "337feae7-9333-4606-b62b-105e287914d0", "value": "c573cb6c93cba3d870a0445c3d1cb654", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246970, "uuid": "a53a99b5-1001-4f9f-9795-865d9237863e", "value": "12288:Qaa/F3kcHp2gCS7zei3sbvh16H25wK0jqJjUIcjlMLLQ79:QawkcHpvhn34P6HH5rIXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246970, "uuid": "b5eff747-7f40-4807-873f-50b1c4b1815b", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246970, "uuid": "d5913ea3-669b-4095-9d29-e36a4feec173", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246970, "uuid": "9d4afebc-6da8-42d5-be0f-e5e623c83eff", "value": "c2732bf220926fb3f10675292a7d8bb19e8ae4e8632fb73358676004b8f3781a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce054f06-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278062, "uuid": "4a6bb052-1a18-46de-b6f8-20d8b923c1c9", "comment": "Malware payload", "value": "71e2c84cfe9ef84e978b49e48d67ce45", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278062, "uuid": "e494618c-0abf-42bc-bf82-169907f8d1fd", "comment": "Malware payload", "value": "c322eead1382f18cd95778655e1747a0ff7108572c4f6413f95f2abde5f8c9a8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278062, "uuid": "d97a067b-2b44-45aa-9d34-ef6c87a0bd6d", "comment": "Malware payload", "value": "7d5639512f6506bf17d034527e0f00e5ead12156", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278062, "uuid": "a1a50c16-7f0f-475a-a8a5-6916860e34c7", "comment": "Malware payload", "value": "393383395486392bce0790abdd9b9aede3bf905eb46695c78381d35185d9ad36fdeca6b54e8108cea3c0aec0bd014a97", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278062, "uuid": "87048849-1d29-4e02-90a9-1a3888785512", "value": "T1C5A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278062, "uuid": "2f37d83b-f256-4bfb-b01c-a4c3b34c19ab", "value": "96:URYZxQOBpLyxIcymLKY8M991wuIaQPYPW:URJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278062, "uuid": "a194425d-15e5-4bce-be9a-442e60c3951a", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278062, "uuid": "0ac1676b-8a56-4eb9-a599-713b28dcfaf0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278062, "uuid": "014f4748-fc65-4e25-9c82-3e2120ed6527", "value": "c322eead1382f18cd95778655e1747a0ff7108572c4f6413f95f2abde5f8c9a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf82a4e4-b5cc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649265153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649265153, "uuid": "948ae06a-5b34-4240-bcff-ee319eac2741", "comment": "Malware payload (Formbook)", "value": "d5949e2ad723b184d5622ce746b0177b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649265153, "uuid": "8aaa084d-ce10-4d5c-8c3f-abfffc3e999b", "comment": "Malware payload (Formbook)", "value": "c34886d629b199ebcda6f6fef7fcbf5f48ba3153c6789708639b0c37d4ac5487", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649265153, "uuid": "699bc603-d1b3-48e6-b39d-7220947ad668", "comment": "Malware payload (Formbook)", "value": "10f1ec8f4a1ce70546a4ca25965b606ea2bc20ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649265153, "uuid": "8f1576e1-d103-4650-8f97-24897d4e8464", "comment": "Malware payload (Formbook)", "value": "0b163e9b53e47f301db1243528a2caab106f864306d7ca4f2a5533f80a337a28ee91b9a90944728bb9986691448bc480", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649265153, "uuid": "e10a59a7-9531-49ea-9bd9-1898a24d0256", "value": "T17464DF8761C09077E8C60E760821C45D5A5F7CEC2CB7427A73DC3BA92AFFA8D7649906", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649265153, "uuid": "18e162c9-25bd-49b3-9133-55f838e902e4", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649265153, "uuid": "4533c5a2-e2f3-4281-9927-e719fa7562ab", "value": "6144:RNeZ2KnbGYu/gc3BOsNExg7ncENT33uRh9Y/qAMJJdLZ+cb4YO:RNpKnyXgcxOsNEEcENT33uNIqbJB4cbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649265153, "uuid": "43b3214e-227f-4a9e-a579-22d031afebc2", "value": 311986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649265153, "uuid": "26c9ed20-07fc-41b0-a49a-3e15ca5dd39c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649265153, "uuid": "9e16be74-f18c-4051-9183-811d26cc26d2", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66be921b-b5a2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1649246965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246965, "uuid": "65b3ef30-74d9-4e99-b4a2-8d33a65d976f", "comment": "Malware payload (Stop)", "value": "14ee63fc90db7b63822570e0f9d2d1d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246965, "uuid": "c040a634-19cd-418e-9da9-80ba5987a01f", "comment": "Malware payload (Stop)", "value": "c39d0bcc9babaa2ebef7232a9309779125997079b7dbe86256aa81a8e46136f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246965, "uuid": "b549ec26-3b69-484f-9076-31b1ba06c704", "comment": "Malware payload (Stop)", "value": "54aa6cc1ab49621c1d3847b7311ef65eb7ab1f3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246965, "uuid": "82acf3ba-56a9-42b7-9839-82e69b1bbdb7", "comment": "Malware payload (Stop)", "value": "888e5216e80a439b658d2fbe19082ab41a77b5a297a0f895c0bcfb8dd63207815f8a9a4d6fb62369f4931295d4879f46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246965, "uuid": "17c733f3-8e4e-4e5f-bc6c-c27c6ff91a8d", "value": "T125F402107BA1D035F5B727F054BA93A8B92EB9A19B3484CB62D416ED4B347E0EC7031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246965, "uuid": "490b714d-2a86-4b17-aae7-9266a8b164b7", "value": "a838cf9305c796ef9ede12c92e34f95f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246965, "uuid": "42bfbd0a-6e04-44c1-bb58-8cbef3211f5e", "value": "12288:V22Po9uZjpgScibWiRO+M9Dte2oFgvwr0iblR2Bi/K4HO8bj79petpmvw3xK32:VlnNGS1WCA02ruL72BiS4uo79p6EwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246965, "uuid": "c8d9ec85-8039-482b-ad43-3cd5f40dd079", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246965, "uuid": "b28287c9-6d99-4cf7-99fa-603157643e7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246965, "uuid": "1cb4432c-134c-40d8-a5a6-54c2c17015a0", "value": "c39d0bcc9babaa2ebef7232a9309779125997079b7dbe86256aa81a8e46136f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "953bb94a-b5b5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649255203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649255203, "uuid": "80e71e4f-2e22-4992-ae81-b62cc25b9ab2", "comment": "Malware payload (Formbook)", "value": "1cc44492565dbf033ab7b77eeb80d8b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649255203, "uuid": "98fc8445-9d33-4821-b268-4947cfefe78c", "comment": "Malware payload (Formbook)", "value": "c3ccf5d01e48c5478bbfbc894f005b8d20e4e4a50cb00bc0199f2d7f491bc494", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649255203, "uuid": "d1935084-dfd5-4810-9826-fe163ef17b37", "comment": "Malware payload (Formbook)", "value": "5b5c8d6b8cc514b65a4a0222519c3807fedc33e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649255203, "uuid": "ee8abe76-2b92-4c2f-ba1d-9d90694c571b", "comment": "Malware payload (Formbook)", "value": "9c403b535374460e44692808fc255ea54616e3d599b8a274a12d8d14126e14807a795ac9a3680e1747aa7e393161ae34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649255203, "uuid": "28605fa5-a3c7-4369-b252-997e71a14538", "value": "T184236C0C77CCD612C2BD967E85EB015453F8A1FB2A13E61AEDC412BC5A93FE56906B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649255203, "uuid": "6bf05602-3bde-4088-ba27-94e388fb19db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649255203, "uuid": "7d8353b2-be40-4cb3-a1de-8995469c281a", "value": "768:1G1wDO2eFaUAptFbt9CHCbrLaxvLyPEFs76+UA/SmWH4GSUaq1LyJdzEs:16fFc7FB9CHW3wWEFs76Bc56Eae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649255203, "uuid": "ac874624-16b7-4bf0-9727-6cd7b2d0ef6c", "value": 49664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649255203, "uuid": "c3d23491-c122-4ff4-b8b9-e1a5970acf5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649255203, "uuid": "61067f9c-b2ef-451c-a935-3fb0641c2c6c", "value": "PO 706621.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf3486ce-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278064, "uuid": "d231d38f-8f44-422c-aac5-20918adecb19", "comment": "Malware payload", "value": "79df62c20b676f15033552ec854020a8", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278064, "uuid": "1d26654c-3dae-42ff-993e-315332e75cc9", "comment": "Malware payload", "value": "c3f1df8020bc6462b5104615b98d1f94627d4642d81c7e8d5a7344dc66eb368f", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278064, "uuid": "29bf92a4-63a2-454c-b6c8-835e192e75e0", "comment": "Malware payload", "value": "e7276b19d3562adbd52a61ce73b086a2db08877b", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278064, "uuid": "837bed4a-4a59-48eb-a230-c9c7dc87deb6", "comment": "Malware payload", "value": "2f4c2b6dec6d25019a03c4d3792e87839d48552008ed9bc68029dfe9e4d2cfc2ab00efe393425f8bb4ec5a0ee0d39925", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278064, "uuid": "39b0434a-3565-41b2-aa8e-f8a587813848", "value": "T15926330009D122C6F6D49D1E5B9C26B5413FEECE28E8E9E3D6D3C3F5040FDCA9661A96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278064, "uuid": "5a5d669a-bdf7-41fa-968e-7e6127089990", "value": "98304:G1wwAjzIQOMK2GNKslgus10Y1/UJ7BdlRbTBAlYVdon:G1wwAYBr21uQsJ7vTBAlYV+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278064, "uuid": "2ff6143e-6a81-4219-a41f-64d7498bf731", "value": 4431872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278064, "uuid": "79c83c7e-47da-467a-b5ef-fcb4f0851c5e", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278064, "uuid": "bbe3e301-c06e-4d80-bc43-669159f005ba", "value": "c3f1df8020bc6462b5104615b98d1f94627d4642d81c7e8d5a7344dc66eb368f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d40884-b590-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1649239283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649239283, "uuid": "3d1344fb-2d29-4bfa-a13b-642e496dbb81", "comment": "Malware payload (njrat)", "value": "c81b617803380c7f5193aac992e7ecff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649239283, "uuid": "102ad671-0956-4b22-98fd-47763df64f29", "comment": "Malware payload (njrat)", "value": "c3fa0b2d3fe6b1f0e2553c8233c511644a7a469819e6b0b1b3060cc1e363c1ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649239283, "uuid": "53dcd627-66ce-4ae5-8d0e-06ca2b64cf74", "comment": "Malware payload (njrat)", "value": "48faa53e2cf72bd0a9df3ee82971747d8d7f56fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649239283, "uuid": "6b1e7c10-1895-4886-8cac-323874cdaa72", "comment": "Malware payload (njrat)", "value": "c7c5715a269464c7e42c83b292d190468d54acadaf8ca72c99f82a1735915c9057e8ccd8c9c553a7a013376e25120352", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649239283, "uuid": "fd7c7285-9102-4e97-a1b5-4caa263b034d", "value": "T1CC032A4D7FE18168C4FD067B06B2D012077BF04B6E23D90E9EE6649A37636C58B54AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649239283, "uuid": "3d939198-8cae-4cf8-8cc1-effb03f72a25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649239283, "uuid": "524b8f29-8f84-4880-9300-24cc24b1c1db", "value": "384:Q0ACT0i9PdTe/kCOyU7fwv9YDn6a5rAF+rMRTyN/0L+EcoinblneHQM3epzX0Nro:blV1CFU7fwyj6GrM+rMRa8NuGKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649239283, "uuid": "46772811-1c6a-4553-a89b-144ad1d4bbbb", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649239283, "uuid": "a0056467-6fb6-46a2-b67f-4bf014f6b36b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649239283, "uuid": "3b960288-3902-46c5-85ee-7c3afa1a9b79", "value": "c81b617803380c7f5193aac992e7ecff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7739b813-b5bb-11ec-8e58-42010a9c0032", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1649257730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257730, "uuid": "203d641d-c8a7-483d-ac3c-15bc72034d75", "comment": "Malware payload (ArkeiStealer)", "value": "ae390968790ad9576b3373caaff89475", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257730, "uuid": "db34281e-cead-4976-9255-f40f155299ac", "comment": "Malware payload (ArkeiStealer)", "value": "c40c4ad03430f7dc6718e0229b64bf3a515d1fabb042acc0a0fd69f82fd14867", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257730, "uuid": "3e29da26-ff52-4efa-afca-102a37db5fc7", "comment": "Malware payload (ArkeiStealer)", "value": "cfbc4aa866518e97d46e5167068db6fbbaa5a7d0", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257730, "uuid": "1cdaaef6-8bfa-421d-832f-3d02efb00f0f", "comment": "Malware payload (ArkeiStealer)", "value": "e5378f697cdce64e7b1d1ce1339b0464cb9041c6758d8aa8fe33dd509da34d3e116f87b1b3e47c733d92bdd8edbf60aa", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257730, "uuid": "03d545d1-b150-4cd4-a355-61b38b6b616c", "value": "T16664CF3273A2D831C5A50E70A460CBF15E3BB8735974589BF7A47B2E2E703D166B5322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257730, "uuid": "af6c980a-f58e-44d8-9b54-64aba457f4fe", "value": "90d6a39a45ddf49ce4fb487d0a67b6d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257730, "uuid": "c9866af4-8692-448e-858c-a241003a167c", "value": "3072:21XIN4Er+dH2ZcTqQebQYKTJJ1QPwzU40Kz+gtafrClFzbsxkgaBCh52lqG:aI/rKH2ZcTqQm0Tr1/tv5tU+Jwiga3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257730, "uuid": "7002e4f8-87ad-4d5a-b937-2469524e5099", "value": 311808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257730, "uuid": "7af418e1-b1cc-4cb5-8775-694a871e7a39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257730, "uuid": "12b0f430-ce33-4a66-b9a7-65c68a686541", "value": "ae390968790ad9576b3373caaff89475.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12baf61c-b578-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649228785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649228785, "uuid": "1553037c-66f0-45db-9537-87f2b5683c15", "comment": "Malware payload (Heodo)", "value": "8630d0270327a3ed77af05e083159bd5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649228785, "uuid": "2364bfcc-41b3-4354-b874-bf3be846cc98", "comment": "Malware payload (Heodo)", "value": "c43e8e3eacc440b06631c799a3d1b79a87f5cafba04a013c0d4fe14e650af42f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649228785, "uuid": "5419f7fb-e70a-49b7-be75-102fa4962c3b", "comment": "Malware payload (Heodo)", "value": "1af7bca668e36803f85e01e1f6b09a51c25a8855", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649228785, "uuid": "30af1521-aa60-4da7-b865-1d7141011981", "comment": "Malware payload (Heodo)", "value": "17175600b606db3a1878266db36ef999cdfa2a2ffeb498b8afa57120bbed6c8a1d6098a050a3984773194663e2e69c45", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649228785, "uuid": "3ac074bd-24e9-457f-b0ff-4feff0f28fac", "value": "T183A4AD12B3D1C075C5EE11341A2A271567FEBD204BF5D6CBABA0FE4EAD32AC18935316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649228785, "uuid": "5cd3b012-4d76-4d48-bb3b-30abf0d0d405", "value": "0e8a17377c9b4601e7a0971e33ed66d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649228785, "uuid": "e5d3f2e6-e8a0-4863-8a25-69f31f9082b9", "value": "12288:6caLILOJcC7Mx3NFvVO9orVD2dotpdLR:6caLIqJcxF9rrVD2kpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649228785, "uuid": "bf195761-8408-4776-9f70-b250d9192276", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649228785, "uuid": "58634bc1-a645-4ab8-bffe-cbfca3c57416", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649228785, "uuid": "69f9cf5f-ec28-4309-9af8-2d90bbff2afd", "value": "emotet_exe_e5_c43e8e3eacc440b06631c799a3d1b79a87f5cafba04a013c0d4fe14e650af42f_2022-04-06__070617.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfc118e4-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278065, "uuid": "07bf680d-8462-477a-8da1-8a907d7ac22c", "comment": "Malware payload", "value": "78116993b0ba1cb71f7c4db33c3e3535", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278065, "uuid": "51f6e093-e8fb-4841-acda-b8423b52e3c2", "comment": "Malware payload", "value": "c45a7368531175f25f50b2e7e2a6ccdbcc74826b4c4702ac5eff6f82c7bad359", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278065, "uuid": "3b448f10-eb6e-4b9c-887a-2b819a8280cd", "comment": "Malware payload", "value": "ead122392befc188231c5ebe8c34ca29ee0a01d9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278065, "uuid": "a79a964a-1c24-45fe-b75a-85c35b4bfb8d", "comment": "Malware payload", "value": "73aac1527a79200bd4a73a5271b81e0b74b03352db7c420877471736a3c606fd0b1c3d452bfa9eb352b59e2890c4640d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278065, "uuid": "2a65b9f7-51bb-4e5e-a3e1-54011c740ae1", "value": "T1E9D0234A5B133C0E321BFAF0041D05C0D020C767617F5571423945F1304B1C0751DD31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278065, "uuid": "6c3fb84a-80fc-4148-bba2-247b7962194b", "value": "6:z6I3VDmbuG5CnPNNOMHFQqHbLHi0drDd2lM0nX4vDF:dnnP+Ra/i0FDoM0X4vDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278065, "uuid": "a862dac9-9a55-471c-955d-f0e742e04761", "value": 231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278065, "uuid": "19152839-d68e-4c7a-a04a-805b93eceec7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278065, "uuid": "08a9312a-8dfa-4eb0-a291-89c629f66c85", "value": "c45a7368531175f25f50b2e7e2a6ccdbcc74826b4c4702ac5eff6f82c7bad359", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0710bd-b593-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649240536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649240536, "uuid": "9ce48fb4-3935-49a3-9931-6b37f61c869c", "comment": "Malware payload (Mirai)", "value": "e3bb20db77eccb5291f296d6914aaf1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649240536, "uuid": "5ae6970e-2bd5-4295-b87f-d228453fd9b4", "comment": "Malware payload (Mirai)", "value": "c4c8bc25dc5a77d39115335ecd73bd362dbbdd9fed6d128f8c49e11f9a7d854c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649240536, "uuid": "a641c561-7447-458f-a85c-355f3ca255e6", "comment": "Malware payload (Mirai)", "value": "0011b9589c41b7c58263a7652b6ceb67b385eda8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649240536, "uuid": "c0cad361-604e-406d-91dc-6622611cfba7", "comment": "Malware payload (Mirai)", "value": "85eb88fb56b45c0d74a36a5033cc810f0fc8af55320b7507fa413c0f3d4de72c792164ba4929dc8896f23bcb2c56d28f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649240536, "uuid": "c7f37ac2-960b-4565-9615-37684740e29b", "value": "T143F2E137A28665B0D3A44E38F45E4143A38AFE7CC4DE74650240E3EE24E3C6697F95E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649240536, "uuid": "6c05d3e0-b314-41cb-8f11-0312cd414b11", "value": "768:7VO9iBPm2A0KsAdc4le60eaHUtNA/TaJq3UIZ6:7VO4Bu2ARHdUgA/TamZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649240536, "uuid": "b5a626bc-3608-45fb-9b55-e42b83d8cc4a", "value": 35228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649240536, "uuid": "3e836cb9-e4a9-4f3a-9f70-2fda5c469111", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649240536, "uuid": "7bf09915-427c-449f-818b-b425c1e361a1", "value": "e3bb20db77eccb5291f296d6914aaf1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "223b28af-b585-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649234395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234395, "uuid": "db507634-e9c2-481a-8dcf-d3eed191f223", "comment": "Malware payload", "value": "5c1f6e508d21df4a8faa86af75da2f7b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234395, "uuid": "e2f08e0a-0444-464e-96f1-221fa44e125f", "comment": "Malware payload", "value": "c5b4d92697fac55cca2e0d1dca4c9ae9db39b070d187de9fcf4eebcd232cc94c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234395, "uuid": "6ccdabb4-96b0-47fc-ba98-27d76acd8237", "comment": "Malware payload", "value": "089832df17ecdacba534b37c529bbe87c606a356", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234395, "uuid": "39212d38-1af3-4eae-b6c9-224eefacfb9b", "comment": "Malware payload", "value": "5b2d10a376321f43626eeb1a8cc6de240d722edb9c038759ca5b95f78c9200e2f082bdbf04a4e179220881ac1cb76c55", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234395, "uuid": "1f30ccd8-55fa-405c-8510-4a33b06ad095", "value": "T12E1412F359359B20D972C8F5A128FDD87742CC417D4F941EE32A32164E3298EB4ECAA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234395, "uuid": "66e04fde-d231-4609-8b1a-16e6378b6a47", "value": "3072:TxIrM+oQWNfsjtzOCKD2jwkKqmPGSO9w73nTXLRKXOG141TPwZah4I:L+oQO+M+FskiTXtKNS1TPEaSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649234395, "uuid": "eb005f38-2da0-4653-9f32-9ffa20b8433e", "value": 192504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649234395, "uuid": "383be3b7-0fb9-43c6-b822-3d9d05adfe1d", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234395, "uuid": "9f91f2b3-53da-4916-b4c8-b116121151c0", "value": "Transfer06422.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f6de9d-b5c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649262135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262135, "uuid": "b4264b29-53a1-40db-a200-d2e91be4ad5d", "comment": "Malware payload (Heodo)", "value": "bcf38a2a51cf372f058752b7d8bd58ad", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262135, "uuid": "c6c41477-a2fa-4588-9dde-f76e95c44b01", "comment": "Malware payload (Heodo)", "value": "c5c70e1d9b4665d8521dce5061975ff157ce15185990abdaf9968e68c954165a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262135, "uuid": "086daec7-4635-4284-9223-1d9b2b8c271d", "comment": "Malware payload (Heodo)", "value": "30bb89461114d615b5a060d0872bed512a1d2da8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262135, "uuid": "8f88e2a5-690d-4ec8-bc22-d3f35f8b3465", "comment": "Malware payload (Heodo)", "value": "ed21656d0423033736da867b9bd45100cbfb977cf283108543f39fe260d6c3d099b7e93db233af02194f1960ccf37aa7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262135, "uuid": "7a341dfd-1cc1-4b01-96e0-afd5e33204c9", "value": "T1A0C41840B259D1F9C4CA3CF83C1A9299625D6CBC7B8960F377BE36AD6B74D70132121A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262135, "uuid": "a745c77f-9844-4948-9b52-9c8c76147bd8", "value": "463401f61c44b0d918f1e23374db995b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262135, "uuid": "5b9ac4e0-fba2-4e5a-a734-6f87e59c6106", "value": "12288:C2Y7Kg+5zhHHq9xT+oDWIGUcItvhFDuEPFJ:g2nHIxT+oDWucItvRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262135, "uuid": "6e49561f-f529-465e-99f9-9026736be438", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262135, "uuid": "0a695840-4a84-4064-8b29-93c3140e2d65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262135, "uuid": "dcd50c20-a982-4425-b8d7-28414ef34030", "value": "emotet_exe_e5_c5c70e1d9b4665d8521dce5061975ff157ce15185990abdaf9968e68c954165a_2022-04-06__162211.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf41499-b5e5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649275777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275777, "uuid": "dc1bc45f-0cc2-4938-b6da-c0fc2f3e09e5", "comment": "Malware payload (Heodo)", "value": "6167f3a4220dbc60bf748022eaabce9b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275777, "uuid": "4faba231-de30-470d-9fb4-fea2c0b01ed7", "comment": "Malware payload (Heodo)", "value": "c62ab59d32654181641b76aefdc36e0ded9b196ca65671492808853a5c46bfb6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275777, "uuid": "545b0f62-38f8-4678-af74-138153542236", "comment": "Malware payload (Heodo)", "value": "683a37c3da696b1289366fd2b732c11aaec27e72", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275777, "uuid": "0ba70e89-0729-4aad-b057-5ef50b5fffd6", "comment": "Malware payload (Heodo)", "value": "34043dfd3b93d3232f4f91efac21151c9a9162e2954f0c24066cf9de0849be3fe211159009d10f8d11d3c95e71816b92", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649275777, "uuid": "5379c01a-88dd-49d0-a7fe-f8f70cba2e15", "value": "T15ED47C0EFFD1C1B2D36B123019D5C64823ADBF2CEAA1C5B777A8BE1D69326C14512B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649275777, "uuid": "32fb3e03-6ac0-42f3-922d-37c446f5fd3d", "value": "d63ab94f4bb6b5d2f0f6092bf07e00ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649275777, "uuid": "2ddc4e35-625c-4e17-9930-f528a6e22444", "value": "6144:/6ZMFXzqfoSHr/mvcQYbi2HN8C8BgifO7y7ZcuVqrWLWN7Ypsi6Ih9vH0/oUHahE:/8MFX47ivcQMNsrDuKJjO69cI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649275777, "uuid": "65e5bbd3-7e4a-4d9f-907e-f758300d8d58", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649275777, "uuid": "d614eab8-1fa6-4d8a-a712-e1b256b588ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649275777, "uuid": "313944cf-bfee-4a4e-adcf-e2cf96fea6ec", "value": "emotet_exe_e4_c62ab59d32654181641b76aefdc36e0ded9b196ca65671492808853a5c46bfb6_2022-04-06__200932.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "049e22ab-b589-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649236063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649236063, "uuid": "ce58c622-f8b6-4714-9093-88b67adb27d3", "comment": "Malware payload", "value": "7f45a79f910666a58779725f8f914091", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649236063, "uuid": "2994439c-51b7-4de2-a924-238cb605700e", "comment": "Malware payload", "value": "c63649a429f8a13cad0f1d79dd06efecb4015f067a2abe847f60829491c4e750", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649236063, "uuid": "9cba11df-2445-4b17-970f-0484c7f44ac6", "comment": "Malware payload", "value": "d9fd800c6a363c8b8d9df277d1c0a115d04a7a1f", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649236063, "uuid": "bc99a2ec-8e27-42fa-86d0-aaf886a4ad36", "comment": "Malware payload", "value": "6850a9f476501dc386a6e8f8ed4491b8a5d0cd819100c152aa5c08eb6bb41df059ce46ff56bb9801e7a0b9370fbc0154", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649236063, "uuid": "1a314652-e7f0-42ad-bb10-62604cb2df49", "value": "T1F5012D7D56E8F8C052C7F2C0A55D36835DD95B1FD044211A318844D922783ECDDBE1BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649236063, "uuid": "167642d8-1d7b-4902-a061-57a92e5f8f00", "value": "12:095oPtVwtMjfGSHcTkO5EwkuwiGpmayKuTHR8KvucyHG231:0noFVJtsGxpmakx8KvwHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649236063, "uuid": "a9747aab-f792-486c-930f-26bc6b00bd71", "value": 745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649236063, "uuid": "e71167c2-fd51-4fb2-9fa6-0a8cb8d7d72d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649236063, "uuid": "32588155-7c7f-48ab-9aa0-f8d0e83ac4b9", "value": "PO_8016992470_Copy.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb243299-b5c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649262676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262676, "uuid": "b0540206-5d83-42f5-bfd4-2a182d62c94c", "comment": "Malware payload (Formbook)", "value": "4040b476c9e02a54f214b78293882c37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262676, "uuid": "f5022e29-5e07-45c8-b778-2a5a7770495f", "comment": "Malware payload (Formbook)", "value": "c693f2f43531ac27c22d4abe354cd66fa4014a60d1df090b22dfe5a76a97c4d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262676, "uuid": "eef35323-e023-4177-b45b-f9e6750d7d68", "comment": "Malware payload (Formbook)", "value": "c48b67cdcac808c3b8693442004df6e43fcd3582", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262676, "uuid": "46e316c5-1d3a-4a11-a473-15013016ea2f", "comment": "Malware payload (Formbook)", "value": "6367a9ea68daf9fde499deb69c1c877973b71ff7e19702bf637cded6cf599576c7f007f867a630e76e93cab7c2c8163d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262676, "uuid": "c4069eb0-7b2d-45ec-8217-238c644f26a1", "value": "T1F3B4025973ABDA12D12C4BB3D4E2244147B0DB62E592DBCA67DD11EF81137E60A82FC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262676, "uuid": "550154c7-ed9d-4336-9b58-077b5eba89da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262676, "uuid": "38678c5b-cdfd-4eea-b87c-8e6849acd064", "value": "12288:li9hM1YmhJU7ZZXbfnhDch6C4/XGBG+dMXxj24dH1jkPF:9YIU7HhohaAXMXxjXdKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262676, "uuid": "d2b95541-0e7a-492e-b9fb-023dc963a079", "value": 531968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262676, "uuid": "a495d5cc-837a-4b7c-9cff-07576a7d9220", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262676, "uuid": "7e5ddf20-4c02-4a99-b73e-10c894bb9241", "value": "4040b476c9e02a54f214b78293882c37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5667f318-b5bc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649258104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258104, "uuid": "ddd62c5c-caf1-4b4e-b930-d671dc79ef9d", "comment": "Malware payload (Loki)", "value": "b1d71a03d9b8cc266dd2f2ebc7f3bfd2", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258104, "uuid": "c25dce68-933d-48f6-9a30-84cfaad82fc0", "comment": "Malware payload (Loki)", "value": "c71d22637cb0caf4653a38b769f718f01fcd9da449679e6d40e8ad23bac40409", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258104, "uuid": "81dfbfb4-9700-410c-b4c6-ef15e7557336", "comment": "Malware payload (Loki)", "value": "542f13090e7a698d619fc75c846a4e535d91ff4f", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258104, "uuid": "11c17af6-3b21-4113-abf7-d011d0617166", "comment": "Malware payload (Loki)", "value": "14f636a4ca700dd5122d8244253f9ce275ad712972351ea84bc9b4d84eff6dadc6fbc77bc5832f3a42de09baf9185c11", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258104, "uuid": "f422e61e-acc3-4442-b9d0-76c5669b08b2", "value": "T1AF1401117D029542F2FE69F6E51A8054795BEC11D2F7F90B6C90BF1DF4390B10A8AF2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258104, "uuid": "aaf35bb5-6d5d-4b69-83a0-9aef8e01350d", "value": "3072:OpEic129+tTE+l7jUBBlCeNZxxM5dD7rJjV3CLhSMyYIyUeKhKPsI6Z7vBQxiISJ:piwu+tLMBlCegdVjVYWZyZs7Z7vCxiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649258104, "uuid": "ff732914-0b2a-4f4c-af57-13c7a22d74d1", "value": 192152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649258104, "uuid": "20925d77-49a3-44d2-89bd-5c3500258ce1", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258104, "uuid": "7ad8edb6-eba1-4a12-844d-3ef17ee1583f", "value": "specification_order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "856b9ad7-b5f3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649281806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649281806, "uuid": "8828f814-350d-4de9-baf6-b7c49d6e2794", "comment": "Malware payload (Mirai)", "value": "98709d88415dc7f8bb8f3131d84761b1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649281806, "uuid": "78544932-6546-41f9-a118-c1fe048a35df", "comment": "Malware payload (Mirai)", "value": "c7be0e27f38d06fd7b8eef5252b537f1e493fa1c3f4789a5f5c063647cded37e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649281806, "uuid": "827cdd81-3a66-41c8-a594-a11f7407bc60", "comment": "Malware payload (Mirai)", "value": "33beb3284bd71437a5af04f48ec9d69249894f8e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649281806, "uuid": "18c9f9e7-6931-4caf-a488-f001cd531896", "comment": "Malware payload (Mirai)", "value": "b5567409b2ea2a4b0d745c571fa02d4750c5c07ee9b995c4d3296a75ce1f3e81499a75ded30852e417ff019e93e53cb5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649281806, "uuid": "00ac64eb-53a6-4fc4-8eb4-2c96a0bc7c97", "value": "T114E2E130C6CF9A70DEF8117AFCF78566173B29B9A4F97324041526C5099D238587C6CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649281806, "uuid": "ab25dd80-c087-4064-92fc-625d74b19b15", "value": "768:0vXtypTOIClHvIcxGQGD5Qw5XMWfpeK1IfV+N1BK7Ls3Uozv:+0bCZIcxsQwlzXeNO1Mizv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649281806, "uuid": "75413f7a-bd2e-4765-8aaa-f66bfc6b3f96", "value": 32404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649281806, "uuid": "2c596311-284b-4a8e-9287-7baeb05ae20d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649281806, "uuid": "357117ab-6b00-4512-afda-e7166c28b25c", "value": "scorp.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55890d32-b54a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649209140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649209140, "uuid": "8cddc19e-2795-44d0-a337-484a6637937b", "comment": "Malware payload (Heodo)", "value": "9b2e0781819c1dfd835be895dd8a4bf5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649209140, "uuid": "f5e6d052-a9ec-4a40-ae4b-8bf244a682ab", "comment": "Malware payload (Heodo)", "value": "c7ea7e1731449751919a0b3d801bea82e73d01f7815357d0cb3ed3dba2827cea", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649209140, "uuid": "2d912109-eb06-4b5c-863c-a2970ffaf79b", "comment": "Malware payload (Heodo)", "value": "d4e031b31b8768ac19f6286a986461da15cada33", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649209140, "uuid": "7410d83b-b059-4e82-a4e6-dfe74b60c7c9", "comment": "Malware payload (Heodo)", "value": "18e91d283c662c3f449283351502cc11f5630be84c59dff729fd81b771c319ef36b6ddd32826071f9104de1a86df55cd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649209140, "uuid": "87649068-0423-4433-8417-214b5c5f55ae", "value": "T10405490937C380F1CBA66DB4441EC161AC26FABDD7A6013A9D4722BF96F2CD06670DB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649209140, "uuid": "86289472-919c-44c3-9312-4c399b25854c", "value": "12288:S54yMgfmmnDD3X5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:SKommDbX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649209140, "uuid": "6ca95936-f9df-4b82-ad53-0c3638cbf8d3", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649209140, "uuid": "11a17cbd-6aba-4ad3-bc69-29d7be30bcb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649209140, "uuid": "68163540-0942-445e-afdb-ed421cb39f4c", "value": "emotet_exe_e5_ac549323e35ce3f9fffa9ad9b7339f3c86df8fcc608b087c2ead2431a2149c51_2022-04-06__013851.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d15ef8bd-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278068, "uuid": "9c9e27d5-eaa6-4c5c-af55-0759125176f0", "comment": "Malware payload", "value": "858b308f49b5b6967adc7e1d80236587", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278068, "uuid": "23090887-e345-4e83-902b-8f4cef0f6dbc", "comment": "Malware payload", "value": "c815e1228b0b3c7b190cd843f5ab759bc615e303729ea99a2b040841498c9e18", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278068, "uuid": "9afbd870-a52e-4beb-acd4-204a097c25d5", "comment": "Malware payload", "value": "8993962fce35f0bb0d321749abc645b84e63336c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278068, "uuid": "c0d5aabc-c142-4f00-b663-35f480320283", "comment": "Malware payload", "value": "f558919313b1bfcba497e56bf3e38c9c0b330d11a71c96db3af22cc7313deb1375e7dab3a063f1f59cca0e7479b89a6d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278068, "uuid": "e7b98cf6-0ace-4f36-8108-12fb251d2f43", "value": "T12E41F8DB209507326DE1E923726A4C4430C2EADE25DEAF18ECDC3CFA408CE457405A93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278068, "uuid": "3a9c1ca3-6096-428a-a842-9665935344c3", "value": "24:QvStvM8X9d2Jv6pbPGbvsvqUlF9svBNImf+ksv+rvKWKxTvebvJNsvPIvebvLkvf:QvsvvYvPkvwvoJvQvh+vsvQvgvsvgvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278068, "uuid": "ea280c09-364c-477f-928b-5bdaf6da3d86", "value": 1896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278068, "uuid": "8bce9fb8-6127-44db-bd7d-204498515117", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278068, "uuid": "72ef7986-2655-45bb-9770-01f7a18706c6", "value": "c815e1228b0b3c7b190cd843f5ab759bc615e303729ea99a2b040841498c9e18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f62f1b-b566-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649221083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221083, "uuid": "aaf0bb43-c5e6-4147-a512-9fb1e9a5e668", "comment": "Malware payload", "value": "efaa0fa58ebc1a555c99f7a0e64ac564", "object_relation": "md5", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221083, "uuid": "573f4bfc-7c88-4c4a-9c73-cca089ac38e3", "comment": "Malware payload", "value": "c8372c8ac7d0958ef855df6e49b33fc89e86a450165e9f3e4fde230201fe21f3", "object_relation": "sha256", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221083, "uuid": "5b2e4546-5b83-41d4-a80f-898ca8860c92", "comment": "Malware payload", "value": "f65bf1f7d93d916e95e64640d25dedb62fe31bd0", "object_relation": "sha1", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221083, "uuid": "03432c27-4c98-46bb-89a4-96dab4b216b2", "comment": "Malware payload", "value": "ba64a5dcf66b155260144c114020bd34e268ad880e283ce4b44981f85ee709cc328613b075d9aa8cb61184599f71bb6a", "object_relation": "sha3-384", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221083, "uuid": "601b481d-a5e5-4a19-88f5-9994b8a9eb26", "value": "T16C0633C7F41DEC3615F7CF7025F6D631C0D9E2AA00D3ACB8A362A4DDB61A78940C65A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221083, "uuid": "49b9e913-461f-4023-8ead-7cd82cd3e61b", "value": "98304:bIft/PlLd4u8eZdYpIDrBBn02I/7GwWmANZIfrvLM/98k40pF:Mft/N8x2DrBB0WjGfrvG4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649221083, "uuid": "8091f1e1-d37c-4021-9af0-299f2c52b50c", "value": 3894941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649221083, "uuid": "42d6071a-faaf-4615-8611-c4b9a3d337f8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221083, "uuid": "5f44bcdd-e8e4-402d-afbe-27c4e64a13c8", "value": "PDFne z6wrm3g5a nfe693d781 .zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e70ea4-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278069, "uuid": "9ce95b86-21bc-47fd-adc0-4e5c99d7e137", "comment": "Malware payload", "value": "2db94d40ade338fc8e6885625cbdf66a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278069, "uuid": "a431b774-d814-413f-8967-642210203a27", "comment": "Malware payload", "value": "c8dbe139316203b2df2cf20cf1eb1d1c28a6c36649a6eff3ade16aa547f3c17f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278069, "uuid": "b230e750-7f73-4b47-b2b2-182fafa73b50", "comment": "Malware payload", "value": "044f7cbe0d689ab64bf82626186d5fd70167e6ae", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278069, "uuid": "9e75ab65-bea2-498c-89ab-3413ce6bbc46", "comment": "Malware payload", "value": "238f4797bde8050b21d0b2945072413b82ba6db5142a56c0b5d635eeea6f7654f9394d18dc9ef01af5bf819d8ab3557e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278069, "uuid": "51178386-9814-40a3-a0f8-390f18d30b82", "value": "T146A1E750112C1AB17246697AD26FFB52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278069, "uuid": "1e0d8caa-d81f-4ce8-b031-0d4066939453", "value": "96:8RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:8RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278069, "uuid": "48a98fff-9808-41f3-94c5-aff6676a115c", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278069, "uuid": "ed6d98ff-f9fb-43a8-9900-882d14c642aa", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278069, "uuid": "dcfd47ba-1407-4fcf-af49-67b43ae74229", "value": "c8dbe139316203b2df2cf20cf1eb1d1c28a6c36649a6eff3ade16aa547f3c17f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c900aede-b5a3-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649247559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649247559, "uuid": "d19e17d6-5577-4dfa-8006-fd0059489a21", "comment": "Malware payload (AgentTesla)", "value": "36bcc16a2841fdcaf68827b1ca8b3302", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649247559, "uuid": "94b71828-95ba-41f8-947b-2f784f14c49f", "comment": "Malware payload (AgentTesla)", "value": "c965467cabc15794c9abfc65ca12367cc8d66274682a4efedd4fc657a0a3055c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649247559, "uuid": "7a8c1106-ce57-47d2-97d9-8c34c8ca0010", "comment": "Malware payload (AgentTesla)", "value": "ba3b01280ee66c13c89bbc81072805a466501f69", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649247559, "uuid": "62bcfad4-2eaa-4c7e-9739-85777dbcb2ff", "comment": "Malware payload (AgentTesla)", "value": "79fa6f660b4d69f4437742445f445f65e54cb89c9dda7e006a1ee9466b3ebcf0d0626f20cb50f44b1a83993d8272b0dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649247559, "uuid": "0e50fa28-2623-44bf-9780-af8f76e956fd", "value": "T1A515A49D721072DFC857D4729EA81DA8FB6174BB931B4203A02716ADEE4D897CF244F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649247559, "uuid": "257e43d7-c18a-4ec0-8926-13e4547ea633", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649247559, "uuid": "bbbdbfdc-ef48-490a-92cd-2eddf7eb359d", "value": "12288:qhVwqjCfBfKjAzz1/RfB8WNOG+zoSi1GZEf52U9zyRkIUzHNermKODnrQ/TU9Ldr:qEqja17R5G6+ikGqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649247559, "uuid": "f6093a26-0b63-4d70-ad9e-fcf5045c0400", "value": 939520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649247559, "uuid": "892ce68f-f10d-4e4a-84e8-3ee85dfacbea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649247559, "uuid": "f5a6e1a6-c6a9-4d09-9cd4-1c3af6a4c543", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "716a4078-b604-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649289074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649289074, "uuid": "79b77804-2a4e-4c03-bf8c-67690ceb5cb5", "comment": "Malware payload", "value": "6fcb0ddab3602f98de6996375c055934", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649289074, "uuid": "e7d150b8-9c58-40db-88ff-6ac59cd3dfd6", "comment": "Malware payload", "value": "c9f63c35ad3b6beafec241f550bc951e7f11916ab6df3877393e2f0760f3633f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649289074, "uuid": "99cc1b24-072c-4b54-a02b-a304486834c9", "comment": "Malware payload", "value": "76204db82616497568e46db544092be4ae09f29c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649289074, "uuid": "0129cef3-9c72-4db0-8224-bc56adf9d826", "comment": "Malware payload", "value": "e955829f624cee95512dd586c91892a7be858ef82eb1377b99f9083034c03a87e37860b20fd406d41d53e4cea671ace2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649289074, "uuid": "214c6c98-5bf5-4a2b-b73b-e3851ced33ee", "value": "T1F664BE53A2648961F7144679A813C8B51C3D7F359B03762BA3E4BECF3AB0247366532E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649289074, "uuid": "2ba629a4-2945-40d1-b7a8-938d605c8829", "value": "d0c5ce494c851cb27feb52c8ea859676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649289074, "uuid": "141fef4c-999d-44bf-a7f3-876bd329f986", "value": "6144:KmEdSunAqHdroKcykhPBbiMV5xzr2fXUl9d952N:K4ujKyUp+gOcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649289074, "uuid": "693ae01c-03ad-4e3b-88d9-ee6c6986d167", "value": 323584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649289074, "uuid": "aff22752-753c-487a-b918-85a163c3025b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649289074, "uuid": "efee334b-aae7-41e9-882a-9a67eaa5cee4", "value": "c9f63c35ad3b6beafec241f550bc951e7f11916ab6df3877393e2f0760f3633f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e868968-b5a2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1649246978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246978, "uuid": "c7465c80-8abd-4151-b7d2-cc3e8e8b4c71", "comment": "Malware payload (Stop)", "value": "5747811cd798cf80691a33cd4571a44e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246978, "uuid": "68e00036-37c3-47a8-9e4f-97c383e10fe6", "comment": "Malware payload (Stop)", "value": "ca42866c2af069fe5e9ed19c79e8b4ccd960cc5384e2e557f741e9ecc57726ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246978, "uuid": "5e12a5c4-4502-4a8d-980e-0d1aef4d6ff1", "comment": "Malware payload (Stop)", "value": "3ff53ccccc3e2c333726410ec9dbae369f1147ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246978, "uuid": "2e51e453-9309-4ec0-b5b4-6737f48969c4", "comment": "Malware payload (Stop)", "value": "d216249e32657c360f89de13325d87edf89b8286764b20ecebbce062d50f653257c7a8a847c1611dfef44064133e1828", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246978, "uuid": "053222b8-f731-447e-8131-828bacd483bc", "value": "T1C9F40110ABA0C035F1B726F149BA93A8793B79F05B2494CB62D556FE4630AD4ED3134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246978, "uuid": "3dd1b00d-a142-43e5-b92a-2f505d39f773", "value": "09b7cb9e514ec032fb567c3b682f1a2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246978, "uuid": "a97c1c9b-82fa-4f0f-8bec-4f6c6c21bbe7", "value": "24576:pdcTbiY9ekO6dUY/T6+MZTlKBkugl++4P4mjBf:pdBk33T6+AZghgl++4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246978, "uuid": "fecd08f7-315e-48e8-9020-f7f285bf1413", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246978, "uuid": "2d497192-6b69-49e7-9b74-451c239898b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246978, "uuid": "0a0100ca-f8e6-4085-8d0e-5cc768ff3c96", "value": "ca42866c2af069fe5e9ed19c79e8b4ccd960cc5384e2e557f741e9ecc57726ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d267cc83-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278069, "uuid": "bcc656b8-1af4-4de7-adbd-2ab7b0c24629", "comment": "Malware payload", "value": "9ea93cd0a58ef8f78030ed5f6cb293c1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278069, "uuid": "3242a8c5-e5ac-4b63-9709-09b989aab5b8", "comment": "Malware payload", "value": "ca9af1ea2a3b44b4406ba7296dbe06d27d16e8582418fe19bce606e263f4c0ac", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278069, "uuid": "407ca635-69e4-4bd0-bdca-b09fc8d12a51", "comment": "Malware payload", "value": "88cf3cda6bdfedb21268a5a17a6dee1c5579f1f6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278069, "uuid": "557bd970-1122-4c05-84f8-35c9ae76871b", "comment": "Malware payload", "value": "f58a67ac314e35562d05dcea21969b7b3f34393e3dd4608b7f0eb0f88dfe97ef7ade1086ab3518c813682a19ee3c44b6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278069, "uuid": "641dcc7a-dcf9-4ae5-9c56-a3465a7a3fa1", "value": "T17FA1E750112C1AB17346697AD26FFB52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278069, "uuid": "6a2357d2-ff5b-4035-b6a9-6a541ba12448", "value": "96:8RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:8RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278069, "uuid": "22bfc2c4-8056-4aae-a0b5-37798568dc5a", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278069, "uuid": "2854d88e-4bc1-4635-a8c5-df4faa75c27d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278069, "uuid": "3ea46aa4-e5d6-4d1d-a510-2427a60f6a02", "value": "ca9af1ea2a3b44b4406ba7296dbe06d27d16e8582418fe19bce606e263f4c0ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2331b3a7-b5ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649257160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257160, "uuid": "e906e8f2-1f9d-4b44-95db-27f3486732a7", "comment": "Malware payload (SnakeKeylogger)", "value": "b8570798178a07852da69a0f6063c8c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257160, "uuid": "b9b64321-b450-4369-bdad-c676e2293278", "comment": "Malware payload (SnakeKeylogger)", "value": "cb17dbe8ccea9008ff815274c4288c3af751f475b67605d9117aadaf0d333997", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257160, "uuid": "f923b792-cbaf-4759-b478-171f94911c42", "comment": "Malware payload (SnakeKeylogger)", "value": "21736735674832bd6726179474402380d070c135", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257160, "uuid": "f978ef44-8992-4600-be56-86f834b37759", "comment": "Malware payload (SnakeKeylogger)", "value": "d17b99a201102648ff078125458beb43c10c136faf4fce9e3251c8a464018b9f3f344a0f31e8e6ec4c2e4ddf03a17df4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257160, "uuid": "b21514bc-0f67-4c2f-93a5-3adc74c812ee", "value": "T1A2A4120937EC6322D8BE97F3F47A444207F5B51B3551E68C9EE260DB2952B04A902FE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257160, "uuid": "09160930-98f4-4b47-ae65-144c2b7dcfd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257160, "uuid": "0130f3f0-841d-482c-aef7-24bbee0445c6", "value": "6144:mq9yP6N+deOEFByR3M+kkbkgX31VTGsqTofJPZq0nk8mOex+7e8rIsB1jErLZt:maYdRsyR3MCVnTGsTfJPIeWyEiiF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257160, "uuid": "569bb5f9-f367-4029-9373-822019f965c2", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257160, "uuid": "9baf61cc-5acc-4f5b-b705-48546dcc8901", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257160, "uuid": "08f7f2f9-840d-4bf6-b812-c5c448004662", "value": "PO#0001342.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2e95904-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278070, "uuid": "8ff467c8-d203-48a5-859a-5ca7bbf33e7c", "comment": "Malware payload", "value": "2f0093a63124a291a8c4ed924a4a1101", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278070, "uuid": "c1971e35-1ca8-46ae-bf6f-f82ceef12e4a", "comment": "Malware payload", "value": "cb3976b1c26d2890d96c83bd7bf98fa5eef3d95ed911bb331d3e36cd9639b855", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278070, "uuid": "a449f63e-b08f-48ee-96e3-139081298aa2", "comment": "Malware payload", "value": "184e4a96f464252af944baafd3293b311676d55a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278070, "uuid": "2b4fd230-8c24-4bc8-baff-24924a2a2cb6", "comment": "Malware payload", "value": "ea06242271fa0fda55d01297cbf14b3778085413121ee9f87a7cd412028cddecc974dc579399d9198828f86e6b3a95c0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278070, "uuid": "fb21ec1a-c707-4efb-92b1-3a8596b45dc1", "value": "T17FA1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278070, "uuid": "8ff7605a-86aa-4047-9ea4-0be32c4fc5f5", "value": "96:sRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:sRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278070, "uuid": "4b8540cb-e514-47ea-99d0-7b29ec331154", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278070, "uuid": "92c1c66e-24f4-4096-9bc4-c0a4a2d01281", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278070, "uuid": "0c441d15-66c7-4533-b815-4f9e5789b46e", "value": "cb3976b1c26d2890d96c83bd7bf98fa5eef3d95ed911bb331d3e36cd9639b855", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7eec254-b544-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649206755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649206755, "uuid": "c31c132f-766b-4fbf-9561-65992f76ccfa", "comment": "Malware payload (Heodo)", "value": "367d985c09e849b96d98d740fac0c617", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649206755, "uuid": "72b43b46-cf4e-4a08-988a-1144de2899ef", "comment": "Malware payload (Heodo)", "value": "cb774637797a66ba347d7751518c20cf8e311cd005482f111cd06da4a7db1743", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649206755, "uuid": "626473cb-f9e0-4324-8e16-28380fc7a87b", "comment": "Malware payload (Heodo)", "value": "a0c676c63378a2de09b68ec55a7a7827baddb90d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649206755, "uuid": "b4fdf185-50b4-4fff-af9c-5bd5f946ef94", "comment": "Malware payload (Heodo)", "value": "3c3e3b37306e45c05891cc7fa8d130ceba4b4218c709075b0743acfa50103f1b055cb1135de41847ff3cdca2f93ec210", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649206755, "uuid": "3aac409a-cab5-453f-b5d6-5a18f801ee6f", "value": "T1FB059D02F45161B9E04A05781F2733A46EEF6E519629CA279FA4F99E1E30251FC3FB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649206755, "uuid": "52f5742d-81c6-4086-9e81-51f52ed6d7e6", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649206755, "uuid": "e5fcc49a-47b7-452d-86fb-b9358c6b08b6", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5ehxS332d7t5hT/hexLxNv:Kanana8qGBGuoNxEfxCM7oN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649206755, "uuid": "cd63ab46-553c-445e-9d31-6c78f7ddc833", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649206755, "uuid": "6998b844-045b-4e1d-a529-c6e500e55b1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649206755, "uuid": "71e2c21f-fe9f-45dd-9fbe-f135c6dd1ad0", "value": "emotet_exe_e5_76a371d118c8c79f225ebbb2245d1248e280d5787e9c6ade17f0d8508af93f23_2022-04-06__005909.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5603f1f-b5bc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649258371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258371, "uuid": "f2046792-4e73-4b82-b7cc-d3babc6e29d2", "comment": "Malware payload", "value": "25b6bbb10eebea6a255bf775252d5db1", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258371, "uuid": "61aaade6-35a2-4005-a883-5c64c8018b55", "comment": "Malware payload", "value": "cbbfb438d9293b284bd6181e6ede7b2929772817736ff27aef7baa6484daeabd", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258371, "uuid": "6e4b7ef7-e736-4046-ad07-02ad12bd6584", "comment": "Malware payload", "value": "cfd333c6b42ee0adb2f0876d9da62ffeea0dab61", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258371, "uuid": "2a976410-4622-4cd7-9911-689f2ce95d40", "comment": "Malware payload", "value": "72e6d2fb4a1156f7799fd3fac6bb9bd231e68a95659fc3bce1e467b466f792d3f5e4e447c08ce5460961272e7ce46c93", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258371, "uuid": "e65552dc-f4a2-4558-bd96-8fbb4b949d57", "value": "T166D46C55BECA6EA1EFBF47BB8361D62D0226735D03A1A6CF360305993951FC2453EA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258371, "uuid": "62d391ec-7c7c-41e3-a5c9-28f5c9b9aa41", "value": "be710ba34b048ab0098050ccf62e369c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258371, "uuid": "57ea3874-ac97-4028-836d-51122a99e340", "value": "12288:70Ws7IMtR4yVld8bzbBSreD+fgFK/UqWh:70bdkX1CHcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649258371, "uuid": "54577bf9-b063-48a1-a935-61f912859daa", "value": 652288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649258371, "uuid": "f1f02fd9-f37a-48f0-afb5-67ccf633139d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258371, "uuid": "07dcdf0f-9ca3-4f62-9ce3-8314c2d816af", "value": "PO2.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e04520-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278072, "uuid": "648542b8-b567-4926-81c8-f6f363c1f4cd", "comment": "Malware payload", "value": "28f87f6936bdd93132aebe587ac76ed6", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278072, "uuid": "6781c017-0e07-4a56-a1b1-cdcc09807e7e", "comment": "Malware payload", "value": "cbdbb4a73e44d2fc8b7851833f4b8dca531c5e74f0dd09ce95e6c9b4f581f9f6", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278072, "uuid": "8626bb64-4180-4042-998c-41f8111804a0", "comment": "Malware payload", "value": "c28280cfdf94c1462037951d443ebc62b7aed016", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278072, "uuid": "2afe4887-c745-4faf-86e2-2d8d51d26658", "comment": "Malware payload", "value": "e1b593a39c02bf4c3ef83323f609352c148e5ad92ee6d4792e4147901dfe9f7e977fdb9c957291065126043f39efb789", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278072, "uuid": "1fcff590-7dda-4e2d-9557-4eaf4f40c65e", "value": "T140B533359E3BB5D780791918A54353B3AAB1BDDC1811F409F3B9EACC26CA4F5E0C2972", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278072, "uuid": "b31f4029-b391-48f3-8358-b0726c2036ce", "value": "49152:DJMych6OZaIU6M9yZ29jsE4dKi4qi7/RhQrM+mvsx562dQ10LIKR7aL4m:DJmAJI9M9yZqQEmKlqi7REM+mvb2TEKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278072, "uuid": "8204502c-e3cd-4ed5-8ecd-8664fc66b89c", "value": 2351104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278072, "uuid": "15a3f5ca-f46d-409d-a1ef-d7aab0662538", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278072, "uuid": "39aee769-7603-49f7-9a41-c687b01e4ff0", "value": "cbdbb4a73e44d2fc8b7851833f4b8dca531c5e74f0dd09ce95e6c9b4f581f9f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d508a217-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278074, "uuid": "fce5f142-0af7-431b-b19e-92db2bbcc620", "comment": "Malware payload", "value": "8857e843bb2b3082821e525a163b1bbe", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278074, "uuid": "aefeeecb-3caf-4964-a3d7-7d4b221c2b04", "comment": "Malware payload", "value": "cc002cf03f3109a51a202bc3821122a84ee0d348defd5aa080df87e29e40f5bf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278074, "uuid": "c2a52a34-17fb-4e8f-a523-d1789db1001e", "comment": "Malware payload", "value": "36c86007c85311de42fd3a064a0cf48822becc8b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278074, "uuid": "d78ba8d8-9c58-415a-b48a-ee9b660a9073", "comment": "Malware payload", "value": "69625d617ab72373c8212ab99d38ec33ecc7f72d5e3bc369d6b6c78c4af1dde934fce856f82a7e1626e64c75cf1eb6b9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278074, "uuid": "46665945-ef25-4c52-b81d-9d9928f638a0", "value": "T1E8A1F750112C1AB07246697AD26FFA52B80ECC1B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278074, "uuid": "247f5d4f-9f70-476b-af7b-e5c37dbedee7", "value": "96:8RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:8RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278074, "uuid": "fc6b50f3-f9b9-4699-8275-46201ff1ef4a", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278074, "uuid": "cdc7bdcb-8ee4-4432-ab85-8434cb938bc6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278074, "uuid": "9858b8d3-688b-44b3-a4f1-677c572f5dc5", "value": "cc002cf03f3109a51a202bc3821122a84ee0d348defd5aa080df87e29e40f5bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65944325-b5bc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649258130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258130, "uuid": "d1fa8609-e339-4b46-9dff-9e1063f119aa", "comment": "Malware payload (Formbook)", "value": "bd43c17c020283664bc755bddf799433", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258130, "uuid": "df993df1-0c32-4aca-8270-3ced4a380a0c", "comment": "Malware payload (Formbook)", "value": "cc3af13dd3a3cd3a71466939d143b88155e952d1487509c56d3d4913c5302c8d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258130, "uuid": "65fb6fb0-7ee0-44d8-ba24-7ae6196b548e", "comment": "Malware payload (Formbook)", "value": "5017027e12a1a955c65a561803c0be7277c67c2f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258130, "uuid": "8b166254-f746-4dea-99bf-ae96a3eecfeb", "comment": "Malware payload (Formbook)", "value": "bd0cc509888ba397cbef3b7853b7a463a8f7b3c77b8b5b4a22dfd56b3f0e94f696da2a996cc80fc8284b6612e95243e9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258130, "uuid": "682dd61f-7ed6-4269-a15e-142cfbac50e6", "value": "T1941412173E50D53DD241EBB4F93C548A00F6AF908FB50A0A23ADF62E887853CDA75627", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258130, "uuid": "c9607b02-7f7a-4779-8c37-274e6c085eb1", "value": "3072:+Q7QlwLCkIgwC80CkJMAT/56htuPPqj978GgQLhh9f2MHDYTOhyO3Mu3dT8gP4RO:vEim1kou3i97FBu5A3dT8bO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649258130, "uuid": "eea14e05-f21d-44f9-b4a1-85061877ca4b", "value": 192584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649258130, "uuid": "30014508-1e98-4881-b854-e3d6611753e4", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258130, "uuid": "71c222b2-11fa-4c3d-bf50-ddcad0df2fee", "value": "RFQ Check-up item CS1528240.2.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7133a5f5-b5a2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1649246983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246983, "uuid": "0221c4ae-23a6-4255-a221-33328aac0933", "comment": "Malware payload (Stop)", "value": "e6c8a5bf47683b9a274157b089a31976", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246983, "uuid": "ed77cdf4-05d8-48a8-ac71-c317df66ee1e", "comment": "Malware payload (Stop)", "value": "ccaaa623e3091c4183a5550b58df11c9492b451b0e602c7e4fd3fd49c95645c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246983, "uuid": "8ef4131e-a663-48b2-a5d0-3955219bf93e", "comment": "Malware payload (Stop)", "value": "2b1df244f2c36551a05a614fa9e5e9cc0edcd42d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246983, "uuid": "984f72d1-9a89-4be9-922c-950e2e39f4c6", "comment": "Malware payload (Stop)", "value": "0cecd420d5fcb0e1637087b4b105531c917fde69f4f9fdfb3995fce58b5877e48f419f11dbd245a5dc53d4b42db5570f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246983, "uuid": "1a7f4046-2142-4f3d-957e-ba1dd8da21eb", "value": "T1BCF41260B990F472C1660D7489A1DBE05E7ABD322971C59B336C373E6FB12F06E69206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246983, "uuid": "130719d3-ef91-4311-8d5e-15ddc8d0a814", "value": "e29fdb264def7dda465a7a289be86662", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246983, "uuid": "e3e1a9ca-cd1a-4228-8832-c74eac5689ed", "value": "12288:FVHf41W6gEoPOyPr2tCwNQiEbF80y5w6t/JVvhOYtZ+MdxEMTf+HcG2w:F+1W6g1PrQNNEB8T5wW/JVvIIzdxFT+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246983, "uuid": "490eb008-3b69-4501-96b2-b59b49138176", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246983, "uuid": "15797031-df39-4a00-a1c1-0fe3a9a98b48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246983, "uuid": "785958f2-7386-4b96-80ca-fbbd6515032c", "value": "ccaaa623e3091c4183a5550b58df11c9492b451b0e602c7e4fd3fd49c95645c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e057b779-b5c7-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649263060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649263060, "uuid": "51d53c4d-6d9a-436e-b978-d071a913c01a", "comment": "Malware payload", "value": "90650bd59d65af3b3cc34b318b68dd9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649263060, "uuid": "4c987aaa-3470-4e30-9699-371547dcad74", "comment": "Malware payload", "value": "cd197cd5e1dfc36ee9b6c148fdf19ae215faa6c3707045909c41b3ac8d28e673", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649263060, "uuid": "ce6e7dd2-3677-4990-aee0-bf681bf735c1", "comment": "Malware payload", "value": "a4042d9bb65c98c6476f03f4bca45b568c3f0317", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649263060, "uuid": "5ddb57fe-479b-4c33-88e6-a2bdf8aec8f1", "comment": "Malware payload", "value": "8b2023add432be805094d28b2d025c10f6274470b22fe084b962f17cb3be238fcd8f6570cb6bda4b517465d150c5db48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649263060, "uuid": "8f6d78ea-e93f-4212-bba5-0fafcef23e33", "value": "T1349412C2E73E188ECD78DA78002BC97143138D76E9D3875AD9CE7DA37911B026526793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649263060, "uuid": "a54b6c04-dbb6-45b7-84db-82f0d178a4cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649263060, "uuid": "adae1a86-b93b-4bed-8fe7-9a4678e349b2", "value": "6144:yHGorP29GdtDb1AOVT/Hhtu0QFYqK6elweBNPZLA8HBfIVhrdRCV4:Vv9mDZAwTr9QFe115w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649263060, "uuid": "70f9cf79-5148-48a4-a24a-15c6b8a5c4cf", "value": 444416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649263060, "uuid": "10e22f50-cd34-4c62-9bee-e288bceabe99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649263060, "uuid": "ab0bb0f0-9022-452f-b6b1-34941c1d22d6", "value": "90650bd59d65af3b3cc34b318b68dd9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d581b5e2-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278075, "uuid": "40946787-20db-4d17-b5ab-23028fdce56b", "comment": "Malware payload", "value": "c8b2b79d9139b9bc38f24ff154e4f6a9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278075, "uuid": "93e6387f-d3dd-4779-b093-183d7c95a961", "comment": "Malware payload", "value": "cd31d6b6382e7b72fa4494019c91320e3f048ec1fb0249b77d980e5853d33069", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278075, "uuid": "47b3f472-ed6e-4884-a7c0-6f882ee997d1", "comment": "Malware payload", "value": "5611f8b69c70764e3f34f9bcbf4b2264feb28645", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278075, "uuid": "bfdc27c6-da28-45e9-ab69-069611163ac6", "comment": "Malware payload", "value": "c98f4d885bc66a67ed23c528b539e0a07cb8ad0a967237179d4a3cbaab7d6fa5d530bdbc8269fb7282a0be48971b9bfa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278075, "uuid": "4fa182e7-a40b-47f7-812d-b9923bdd20b1", "value": "T1B5A1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278075, "uuid": "f70baa7d-3ff8-4797-87bf-c407df4ec473", "value": "96:pRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:pRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278075, "uuid": "f16de23f-9773-4be6-a57d-f9721cd641a1", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278075, "uuid": "2657dd12-95fd-44db-8ffb-771212a58d2a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278075, "uuid": "53589310-52e7-434f-8604-00f4cc95db2e", "value": "cd31d6b6382e7b72fa4494019c91320e3f048ec1fb0249b77d980e5853d33069", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5f47242-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278075, "uuid": "1ff27599-4d98-44ee-a669-e5cd90aa7c53", "comment": "Malware payload", "value": "3e266b755792eba47056ea5a7cdc13a9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278075, "uuid": "ad4f38dc-b113-4c5e-a5f1-c119f6d926cc", "comment": "Malware payload", "value": "cdd4dd6ae07ec0b342e98616b281ebd7e1c59dfd7c083ef45b9c6d6ba097a2af", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278075, "uuid": "79d45674-5d55-43d2-b560-8c99ccbe6644", "comment": "Malware payload", "value": "0a81bbe283934ad47f75b45b5fa5df697629ff55", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278075, "uuid": "0f9972f6-1afe-4819-a3f6-2cc6698d33e8", "comment": "Malware payload", "value": "aab6ed74a4e274779d215924d20112045d31daf918593f5a0336479a5b0356ddb88ad5ace5ab9e29bb36df0f2cc3a48d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278075, "uuid": "330bf062-95ed-4066-ac39-cbeb1c40d35a", "value": "T12DA1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0796C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278075, "uuid": "0cdd158e-2022-448a-8c91-280835763b47", "value": "96:MRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:MRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278075, "uuid": "4ec93be9-37fe-406f-80fc-c7d7715b9544", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278075, "uuid": "77be8e0f-38a3-4bc7-ac82-295c5d85ea7c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278075, "uuid": "712dec4c-2773-494f-a9c9-ef1ee541a9de", "value": "cdd4dd6ae07ec0b342e98616b281ebd7e1c59dfd7c083ef45b9c6d6ba097a2af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5fcf52-b5bc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649258066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258066, "uuid": "fa667c10-fb54-4537-9d9f-5fc89dabcb56", "comment": "Malware payload (Loki)", "value": "d34d1614c196e41de3178643e0986733", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258066, "uuid": "ca136293-6658-40ec-a15e-e0fb748836c1", "comment": "Malware payload (Loki)", "value": "ce4f4562d687ae91448c8f66aeb1b0b2f751f45c8f8e688116048a1fa4e8f27b", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258066, "uuid": "16cbd1cf-e75b-4264-a910-d7aff205d7ea", "comment": "Malware payload (Loki)", "value": "e05dd1a2948b9555c2c6fc9e2f6f8a0ee4899a52", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258066, "uuid": "28d78df2-3eb5-446a-9498-ac57f9f496ad", "comment": "Malware payload (Loki)", "value": "0f5580391ce8fbd4f892a0d278722ad00d175418840c1ec0780f544f88d339900dc239677a801606018dbfef363e8650", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258066, "uuid": "41c7d95b-5518-432e-99f2-4d11c9ebd8e6", "value": "T18E1412EA22A3C2CDC290D1F1DB319BEA48239DD5B710956D3E06796FDA742D701B38C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258066, "uuid": "e0613ba9-c648-4240-990e-0129ab283785", "value": "3072:H0r3wgqYFAYIffwM0Gely82U6FpIkquPKraAJoS2q6zrk51JhlVyFvuBh4FsjI:/gqYnIX9KT56rhJKraWv2XPSPS0ksk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649258066, "uuid": "b6154a74-401c-4372-838b-d2203d72b6a3", "value": 192376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649258066, "uuid": "87c4723e-ef39-4218-8a3b-f1f8bd4108f3", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258066, "uuid": "4fce4909-b24a-416b-9962-c6859659fdb8", "value": "MV ECOATLANTIC TC.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b54c86f-b59c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649244449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649244449, "uuid": "c6b7c3ac-9b60-4710-b216-7319842e7666", "comment": "Malware payload (Formbook)", "value": "1057ee339600a4357ff93bf8121e4fa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649244449, "uuid": "699fee34-6698-49b8-8cb5-1bfc1ac0d692", "comment": "Malware payload (Formbook)", "value": "cfeedd9d4e2229b624972a48f3e2c61f9a66905e09c95a77088e44b513da721d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649244449, "uuid": "cc9e9630-17a1-486c-8815-27300215eeae", "comment": "Malware payload (Formbook)", "value": "7070de42500ece135ddf864ccfab4fce378763ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649244449, "uuid": "0e98fe14-65dd-48bd-b755-c66d00597470", "comment": "Malware payload (Formbook)", "value": "1090b2a6dc2dd0fc19bd9013eb487deb097b64b67ec9d56fa66836c2a55996ef975b221270241ac593d923398255533e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649244449, "uuid": "5474c0de-0118-4bf0-a89b-89e7f938b294", "value": "T11213D65A7891961DC5E47BF86DB1918266367CE10124C18FECFD7F2AAE32213DCC226D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649244449, "uuid": "ae708d73-a261-4741-932a-2468ffec28ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649244449, "uuid": "1cabf67a-df60-497b-aa7d-673efd33284d", "value": "384:VaPqsdTYcbHrbQ6ulaiJMwCKTH2S3dd0hUADkaPrtaM0:Va4KPml7MwCKt3deVDZrtaM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649244449, "uuid": "9e9b88b6-2568-40e2-a576-bf1b22e12c05", "value": 41472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649244449, "uuid": "65dc484a-e4b4-4042-b450-d45f18fb363b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649244449, "uuid": "b0522b5c-3d3f-45ae-be3c-9c72a0aee6ca", "value": "SKM_C3350191107102300.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d67bf220-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278076, "uuid": "a595e1d5-03ea-4f32-a445-b55c0be83598", "comment": "Malware payload", "value": "58f9093b5a3e498b34354afb19cf080c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278076, "uuid": "ed732d61-07dc-448e-9890-3c196ad850e2", "comment": "Malware payload", "value": "cff274f108e17e042b22d60b3630f3423c07d40302640448f8a4c4343cb60b86", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278076, "uuid": "f083a73b-b775-43b1-a6d8-c71ef705651e", "comment": "Malware payload", "value": "2c8eb6f51c4cf038092f7a3664681ef76adfc2da", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278076, "uuid": "a9fe0c1c-c6cd-4c26-bfbe-b05bf5c0621f", "comment": "Malware payload", "value": "855a06cbb5436cee0934cd08d0a99ff4e47b5c5bc54ef77dd87ace98d241069f4a93e306d3580f6253e85ae722634e24", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278076, "uuid": "33587e7c-e7e6-4c15-a747-871b687491a3", "value": "T1E8415ED5129109B62EE6D93271B60054E8E051B12EE47EC9D0EC34F7F68CDC875A0B7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278076, "uuid": "8dd1bcdd-c5a4-4d31-981a-21c71a3f26f6", "value": "48:vKNhpXENhpXeKNhpXpNhpXPoKNhpXaxNhpX+KNhpXhONhpXhVZ0hKNhpXh5NhpX1:vKVXEVXeKVXpVXQKVX8VX+KVXcVX+hKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278076, "uuid": "4205928a-1ef2-415e-9ad6-49de00f6bfbe", "value": 2083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278076, "uuid": "031ec8f1-a7b5-46ca-8951-eb60a28ccd00", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278076, "uuid": "c3de2afb-f49d-4abf-947d-37925bcf115c", "value": "cff274f108e17e042b22d60b3630f3423c07d40302640448f8a4c4343cb60b86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475a43fb-b5a1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1649246483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246483, "uuid": "4d40bec9-d388-4833-a354-69c3ee5a3dae", "comment": "Malware payload (AveMariaRAT)", "value": "342924c0e21fcbd7f1d220bb292ce85a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246483, "uuid": "e41e5f2b-9970-47c1-8183-572f312940ef", "comment": "Malware payload (AveMariaRAT)", "value": "cffa78d71a2624c555196f08c852019df207fcae373847b1586a3142713b81a8", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246483, "uuid": "2e77f2ef-c61f-4f2b-8be1-7a0c3ea347c3", "comment": "Malware payload (AveMariaRAT)", "value": "009b97c2172d13796d5d1097bce66044fd276514", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246483, "uuid": "d67a7f5f-9076-4ca5-b769-417316fad437", "comment": "Malware payload (AveMariaRAT)", "value": "c127d67e85348e5abf47e0f50f35d1d8a7b7859afb27bd0cf3dedd86cb8d1efe8a13bf517352c14d829160e79eb70913", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246483, "uuid": "2889ab80-75a9-4366-a013-a2ea663230c6", "value": "T11F94120117E82321D8ADABF7E43654D00BBC752B39E2E3DC4ED652EE69523509602FCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246483, "uuid": "386648f8-4e17-4a2e-9212-c4e1b1c4c6d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246483, "uuid": "52f0ee34-6bd9-4b32-884c-51a78efb2e9e", "value": "6144:T4HG8XtBWiX/a0kfs2hm1jqE8CBKRnwx95nJp9kGxo8jHVkHe6zc2MGn9VE4QAM2:Tq9BpkfctqE7URwx9VEeNWnxrVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246483, "uuid": "bbe03d03-4a49-4a80-8c7d-791a0252ff8e", "value": 444416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246483, "uuid": "6260960f-49e1-42e2-b37a-c9259e8ef9ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246483, "uuid": "f32f6172-5dee-4aba-9dcd-8c1d103891a9", "value": "New Order#IRQ2107799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "095ee361-b586-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649234782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234782, "uuid": "0169a1ee-b0b1-4141-ab1b-0bc898781c63", "comment": "Malware payload", "value": "0b34a9eab544a98af8894b996f72015e", "object_relation": "md5", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234782, "uuid": "fb609aa5-05ef-46ab-baec-f1f33dfabc89", "comment": "Malware payload", "value": "d00f736a98a6a8c06eb876cf315332de26d43ec753eedb3aca827fa1d1162c20", "object_relation": "sha256", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234782, "uuid": "e88fecea-d68a-4595-9aef-308ef4aea919", "comment": "Malware payload", "value": "fb7029cc607c1eba22e41053cca72bbc26352856", "object_relation": "sha1", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234782, "uuid": "b1ccd847-ba6a-41f3-b8c9-5a2e95639e11", "comment": "Malware payload", "value": "9c92385a69ecbd0720b78bf41f28794993ac7d9d2bf01cb60b8a11786ca42da4db3aab1c831dbd3c09ab361f9b22fc14", "object_relation": "sha3-384", "Tag": [ { "name": "batloader", "colour": "#CE8AC6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234782, "uuid": "b3de6c56-720e-4d65-b878-b56e8f0e5172", "value": "T13F442308F7FEE00683F58DAC24B941DE2A00624F71F8F4D7D1573A79BAA972932C6419", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234782, "uuid": "ae3b757a-8e18-4c53-acd4-0eb352a0b732", "value": "6144:XcTw5aia0DxEu0AJKQxaVeZxdFFwHG8sWJVJenn:XKhia0JNKezdFF58skJgn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649234782, "uuid": "d1ec63a3-3759-4f81-945f-eb19b4adde30", "value": 254080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649234782, "uuid": "47e7d0d4-7e8f-4723-9636-e23b107e4df4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234782, "uuid": "e3f03a2d-9c3b-4f77-ad9d-b29c73935b98", "value": "6ba4565e-64c6-4fd9-52d1-fec2cad4d889.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ce5544-b585-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649234451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234451, "uuid": "d74bff5d-e149-4578-95dc-2e881cada5ac", "comment": "Malware payload", "value": "bc1cdf9afafe2c4eb222db2a0de32356", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234451, "uuid": "33fe137f-fb35-4c99-8d34-22e3c958e7a3", "comment": "Malware payload", "value": "d0d3cca15cc3242605c1242e229d8e06727175c6839f1f39338d57a115ee5807", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234451, "uuid": "f57c8f9b-2e2d-4ea4-b02f-895508345beb", "comment": "Malware payload", "value": "4fe5d083d84be8a5e3d83961880d6cd86980f8b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234451, "uuid": "20445d9b-2411-4b54-b1c4-c8bb51de4b39", "comment": "Malware payload", "value": "3df838be4887db46be52670f80c8360a05bad60630c24b9c9300fadedca312222744d75ffa648d90b7f9a1fc43a6036d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234451, "uuid": "18098787-a93a-4ab2-ad1e-023cdf2af39e", "value": "T106040228B2E4C43FE16B0B748F3D57A79AFAD61900E44B1F43509F9A7A332D2991D712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234451, "uuid": "b823bd72-f09b-48ad-9622-383a323806a1", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234451, "uuid": "61d084cf-596e-43e4-9ee1-878d36843baf", "value": "3072:l1NjcVVnLpPunb6FxUNfZEEE/k3heF5omzh/kuohviW4E3h1i5ST15sBn:HNeZmbtuMEFClci37iE3sV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649234451, "uuid": "294881a4-e2bc-4f52-bad4-a7d54597b9ba", "value": 183349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649234451, "uuid": "7fa0c938-b23d-43df-b9f0-c8467dc2195b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234451, "uuid": "befbb833-f42d-4284-aaab-db067d28c898", "value": "SecuriteInfo.com.Trojan.NSISX.Spy.Gen.1.2679.24792", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c35e30a-b544-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649206682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649206682, "uuid": "69bcf00c-1b15-459e-9a3c-acc3e8a8ed7b", "comment": "Malware payload (Heodo)", "value": "2ba380df5bcaa52a8a93aecacef443b9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649206682, "uuid": "0769030d-887a-47df-90f1-7bd6f270aacc", "comment": "Malware payload (Heodo)", "value": "d0d45fa4b9347bfdab6bf3a16b722d684adbd6db56114e07556cb42aff579955", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649206682, "uuid": "112bbae5-20b9-4c4f-a4d0-1e64c7380304", "comment": "Malware payload (Heodo)", "value": "86e976347cd075237beda97947d391fb70d4c7ec", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649206682, "uuid": "8a1ce0dd-01f9-46ee-85d9-bd1162f7484f", "comment": "Malware payload (Heodo)", "value": "c53c3fabea46042438aa39510da05548904d6bba6095cf6f1f0afb90b83f037b2f86bb37a8ea989a251d7d4192ac7ce6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649206682, "uuid": "ee772ded-4685-4fb1-b332-a7d22b8a702e", "value": "T12AD4BFD87290C232DE7B6B798522C2A05E6D7CE06AB0DF4B2E447A7D6F31D44C8197C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649206682, "uuid": "4c7b7d36-3f52-40ca-9867-86346341ef34", "value": "6eb736b73a786957562fd323f3abbe25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649206682, "uuid": "2ff55310-cd3d-4840-9e47-bbd7c88567bb", "value": "6144:XbfQnyfAdoAuYqMPkZEeZ7fYX3WVpLQF5DTj7Ypsi6Ih9vH0/oUHahDcI0:XoynYqMPkZvIsLQFx+JjO69cI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649206682, "uuid": "27539e22-4a8a-4be7-8009-61d58cabc7c0", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649206682, "uuid": "e308ba4d-235e-460d-ae22-c8d6e2614a8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649206682, "uuid": "9562cf96-2acc-4af0-adfc-48cc2af4b078", "value": "emotet_exe_e4_ae6b20d0d70a48683c6fc0478de0e318edc981e4d838defe090431b769a0fb59_2022-04-06__005755.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4280950-b58d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649238049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649238049, "uuid": "2fd9b0de-41f1-4074-8ec3-78bd323ad8d6", "comment": "Malware payload (Mirai)", "value": "81431c421d887dfc1b2e00b469909789", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649238049, "uuid": "97fbb3b6-7f34-4411-9092-37a46be0f9b0", "comment": "Malware payload (Mirai)", "value": "d0d7e37bd38f5331b4696e988253364753087bb8803374ab317bae992c84f5a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649238049, "uuid": "84a10bab-4d34-41c4-99dc-7a743b1a2422", "comment": "Malware payload (Mirai)", "value": "05d5eb1eba429501b6d380dd0b5959d4781e63c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649238049, "uuid": "ec7c50ca-0d99-4ba0-b979-97156e18e195", "comment": "Malware payload (Mirai)", "value": "d470344a562c83249a4c2ccfcd8c45deb4562076bd8a25b9d0d28d362907f49aa1548209e27aa32df342fd80bc6ff62c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649238049, "uuid": "aa4cc8c9-f23d-4b42-beba-888c85259543", "value": "T10EF32B46A6805B23C0D71B76FAAF02453323DB94D3DB730659286FB43F8765E0D57A0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649238049, "uuid": "0cfd5a53-1ed9-41a4-ab7c-ee4b346a9bd0", "value": "3072:LfSdAKJYQr7eoaIibcRMT+NlSnM7SMpIWVWsIaM/9lNtqimXcbg13V:LadrYQWoaIibcRMTKAMVzVWshM/9lDm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649238049, "uuid": "9a442210-b594-492c-9626-ce5450dbbc54", "value": 168983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649238049, "uuid": "77dc7dd0-cd11-4063-82aa-87c23cd2b9cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649238049, "uuid": "dd2fbc2f-fcda-455d-b9d1-87185d24ff14", "value": "garm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0480123-b5c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1649262550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262550, "uuid": "ac37acc8-803f-40c2-af9a-c39701cef8d3", "comment": "Malware payload (NanoCore)", "value": "08de95692eaf98ddd417248d7f2ebe7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262550, "uuid": "725a0dab-998f-4fba-b5cb-aded47ea8221", "comment": "Malware payload (NanoCore)", "value": "d1c68d1d33e8dcbf7912941322f2f26112764fcd2f36e0383949ff2d12cd4ac0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262550, "uuid": "d79a5944-c0d0-4091-b69d-f22aafdb4ac1", "comment": "Malware payload (NanoCore)", "value": "f757f7b9fbbdbcc14641bffb91c2ac0a3f58dfff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262550, "uuid": "c14892e8-0cd2-4360-926a-1d9b9afa916a", "comment": "Malware payload (NanoCore)", "value": "69ca3271369566dc6595be547822e12d5e4062dddb5587c1b9a3c65c4e1a6e1e3458419c349f5c83c08017d025db4344", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262550, "uuid": "e868ad39-192c-4271-b8f0-aa68f9b7f82a", "value": "T1DCF4C0823244DC9AE44729F258AFC56051B87D9F9164C60D3B83FB2BA5E7342345BB8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262550, "uuid": "0536f794-4bb6-4833-a34b-86ab6ab2a22c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262550, "uuid": "70d228e6-744b-441c-9e4b-5653594e09d3", "value": "12288:wp/uUYcVa2JUc5vNrs2jfdcPgEkF9GQ8oGnSBrFZSityjK:4fa2JUclNrs2xcYFE3okSBXdH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262550, "uuid": "6d5f99d0-b5e7-41db-adfc-01dfd1431d9a", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262550, "uuid": "fefe2fe8-c2aa-4d9b-a4fc-c8f5bb6a63b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262550, "uuid": "b7a1fd4a-1144-46e0-8295-7c9401bc774b", "value": "08de95692eaf98ddd417248d7f2ebe7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5254cc6d-b5e8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649276995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276995, "uuid": "b1353993-969e-41f8-91f0-c0cc321fc114", "comment": "Malware payload (Mirai)", "value": "fb49be070db02f51e73717a7c250ce50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276995, "uuid": "1ac31580-397c-4f38-89d5-389056a670dc", "comment": "Malware payload (Mirai)", "value": "d2337db0958b58ba9fcb98979dc92a6a6bfbdaa031d0ddf9bfbb9ef7304f1eca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276995, "uuid": "326c6225-80c7-41c1-8965-4c63e93a5b94", "comment": "Malware payload (Mirai)", "value": "1529c6f6f67ef6b0922541962517a7a8dbe72fdc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276995, "uuid": "b61eef66-8b79-4e88-8aae-3fa51465b264", "comment": "Malware payload (Mirai)", "value": "513e1aba1ee1ee1fd237f9e56157a3ead4047558be8424ffac1f615efd752a43cbfd577f98fad5248b40f0f23f759478", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276995, "uuid": "01ba7628-c68a-4a05-b105-2dd9071e996a", "value": "T1ACC2D02E330244D9FD5586701B7817487A221562BE43EC13678BFAC3EE8B5FAB9068D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276995, "uuid": "91656ef5-e54b-4fd8-a081-314f1c13554a", "value": "768:AMLqzcIV/LLwl9eaVT5R4iXNjm43dFJgGlzDpbuR1Jmr2:43VXmeaVdiiXNhVJur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649276995, "uuid": "fa663ba4-c812-4ba6-aa7c-ad8c8b5dd183", "value": 26236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649276995, "uuid": "aaf48ff6-5fcf-4d26-bf74-bfca5ae1d073", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276995, "uuid": "c135ea93-2eb7-4ea0-af70-d20345256891", "value": "fb49be070db02f51e73717a7c250ce50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba26c7d-b5b9-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649256959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256959, "uuid": "da140fe8-036d-4a0b-bd8c-c4433a5d08a5", "comment": "Malware payload (SnakeKeylogger)", "value": "fb26a2e2c30c629aa8cab8d347129c9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256959, "uuid": "82961b0c-5575-41d8-8f8a-d3ae36ff8524", "comment": "Malware payload (SnakeKeylogger)", "value": "d259384b3d9c4876d789031f4402f60f13db250484de111654158939a06769ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256959, "uuid": "348001b0-ed3d-4716-a563-22287260034e", "comment": "Malware payload (SnakeKeylogger)", "value": "17695b2da5a2a234a05b079e246c80566918204c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256959, "uuid": "0eb03675-0ad0-403f-90a1-8175012e296c", "comment": "Malware payload (SnakeKeylogger)", "value": "ef708ba9d0c86ecafb38d58a38f5100032be4b8f8cbe7e3ee210fa47759f5b8dd8d848fd4057dcb84e99e6df4344e887", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256959, "uuid": "9d82d944-5a3b-48e8-a346-3cbe348b6350", "value": "T1B4A41245BB6BDE1BD16CA6B3E1E205154370AA13F4A3D74A2FCD16EE0A673E10A417C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256959, "uuid": "c0bb631f-3690-4f28-8eb2-badbb56e1011", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256959, "uuid": "5ff7fc35-2b9c-4dac-b5d4-d6c208682e99", "value": "12288:zdDM3y6C2GIYMKNvzQ5iOPNm07NMHQ9ytwLf5gF:zayJ2GxNv05iOFm07SHFwLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649256959, "uuid": "4fd4a287-66d4-40a4-adfe-c66247353e5d", "value": 473088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649256959, "uuid": "8165180d-1612-4450-9e31-b091b02589bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256959, "uuid": "abea3d7a-0b7b-43f5-9e53-013678886f09", "value": "Product Portfolio.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d702cfd8-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278077, "uuid": "8df32bca-0059-40ac-820c-14b127a0f806", "comment": "Malware payload", "value": "c87e41a6a375ee4e251272c45bf235c4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278077, "uuid": "96f06313-5eef-4c38-b906-87d41cb29a54", "comment": "Malware payload", "value": "d2a704bff4eba80918f304d791eef6a9dd1252886e7b75c540f003fba53afde8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278077, "uuid": "ee93195f-e127-4d02-b21e-1c61b18255a2", "comment": "Malware payload", "value": "07a4c7938e29c78946ff1c85b184a59b1d252038", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278077, "uuid": "78c5d14b-8006-4b6a-a573-3ca5a6fafeb1", "comment": "Malware payload", "value": "9831948e83b77c51023a2083a7769c28298b82e217688e98b6551c88c01118323b6edf323e631a8cb3ec1322fde767f4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278077, "uuid": "fbf1457a-8b9e-4cd2-bfa0-c3ae680c2daf", "value": "T177A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278077, "uuid": "70c3ca44-92a2-45da-a579-08606a33c652", "value": "96:hRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:hRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278077, "uuid": "2c99455e-7859-4ac2-8cc9-f4a2dd3cb438", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278077, "uuid": "a6a24ce3-5a5a-414e-9ea0-cae381722504", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278077, "uuid": "0ac33f44-6022-48c5-89f8-4d391b8115a9", "value": "d2a704bff4eba80918f304d791eef6a9dd1252886e7b75c540f003fba53afde8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d78895a7-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278078, "uuid": "415df83b-23c9-4c2c-9c78-bbd629688e61", "comment": "Malware payload", "value": "b556c325f4ef3d6501d7df782b960a0b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278078, "uuid": "e065733b-a1d1-409d-b634-439a78e8428a", "comment": "Malware payload", "value": "d3b91063b8636a63d1e02e06d2f2d730e73c5489f0ef1ff68774f2259d8a393a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278078, "uuid": "1731bb98-c0e0-4b06-8df3-5b83fe801857", "comment": "Malware payload", "value": "48f3f06ea27be45474f84c1aa9131af776e7be10", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278078, "uuid": "ed2a6056-9c9c-411e-9a84-ec816d67ed84", "comment": "Malware payload", "value": "cca1e85f11eb3f8428f06c514cf864f02587a2e887b5538aa16344cc01ed7d1078529cbb159f8eaee41b4ce26d7d124f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278078, "uuid": "2fdc1bdf-8e9e-45eb-b213-a7f512f85872", "value": "T109A1F850112C1AB07246697AD26FFA52B40ECC1B0A777B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278078, "uuid": "24c809e8-1da8-47cf-b439-6242d9ad6dd8", "value": "96:RRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:RRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278078, "uuid": "43f374e7-faf2-401b-9d70-29b677f70a40", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278078, "uuid": "469c7e14-106f-4939-8778-e90bcec1e79f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278078, "uuid": "13c3fab3-c7bc-46c0-b77f-6ddde26fc3ac", "value": "d3b91063b8636a63d1e02e06d2f2d730e73c5489f0ef1ff68774f2259d8a393a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf1a6d66-b5b0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1649253126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253126, "uuid": "fea8a3c1-9b0b-471a-85ab-d1159837d0fc", "comment": "Malware payload (Quakbot)", "value": "173640a202bbfb25185ba0489bde6f1a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253126, "uuid": "c2db0b49-471f-44af-8c88-9332b353fbb5", "comment": "Malware payload (Quakbot)", "value": "d3dabe40e693eb8ce767ab55d081e14e1ff2fef05879c387a4165210ea59ba74", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253126, "uuid": "c94704eb-3eea-46ef-b7cb-8fa255cfd5e8", "comment": "Malware payload (Quakbot)", "value": "01b20406c95773bd3ccb2122b704cbd3d8ad04f4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649253126, "uuid": "cb4189fc-e1f9-4932-8ba6-a625eaa5cfd8", "comment": "Malware payload (Quakbot)", "value": "3c5e7fadfe046517eff59496ff2a028057be4dad698c0494ba665e0e02c33b6930cf6f307576504d8e7cb770b53f38d2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama174", "colour": "#ADEA5B", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253126, "uuid": "6b07a36a-711f-4e83-aaf5-5119729b2f67", "value": "T1C965AFBC75046CDAE66F06BBDD96ACDD13B6262299C794CD8075B7C309A3372EE02C05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253126, "uuid": "1ab7de50-3090-4d10-8b30-f4e5f59da34a", "value": "1538717eb64bec210d6f84c7331143bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253126, "uuid": "2ad0d061-d689-4997-a51a-d6711db5fa70", "value": "24576:Uc3YrrLEaF0tTHMjuX5PmnKUz3NL3BAYJWDJnh+idFsv3YgPmHFEJ:UZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649253126, "uuid": "64aac241-643f-490b-969c-b30e986a090c", "value": 1427464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649253126, "uuid": "5dc87a49-18b8-4647-9cd8-48f213799f25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649253126, "uuid": "14860e18-4706-442e-8ab5-a952cbbda478", "value": "0x0002000000015585-272.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d86f7659-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278079, "uuid": "45cbf517-0fe9-4e19-9e31-6babc5fafef6", "comment": "Malware payload", "value": "02ae3df4bc20d4f61b6553f2294f4d27", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278079, "uuid": "001e8b40-7faa-4442-8d9a-ac3db5e84ea2", "comment": "Malware payload", "value": "d608426ff6a3967a41581f13b8e981d3eca0a9acd540053ff3cf8ba290cbbf6e", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278079, "uuid": "98bb68cc-d8ae-467f-99c5-40da8d519341", "comment": "Malware payload", "value": "411a5131545b5ca24261e9d25a7da5a5fb6c74b2", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278079, "uuid": "4081a6cc-dac3-4e54-a8f8-cce27cce0d31", "comment": "Malware payload", "value": "69b6d6645f15ac0206e7985eddc3017c5fe60971082fc05f26d70aedb6b5f0f985f031f94f3af9ed504fb578485a62f6", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278079, "uuid": "a9aea7e1-5cb8-4f1b-978c-f5ab8d275098", "value": "T1F7B533359E3BB6C7807D1918655347B39AB1EDEC1812F409F3B59ACC218A4F5E4C2DB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278079, "uuid": "2c983eec-e632-446c-a2dd-dc0320fba5e2", "value": "49152:DJMych6OZaIU6M9yZ29jsE4dKi4qi7/RhQrM+mvsx562dQ10LIKR7aL4gxQL:DJmAJI9M9yZqQEmKlqi7REM+mvb2TEKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278079, "uuid": "76073692-6ba8-42b3-8c51-4690e3bb5c0e", "value": 2453504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278079, "uuid": "d18f4286-012e-43c5-ab24-a92707fe18d6", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278079, "uuid": "7d586288-d53d-4862-ac71-4b4c5997f168", "value": "d608426ff6a3967a41581f13b8e981d3eca0a9acd540053ff3cf8ba290cbbf6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54da547e-b5e8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649277000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277000, "uuid": "c0cf1778-aadf-4222-ac75-dfe2dd8c5681", "comment": "Malware payload (Mirai)", "value": "cf038bfde8eb1d05d4e154e33c4c3179", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277000, "uuid": "a26b429d-3277-4626-b28f-e6966f172b32", "comment": "Malware payload (Mirai)", "value": "d638c43785bde6325b2d0d502ceac783b787a8a1a630fdd5c2d5ec77175cf2ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277000, "uuid": "7b6e94c8-0f73-4b18-b601-9915161acc99", "comment": "Malware payload (Mirai)", "value": "92caf3e4d5c4b44007f88088d1c48a56c5bdba8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649277000, "uuid": "5fadba92-3f71-49ec-adac-cead4db22421", "comment": "Malware payload (Mirai)", "value": "c720bed444a95bad5a2cd126a203cb620fd4246ebcf2c2c25fbd92251a604b66f2de022ba733d7f083fd96ac599523ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277000, "uuid": "f8e78761-7ae6-4a7e-8569-b7788bf88b70", "value": "T1AFA2D0EC929846F2D0661475BEB4064327A32FBEF2E832BF315515A4D3C25B9CAE14C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277000, "uuid": "0a618432-14d2-4fd3-9671-41bcff582dbc", "value": "384:XaRugoCxL2z6QZj7AmYIC65l7vt3TbA7/QgizNoRQcUwhymdGUop5hXf:KRuTw2GQZHAZ0tLnhSvs3UozJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649277000, "uuid": "5b8f8c84-bf25-40d9-bfba-84a9a8fad4da", "value": 22212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649277000, "uuid": "d32e4bc2-62ea-482b-aa43-0b71804eba0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649277000, "uuid": "b4f1799b-6496-4c5a-9edd-cf3abc4467cb", "value": "cf038bfde8eb1d05d4e154e33c4c3179", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39dfbca7-b5c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649262352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262352, "uuid": "5ed995c7-697c-4431-896a-dcbc6e802897", "comment": "Malware payload (Loki)", "value": "e310d720d6ea9ef7e6fb0920772f3eef", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262352, "uuid": "a1720af1-6c64-4935-9f85-a7d0efb5611c", "comment": "Malware payload (Loki)", "value": "d65712c07c5f14c0c4be8d3f67fb71db5e80c1ac41832ba018304f3b73dec719", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262352, "uuid": "db29309b-c14a-426b-a98c-a586634e5023", "comment": "Malware payload (Loki)", "value": "3b96fe2de99c840253b641c6bf7172a7ccc810cc", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262352, "uuid": "4a67b3a9-9827-429d-af00-2392220deffb", "comment": "Malware payload (Loki)", "value": "62d4f8bead6cee04e3bc13ee0fbcc1ef7b2c56b9faf4d6fefe05d8720c2aebd0842e0ddf142decb6834f043b5fb900ba", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262352, "uuid": "0ce35179-a6ed-4b41-9373-6a09a5f646da", "value": "T17F94124533E81B11DCBEA7FBB868658003B095272991FB94CCE274CF28627A49653FD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262352, "uuid": "e570e142-374a-4f94-85ad-1e1078ab9949", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262352, "uuid": "f9e7c0a9-f901-43f2-ae71-c87acf985597", "value": "12288:T+5B6iGVeENxUPaLky03kq0uPexpqZ6DSXYJq0F:UB6iGzDUPaskqP2N80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262352, "uuid": "c6e2d2cc-b6a0-4a5e-bae0-b04a662e3603", "value": 423936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262352, "uuid": "2c0fe432-1e0c-4596-a6d6-48d18dbe6f23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262352, "uuid": "a3a6a0d7-fff7-4f2e-9a0a-8b449711db25", "value": "DHLINVOICE542298.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a93135fc-b53c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649203268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649203268, "uuid": "4670fc4e-67fc-48e2-91e7-5396a83cf0db", "comment": "Malware payload (Heodo)", "value": "e129dd1c052ce4ac7c909f94832c93e8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649203268, "uuid": "5475386b-7cc5-4faa-8f38-a772bddc31b6", "comment": "Malware payload (Heodo)", "value": "d66366a8ee3f8b2f8bb8efd97e72d3b53716eccedc0866ef8429b5bb58048295", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649203268, "uuid": "69dc48d3-d926-4f66-8ee6-8727af7df825", "comment": "Malware payload (Heodo)", "value": "f8c78d6119879d508dd0b4a068a24cb14381c497", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649203268, "uuid": "a4800d19-8560-40e8-92b8-55601a43b4fd", "comment": "Malware payload (Heodo)", "value": "da734b91112bde66c7aa0a9213b741624b3e4721eea451f34a2fb9cf401d8d5a22540a67187b2855947ca10b322692ec", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649203268, "uuid": "022eed0b-1f2b-4961-a0be-12beb857c76e", "value": "T18EB4BF12F2D2C076D1AF0339691A975827BEBC609E75C657FFE02B8E6E315428F24712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649203268, "uuid": "7111923e-dee4-424c-a172-641f58ca829f", "value": "f372ffd215ce36fff280c952ece006b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649203268, "uuid": "1c9e736d-69af-4159-9a07-aa3a49aba411", "value": "6144:T4nNZVhzXP5O5+x/5QTHXMCQM2M/bRSgvfj609XJ82NxxIikTnPdALLLDSqTYfV9:obdQTHLbPJJ82KFAyq8fVQi5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649203268, "uuid": "b0aa0688-cbdc-45c5-aca7-6f7782705f8c", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649203268, "uuid": "83b29890-5088-48c2-9da4-e6f1dbe27ac9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649203268, "uuid": "6ef7953e-d781-4f35-969a-22b6a1c99d71", "value": "emotet_exe_e5_d66366a8ee3f8b2f8bb8efd97e72d3b53716eccedc0866ef8429b5bb58048295_2022-04-06__000058.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87626494-b564-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649220391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649220391, "uuid": "a059af30-8782-459a-b85f-770a9142c9d7", "comment": "Malware payload (Heodo)", "value": "f84b8f9a698a6703a774a09fa9aee6ec", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649220391, "uuid": "7a32ce2b-72b4-4f67-a535-b451fedf7b37", "comment": "Malware payload (Heodo)", "value": "d67364d2f776d4a6ff5274c0f488fde6e6236c1f5defc81f120ed67d0fa94ace", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649220391, "uuid": "d7aabdf5-67ff-44ff-a577-cc6f5213e69b", "comment": "Malware payload (Heodo)", "value": "5bee8e0cf8898a2cb10707df978d4a3fd89c1274", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649220391, "uuid": "649494dc-2927-4ac6-bef8-44680a714d0e", "comment": "Malware payload (Heodo)", "value": "da5926bf81cdaf730621e598528fc6c2f0cc990bf494458a8a659794ecfb689d1fdaa42086bee5f15dd80b4e33cff18e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649220391, "uuid": "e7d5c87c-5f97-4360-a2a1-6be2c49f8479", "value": "T17244B41233C361F0CA53B564840FD125BCA7B83C6B15897DA247656F87EB8D0DA34AFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649220391, "uuid": "ddad0c7d-c3f2-4cee-8a2d-19cc8a9b879c", "value": "6144:S5uok8qcKhyMlSXVKfKGS4Tp3wb8iZ7B7:S54yM33d3q3Z7B7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649220391, "uuid": "bbde89e7-0ecc-4574-9887-7543cb613245", "value": 272000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649220391, "uuid": "c8b40ea1-37e3-47b7-b158-92f0396d0475", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649220391, "uuid": "2a3b9646-6dfe-45d7-ab72-48af8fe43690", "value": "emotet_exe_e5_d67364d2f776d4a6ff5274c0f488fde6e6236c1f5defc81f120ed67d0fa94ace_2022-04-06__044626.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ee24ec-b53c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649203267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649203267, "uuid": "e1c1a6f6-a8ab-4016-9aa8-67497b0c4e2f", "comment": "Malware payload (Heodo)", "value": "2d78cc38186f1db030244f11ebf351d0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649203267, "uuid": "2f4b73bc-f120-477b-b358-04275dacdc62", "comment": "Malware payload (Heodo)", "value": "d69e9b2c4dd268724e77ace800f42b8e2745dd27f6f2308293046bd79925177c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649203267, "uuid": "8dc0afb4-048e-4ac4-bd55-76006ee1f739", "comment": "Malware payload (Heodo)", "value": "c371ed9f262467bc312e7db13329a4037f33a3ff", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649203267, "uuid": "d2435264-effe-4147-8822-99a6e1c1dd0c", "comment": "Malware payload (Heodo)", "value": "33e3336df73e591037cecf6adfdcc0aa6c695754a12367c6a146ae8699c592318fb4ff93861cfa9325304811697707c0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649203267, "uuid": "b22967a0-939e-475a-98a3-4fbf83b04e8a", "value": "T139B4BF12F2D2C076D1AF0339691A975827BEBC609E75C657FFE02B8E6E315428F24712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649203267, "uuid": "a39bcca3-9bfb-44e6-b86b-a4dd0fc66cf2", "value": "f372ffd215ce36fff280c952ece006b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649203267, "uuid": "96c9ad9d-c741-4ed5-992b-0ff39254a8a8", "value": "6144:T4nNZVhzXP5O5+x/5QTHXMCQM2M/bRSgvfj609XJ82axxIikTnPdALLLDSqTYfV9:obdQTHLbPJJ82/FAyq8fVQi5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649203267, "uuid": "7b8eeca0-2616-46d2-809e-110726c4d1ca", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649203267, "uuid": "7daad9e7-2d18-4a3c-955c-ad13b30095b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649203267, "uuid": "5e7e2fa8-7cd4-4854-b8d5-799b53426b37", "value": "emotet_exe_e5_d69e9b2c4dd268724e77ace800f42b8e2745dd27f6f2308293046bd79925177c_2022-04-06__000057.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ee053e-b53c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649203267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649203267, "uuid": "d2e06dad-a48e-44e5-8197-7626aba09f75", "comment": "Malware payload (Heodo)", "value": "d5c8f8e75f30618ef37bfe999838ff53", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649203267, "uuid": "d56ba12f-320a-4889-9717-ee22922efb0d", "comment": "Malware payload (Heodo)", "value": "d6b0a379b1daf97933be8721fd32de758de41cd4ce4e60455257c3ca63b23b27", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649203267, "uuid": "f12ee151-92ba-4800-b30d-362761ba12f4", "comment": "Malware payload (Heodo)", "value": "522be76c8e3d54c5949db06df85168e7a6204975", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649203267, "uuid": "40e280ad-0706-4159-83ee-c627141ccf4f", "comment": "Malware payload (Heodo)", "value": "afa6d851d8e7d2a0743b33848d80dd60cf1610daf71bc061cf741183de2e15e13a8827bc9ec1c65517f537a44b52f66c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649203267, "uuid": "ab905fc3-35cc-4670-83ac-5817eb832ac1", "value": "T176B4BF12F2D2C076D1AF0339691A975827BEBC609E75C657FFE02B8E6E315428F24712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649203267, "uuid": "9d34f05c-a9e5-450f-a9b8-6a867d96c721", "value": "f372ffd215ce36fff280c952ece006b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649203267, "uuid": "2f3ddd88-b708-42f4-af1c-31686a3f98b1", "value": "6144:T4nNZVhzXP5O5+x/5QTHXMCQM2M/bRSgvfj609XJ82axxIikTnPdALLLDSqTYfV9:obdQTHLbPJJ82/FAyq8fVQi5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649203267, "uuid": "96facaf2-0671-4b53-a8fd-0195a95465be", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649203267, "uuid": "c6a1341b-d405-46b2-ba7d-b82c299ed37f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649203267, "uuid": "6d5e427c-d737-4778-ab96-87d8b8e40bc6", "value": "emotet_exe_e5_d6b0a379b1daf97933be8721fd32de758de41cd4ce4e60455257c3ca63b23b27_2022-04-06__000101.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4b257b1-b589-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649236331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649236331, "uuid": "83297585-5b34-4e11-b2ec-b8f9eb2753e9", "comment": "Malware payload", "value": "e606c3ce20d30555d176ff98226bbaea", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649236331, "uuid": "f2d95aa2-dba0-491f-988f-7501c73511a8", "comment": "Malware payload", "value": "d71a6cbadb85e527e727a32bfa4a07821c2f9d7beaaf570dc4f5a574abcbffac", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649236331, "uuid": "44cd7937-93b1-47ac-b693-c939c1618f9d", "comment": "Malware payload", "value": "08e8a370d29727d9681e07b65f6b1cb653a89d99", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649236331, "uuid": "6d291039-122f-40dd-b815-5973baf06ee4", "comment": "Malware payload", "value": "603b427ee73139c5033114e7b68a57b65c16ce4eb68621ce6810c1030c108f1c576a1a6abc63d2141ca8bd54c7e4e13b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649236331, "uuid": "8a1f9bb4-d555-4169-8cc3-8a12b23a6d85", "value": "T1A741342221DCE29A68D997728BA33554C8B3F2FC3B324B557409DB1B17E54A0BB29353", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649236331, "uuid": "b0794e15-8203-4119-8404-e0f828c74b64", "value": "48:YOhTM7Lr1L+BsL/7ro6psOEohCOK7blIl+YBy:BA7/1VLn+oCnBY+YBy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649236331, "uuid": "7cc576d6-b989-405d-8a76-5b8b98206e55", "value": 2108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649236331, "uuid": "a3024893-573f-4d93-aafe-119fdba0e643", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649236331, "uuid": "c00be600-da1a-4804-9239-bd9d92cf8f2c", "value": "Security Kits.VBS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed5214ef-b5c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649262653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262653, "uuid": "a0bcc936-f27f-4f90-8031-3cd12e4451a2", "comment": "Malware payload (Formbook)", "value": "9bed0c07bce3186437c520bae47dc8bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262653, "uuid": "6bb9f163-e728-4696-b072-f0b034cec682", "comment": "Malware payload (Formbook)", "value": "d7d5842b7eed6386f41f307b5de1e9b4350fbd21c26eccfa1345ff3a349d9f52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262653, "uuid": "63522518-0379-4c7a-a2fa-dc9c7bbe1e5c", "comment": "Malware payload (Formbook)", "value": "0463e3e3b79f60d41c3d863248c81722a3484536", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262653, "uuid": "07f19536-1264-45fd-8685-43b2a6387d3f", "comment": "Malware payload (Formbook)", "value": "a229216e03065bb46179d00b7637b94250006834709c51fa569f3d553815ec0719619e0e4e9bf5e3b64af9c8bfab964c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262653, "uuid": "9c6d4981-2810-4e81-beee-fd98f31d7416", "value": "T1B83412185268C5A3D5834B730F39A77697E8C13734655B8F1390FFA87E33682861EB49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262653, "uuid": "d0fd3221-4495-4a0f-bcb4-c02a14794b33", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262653, "uuid": "1accdc34-77a4-4b7d-8f78-8de8af9a8ec5", "value": "6144:HNeZmaSRrB7GT3EWQiC07WaRVKh4Tfnvx8XpO:HNlLHWG0qe4h498XQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262653, "uuid": "f0f2965b-ad2b-4125-8fcb-d956f58e3bb9", "value": 245017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262653, "uuid": "e7a8b393-5d87-4883-a38a-4a0b6fcc78bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262653, "uuid": "c424b8b6-227a-4d48-9b12-0b778602e4e2", "value": "9bed0c07bce3186437c520bae47dc8bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d905b600-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278080, "uuid": "994c1c8c-5756-46c8-bd3c-c8ed8b7591f5", "comment": "Malware payload", "value": "2dac0f4d5550584c7b0640dca649d6c0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278080, "uuid": "eaeed0d5-dae4-4589-bd99-a2b010885a7e", "comment": "Malware payload", "value": "d7e12375498816095809bf0e779abc84af3c468f25ed15b875a6252041d448dc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278080, "uuid": "677ec69b-e05c-4028-8f1a-caae3e16d059", "comment": "Malware payload", "value": "64a6c34d107ff80633743c959289015ca28d9da8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278080, "uuid": "a5ba05b1-46f2-42f0-9b6f-e191c558d97c", "comment": "Malware payload", "value": "590089339b427a0ac9a4ece757163169b1f97c05e30f56157c0bf5be86eb7f3eac357eee357603d8f6a603cf87a52ed0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278080, "uuid": "5e076fa8-41ef-40ae-a3a3-ddbf4573440c", "value": "T145A1E750112C1AB17346697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278080, "uuid": "acf1b560-5603-4e48-a907-9eb7e0a8b4de", "value": "96:YRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:YRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278080, "uuid": "cb70d8e6-2d0b-488d-9075-f3f8edabdd1c", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278080, "uuid": "0b74b8ed-7549-4813-9564-849cc4e1b5e1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278080, "uuid": "15eeeddf-4b6f-4b91-ae2d-8be9b4236b6c", "value": "d7e12375498816095809bf0e779abc84af3c468f25ed15b875a6252041d448dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "162bdb34-b5bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649258426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258426, "uuid": "286cca74-bb3c-475a-81e0-8a637248e32a", "comment": "Malware payload (Formbook)", "value": "a738c06692ebc816baeb5fe030713676", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258426, "uuid": "4b1b8b02-de7a-40ea-8d38-dea38d74fb63", "comment": "Malware payload (Formbook)", "value": "d7fb7846545905a86a059da93c28f6f14a12b4ff9148b801f7238e75d75036c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258426, "uuid": "01dd1563-b490-4375-9274-139aca269961", "comment": "Malware payload (Formbook)", "value": "e79e370fd83cc07ffbed5b92230fa68481d5d015", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258426, "uuid": "6669b073-45fd-421c-810b-4033e1113e7e", "comment": "Malware payload (Formbook)", "value": "ae44a5baa5ac7e2892467bff5049d37be057d58a866d51ec3b13a4ccabd7de3536fb6caa7be8d778e16a53f865070f34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258426, "uuid": "f133cfb4-460f-4d69-bc95-ef3205283710", "value": "T17A131A17BB94BE77EB6A06370C7382050335EF569413873EA6DC522A6D633444AF7631", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258426, "uuid": "f38bef4b-af17-4a6a-8625-38e7395a6564", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258426, "uuid": "73177df2-3d89-4818-8341-b17f8ffa278a", "value": "192:LjkuY2aruOn/dTYshd+bKAlL0EgmSQgPVuYzkf92YoRXtU+8:GAO/dTYsGbvyE1EVbk92YUtU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649258426, "uuid": "5165398b-2a0f-46a9-8211-2c3b9cae41a7", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649258426, "uuid": "494484a9-5e9b-411e-b066-8e383e3dfe49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258426, "uuid": "a34bcb6b-064c-401d-a5aa-db53f56c2cea", "value": "file001364061.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9938e40-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278081, "uuid": "07080721-8e33-4614-924a-fd063bf34bc8", "comment": "Malware payload", "value": "8dd94885b4f58b4fea33855277d31bba", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278081, "uuid": "be28f99b-c3b5-42ab-a602-0f59b879006d", "comment": "Malware payload", "value": "d83e5b5833ff6b3a632e028c2a08a61b36a47e8b972ee9237c259b781ce69b07", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278081, "uuid": "86d76e22-d027-4630-ae84-8c6864c0e466", "comment": "Malware payload", "value": "5f562320cc18c3fa03bfe7654c81ea9a482607e5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278081, "uuid": "2b3469a9-1bfe-4b6e-9f97-f0ca7b36fba6", "comment": "Malware payload", "value": "d420be3b7f6618e6bf3eeedfa0b3294a51326d6d23b9eff4ec8a183526a54e47fc0aca8dac519cde86f767cbdea4e39e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278081, "uuid": "17f8bdba-e313-4fb7-a6c2-ec283464c60e", "value": "T13E91E2E5343893AA2DA1ED7361E6C546F2A071A7E5EC4D0AE3D1F0E5054CFA1F4A4B83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278081, "uuid": "9731979a-7a72-48ce-836e-cde2c09b3699", "value": "96:vYSJSKIYSsS/DYSDS0cYSNSuAYSiTSiEpbYSxSiaYSgSzHYS8SPRYS3SIsYSzSkK:gSJSKSsS8SDSCSNSaSiTSi48SxS6SgSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278081, "uuid": "ace856a6-a728-4412-be7e-554d6921dd21", "value": 4401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278081, "uuid": "42b70536-eb32-4fff-8ebb-94c23c11bac1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278081, "uuid": "6b8ac786-18db-44ea-8fda-6351f5c8746d", "value": "d83e5b5833ff6b3a632e028c2a08a61b36a47e8b972ee9237c259b781ce69b07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4594bb81-b54a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649209114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649209114, "uuid": "4aa1fca3-d495-43c4-923f-be302e730dd1", "comment": "Malware payload (Loki)", "value": "46ca5bbabbe84deeb4b418cbaf2030a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649209114, "uuid": "6e47308f-22f6-46a5-a6dd-3689c6485a7f", "comment": "Malware payload (Loki)", "value": "d88a68b1ab516aa6ef3bdf0f5eb025ebd2da3201e2cd4afe049ca5fd3dfe05cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649209114, "uuid": "428cb120-3ac0-4f6a-b205-e9883a79e97e", "comment": "Malware payload (Loki)", "value": "7d59fa2baed11da5a07081f91a439dab878fff6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649209114, "uuid": "7ada3c2d-4411-4ef8-b061-855a92e67ea9", "comment": "Malware payload (Loki)", "value": "9367239d1164cb7145e1a5627b8d80939b7f0ef3d513d195d237bb7431b33b62627edc12ed5781af056da045ce716de0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649209114, "uuid": "275749ae-4c84-413e-b57c-72a5135c225b", "value": "T14594125A27FC5325E8BE8BF3A035218107B0656F2451E398DDD2B5EF0A537909A03F8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649209114, "uuid": "9d5c9bda-d212-4cd4-bd39-8fc0affa4cda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649209114, "uuid": "bb41721a-5615-41c3-942d-d9c25a4f4e3f", "value": "12288:pN3/65zbQRi4o2BlruVpUx7wM9kJeqgWF:D65z8foslSeTtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649209114, "uuid": "4f2df572-ad46-4b61-95bc-c16c59df296c", "value": 428032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649209114, "uuid": "677acb93-4372-412c-974b-ac1a0b8b25f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649209114, "uuid": "a77fb6f5-2d1e-44c8-a639-1a34d00de557", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8daea9ed-b587-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649235434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649235434, "uuid": "f8211623-4029-49e9-98e0-83262392ffd6", "comment": "Malware payload", "value": "44715ede5a070a9689aa738c2a904dae", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649235434, "uuid": "2eb6f052-6095-4dcd-a1f9-0c3180439513", "comment": "Malware payload", "value": "d95edec180d7c2ea69585c2e2fe6f7d30421fe0974b38afdc88a4ba756514cd6", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649235434, "uuid": "38c8b4fd-d365-43dd-836a-deafbb8968b5", "comment": "Malware payload", "value": "72a7a0754accbbe1523240bb058e9137245647fc", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649235434, "uuid": "949431fd-e65f-4b50-8964-e9a483369a26", "comment": "Malware payload", "value": "0bb7ab20d1f341334ba8c1c80a76a30e556371b9a99d9e81ce2adf6eb0882e99af2263901f61b2df004e07b06cc2784d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649235434, "uuid": "718ccb24-98f0-4204-8789-74495cb543f3", "value": "T14CF5CF26759AC636FA7E8270652DCB7A60B97FF00BB244EB63C4592E0D744C10272F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649235434, "uuid": "5811045f-daf1-405c-b872-656632fe8813", "value": "98304:2tMtAptulbxKO1fTCHOjSEPYoDu5+tK3HyfE:2wxfTCHKXDu5w+HUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649235434, "uuid": "05092374-c0b7-42e9-a49c-4f54a1c68bf5", "value": 3406848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649235434, "uuid": "836ff3f4-fd5b-4872-8ed0-7031ab79824a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649235434, "uuid": "aaafda39-8325-4264-a680-4af82b9ffd39", "value": "Pago_ARCHIVO_ADJUNTO_3249002-3593046900-09-29060953-656.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cac2ce0b-b5af-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649252716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252716, "uuid": "be5cdf5b-688e-4204-a6b5-05eda8e21757", "comment": "Malware payload (Formbook)", "value": "ce5b47c242fa046f7d71c09b10b2b8aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252716, "uuid": "3213a757-26ba-4a6a-a95d-f967e9a5468d", "comment": "Malware payload (Formbook)", "value": "da4cb25d25388cef409303e2e4c3f2ec589d747d49e602ef924eaefbbaf75144", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252716, "uuid": "6cc71b8f-a5e4-4c69-9d07-fb05dbb55e42", "comment": "Malware payload (Formbook)", "value": "0e6b489ef00b9611692ef071bfe5e8f71138009d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252716, "uuid": "cc2b5b53-92e2-4fd8-84bf-f254d51d13f4", "comment": "Malware payload (Formbook)", "value": "873c0afdd1160e4c66fd515994fb0705772cf18685a290f28958604553285109363e1e9b5cded8b39f509ceb3c6dcaf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252716, "uuid": "777284c5-8186-44dc-88ae-ab8f6b513f81", "value": "T1D96401043254C067E8B349F19D39D7FF8AF96E22499462073B557FEEB932603462EB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252716, "uuid": "36f9c722-8fa3-4eea-85e5-3156d60f220b", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252716, "uuid": "8e6b4788-0fe8-409d-b1eb-a8d26e9f5729", "value": "6144:kNeZpRkWy8I+ZWH0g1GNlPyrFPNi7TU39TYjQhN6Y/:kNckn840xlKhPNicNEIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649252716, "uuid": "3f2f9093-755f-45a4-9929-d069e6dbb284", "value": 326063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649252716, "uuid": "ddc81a21-61fc-41c4-a152-0f87c180a8b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252716, "uuid": "b06bc3ea-1569-4956-b28f-336904e2f9d5", "value": "IRQ2107799_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da0fad0e-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278082, "uuid": "e1d36bd0-8ea4-4c8f-931f-154a12c7dfaa", "comment": "Malware payload", "value": "44e5078c5fb46b172e79ca3426819484", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278082, "uuid": "08d82409-07d4-46ef-9855-6ff7c825d181", "comment": "Malware payload", "value": "da916ac3ede42cf30674d761cbb3e08d79567bfed75a89ae1714de34938d47ea", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278082, "uuid": "94a995bf-bffe-4920-8e4a-741b17de082d", "comment": "Malware payload", "value": "021d65aa8f6fbd6507f40d97aecfd94b2b95d0eb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278082, "uuid": "c72edf04-c5f2-4138-bc6f-3c596a7adb3a", "comment": "Malware payload", "value": "58a3d2d38653270d0d0f467bfeb07d3662450cacfc4043408b886fb29e4ee8770de640062edd8e9704b2bd759197a1f1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278082, "uuid": "8d42d385-e90b-41a4-bc89-44f1a7a20e57", "value": "T19DA1E850112C1AB17246597AD26FFB52B50EC82B097B7B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278082, "uuid": "d1767797-00d9-41dc-bbaf-611ecde55444", "value": "96:SrRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:IRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278082, "uuid": "d7666e95-f605-440c-af48-fde91fa8c06b", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278082, "uuid": "f83879bb-5b14-4eac-b250-d0a5d45d2293", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278082, "uuid": "b92729a6-75d2-413a-a4f0-eb3c2ba518ab", "value": "da916ac3ede42cf30674d761cbb3e08d79567bfed75a89ae1714de34938d47ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69b10035-b5b9-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649256848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256848, "uuid": "117c26b2-0772-47b3-a343-514ad45e603e", "comment": "Malware payload (SnakeKeylogger)", "value": "0ebdaf8c9c4b0cf1fe0058283b2c67ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256848, "uuid": "970ccf73-2962-478d-a2c4-5260602216a5", "comment": "Malware payload (SnakeKeylogger)", "value": "dac6bf6dd9a3a74f97b2f676c164ce1883bf266befe9aeb1ba19906fbc0f3cee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256848, "uuid": "75782453-82b6-4e7e-ab38-581a5d4681e0", "comment": "Malware payload (SnakeKeylogger)", "value": "5d965cd65956235cbfbe0e06e242dd9ad2c7f760", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256848, "uuid": "d5731852-0101-4de7-920b-cae1f023ad36", "comment": "Malware payload (SnakeKeylogger)", "value": "f43e8483ee2e77ab6da449d19d9248da2d0bd24b0f146494650bf287bd99b8ca7308dfa89eed7003a3d7596ac782257c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256848, "uuid": "cec0b3c6-4723-4799-9088-0e109f5a7b17", "value": "T1C1A40290B3B7C913E56C4AB3E4D6680043B06F13A167E74E2BDD61AF96137E24582BC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256848, "uuid": "21a4d170-7ca5-4bfa-873e-7b746ae165e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256848, "uuid": "80179bf0-27fc-4c1f-ba02-1e3d53ae4f43", "value": "6144:9glxcIFCq/hAgMsKEo5IUPYw8WpSaLUkBZVMjzZ3dLR/04EVXpO+k5z7iUZtkOLL:Cqq/hHM5PNp5vBYjzTR/0di5jtLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649256848, "uuid": "7009a1e0-5b67-48a7-96f8-db5190dd4dee", "value": 482816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649256848, "uuid": "d954edce-2291-4b90-937a-020d72b71b34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256848, "uuid": "af2d2661-f92e-484d-81f9-e11ff17a4a80", "value": "B\u00dcT\u00dcN BELGELER1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae8294d-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278084, "uuid": "c08ffd19-652c-49c9-8d35-4a82a5eb9bb1", "comment": "Malware payload", "value": "c87b149cc32b98c6b0b12dae2b95fc97", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278084, "uuid": "f9550d61-3826-4681-aafc-d86244c73ba6", "comment": "Malware payload", "value": "daefee3e329d62beeb7a62a39f85480337eb5e572cf5331ed3fc3f935577e241", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278084, "uuid": "a5acfc3d-16d4-42a0-9fa9-c6b4d8c2818b", "comment": "Malware payload", "value": "3c7831d22ec842f2f448b494a6d7000519dbfa75", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278084, "uuid": "3ab32a8f-979e-4d19-a57c-62feba859f93", "comment": "Malware payload", "value": "81df31a7d0b6546f53661f89745e36e22a19ec53d4721a0d3c8b696a2bb67a645aa90e176583cde654c50b8c91f6f85f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278084, "uuid": "5bbc9311-405b-4379-a2d4-8e1b54e284ea", "value": "T177A1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278084, "uuid": "329a0b31-0fd0-4c05-8fbc-44af5ff42924", "value": "96:7RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:7RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278084, "uuid": "fe62d84e-2fbc-41de-8c4e-7b681286e994", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278084, "uuid": "cb1fc348-0faf-49f5-886e-2aa98da6bb53", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278084, "uuid": "dc999498-0dc1-41cc-bad6-82042ddd83b8", "value": "daefee3e329d62beeb7a62a39f85480337eb5e572cf5331ed3fc3f935577e241", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d291de-b5a2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1649246989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246989, "uuid": "a45ca077-2a35-4318-9a78-d9a502348f4e", "comment": "Malware payload (Stop)", "value": "0466880297b354f217e2ef336a756209", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246989, "uuid": "fda2ee12-0391-47a6-a7d3-f18708365db2", "comment": "Malware payload (Stop)", "value": "dbbba5ed6e1404dd63b721b87853d55cebc7e29cb10b298929ee8928fd0987df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246989, "uuid": "7b6be1a5-c4fc-43f6-bcf0-adecba574333", "comment": "Malware payload (Stop)", "value": "be94f88075570ba3f96acb8bccefabf8d3fe2701", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246989, "uuid": "8f22a991-d015-4d58-a92d-9ebaaec0d27a", "comment": "Malware payload (Stop)", "value": "3bf80c2a4c7fe92f5b562477e1d2dd12b8c19f20bf91bdae866bbb8f79d80daac25db4d8b7a9ca2ddf4146b17a26be4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246989, "uuid": "b747b95c-9e77-4347-8f77-8a5d2138500b", "value": "T16DF40210BB90C035F5B716F05ABA836CB93D79E0AB6854CB53C516EE5634AE8ED3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246989, "uuid": "9a869220-72cc-43da-ab05-c229056eb30d", "value": "a838cf9305c796ef9ede12c92e34f95f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246989, "uuid": "17114bfd-6ea1-4a3f-9bcf-0c609dd4cf2e", "value": "12288:+vL/3/FmnvTUJiCOkEjgQRQwHHaNFlvcjiSTt65RyaLGbs:+jVsrUQ1KFZzmI7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246989, "uuid": "02fadd89-e3b3-4421-a7d1-29aa31a9b257", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246989, "uuid": "8a2793d6-9a7e-4636-8255-a35f9874c017", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246989, "uuid": "ac0fc012-ad7d-41bb-95bb-4592deb73047", "value": "dbbba5ed6e1404dd63b721b87853d55cebc7e29cb10b298929ee8928fd0987df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4181da9-b5b9-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649257000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257000, "uuid": "342f1a4b-1084-411e-8c74-cff8fedb48f0", "comment": "Malware payload (SnakeKeylogger)", "value": "c5efdadaad80c1deb5c54861e1124ef8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257000, "uuid": "83eb3859-d115-4c54-88f3-611140f6b317", "comment": "Malware payload (SnakeKeylogger)", "value": "dbbf63c96c1191c51153692cf20280ce57df9e9d538cc323158985e2f751666c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257000, "uuid": "3168fcd7-6d03-4718-b621-35e32f79d15b", "comment": "Malware payload (SnakeKeylogger)", "value": "99c9f5e40f514624cbc6be4297057af8e4c24326", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257000, "uuid": "dda6f992-afd5-4d48-9aa3-8516b7d3eb95", "comment": "Malware payload (SnakeKeylogger)", "value": "f43ecd500a8e0bb565cbbb5f3ce2813b1862b9335db4e3ec945f5d9437a3fb1c9fdb4f82631647c5d8062615e0d2b5e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257000, "uuid": "ca1bdfcc-894d-4242-8e33-c5ba7d4a900c", "value": "T183A41258B7BBC526C2AD977390D20A1503759603E427C79E2FCD62DF0B127E68912BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257000, "uuid": "f47588b2-1c79-41d2-be8a-c6e719878d3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257000, "uuid": "1bb25a6b-c1ac-4aa4-8b98-9f1f55232ab0", "value": "12288:M83YJ+kM0IkUtm11okr2q3tQQ2kEIJzUItF:BYJrlIQIkr2q3tDvEIlJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257000, "uuid": "33a9c856-02c0-40a8-94ae-cb7dd4da018f", "value": 473088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257000, "uuid": "53e0a228-ed7f-4fdb-b8fd-2b5aca618bc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257000, "uuid": "6ca02dba-8777-4fd6-bb62-9399cf6a619a", "value": "payment swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c3d9873-b549-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649208642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649208642, "uuid": "110a7407-2455-4940-b516-a55b979b275c", "comment": "Malware payload (Heodo)", "value": "6d8e5998a1be0aae24864ccacce97b20", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649208642, "uuid": "3f6f8f05-b1a7-4722-bf30-e5ecb525a6fb", "comment": "Malware payload (Heodo)", "value": "dcfbf3762cc32d0e83965bf702809453031a73fad654c2992cc646d92a936431", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649208642, "uuid": "61714271-bea1-4277-856b-1f103761a651", "comment": "Malware payload (Heodo)", "value": "e9eed7f14ee3d4e2c6e9b855362e4f85f4ab5e22", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649208642, "uuid": "eb39b54f-92d7-4c87-9ff1-425d6e1abf48", "comment": "Malware payload (Heodo)", "value": "8dd9305de84f35a723b5b53fe525df3fc50a0ca305093a26e2a164f7874fccd4ee490243980e5d960715e619701c47b0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649208642, "uuid": "74c341d8-7c66-40e4-b54f-ca936f6a04b6", "value": "T1FCC4613D2FAE40A2D8661770145C0FD891ABCE25BB2255FF25842E2E2EB57C74879F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649208642, "uuid": "be22d7a2-9eef-4d85-afcc-c5ccc2affa93", "value": "6144:iKfJCALkjp1g4SbsLyKilbNUBmB5XORDlsOMAidDNcYs6k8:iKJCPjp1g4SbBKilbUD4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649208642, "uuid": "4116e925-f518-419f-ac85-18c0ff664009", "value": 589320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649208642, "uuid": "e653d8c6-4139-49be-a4f5-c6a2032e634f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649208642, "uuid": "adc4c87d-f464-4aec-94ed-af4d6a1f8336", "value": "emotet_exe_e5_dcfbf3762cc32d0e83965bf702809453031a73fad654c2992cc646d92a936431_2022-04-06__013037.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a8125e6-b604-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649289089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649289089, "uuid": "0ce4f485-7ecd-4995-b499-4e2b797f13cd", "comment": "Malware payload", "value": "ea9934923a08fed92f50551a23684d19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649289089, "uuid": "f9c8a2e5-d176-4e45-89b7-4b77f0efdced", "comment": "Malware payload", "value": "dd9f9ce3b45500ca095a888b4b2300f0efeed9bf719b127362e68cf59c83baab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649289089, "uuid": "2dd25df0-d1db-47d4-8f03-070baf952ea1", "comment": "Malware payload", "value": "527f1bdb575ca26fa0fa710767fbaaff54bb7c37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649289089, "uuid": "f9c3c150-dda7-4a4d-8fd4-0034fc71ec75", "comment": "Malware payload", "value": "88176e30913773616ed76b09f2116dfe36669fd66e2c69a40b43640261699ceba7956464c75efd3235543a59223aadf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649289089, "uuid": "d3f6f89c-27ec-4b60-9f1b-3db47c202821", "value": "T1D564BF53A3648561E75445B9A813C8B52C3D7F359B03762BA3E0BECF3AB0247366532E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649289089, "uuid": "a1e35874-a780-4f47-bc3c-83769071b99b", "value": "a758f977f5c6bfb8c4eb2cdb0c48b781", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649289089, "uuid": "5bb9a027-360d-4146-ac50-788b20ad02da", "value": "6144:fmEdSunAqHdroKcykhPBbiMV5xzr2fXR3oZJlZN:f4ujKyUp+gO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649289089, "uuid": "11b115dc-801d-4f2e-a0ad-145bfd342767", "value": 323584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649289089, "uuid": "1f8ed7f3-ae41-4603-b9fe-e64031c2f45b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649289089, "uuid": "7d696a54-024c-4e6b-b787-029b1c08ea38", "value": "dd9f9ce3b45500ca095a888b4b2300f0efeed9bf719b127362e68cf59c83baab.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de0acf0f-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278089, "uuid": "f6171ed8-4b3c-41e7-a572-3a8f40c30803", "comment": "Malware payload", "value": "1eabb1c9459c9c5dedce7266fddfe17d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278089, "uuid": "3407570a-59d6-45c1-8769-a90e32a4927a", "comment": "Malware payload", "value": "ddd5e3c798449b23cd9e0bea7ab6fc4ce17c5cfd983d9686eb107e6952389a72", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278089, "uuid": "ba831da5-ed6d-46ac-95bb-02112ad3b77e", "comment": "Malware payload", "value": "4fa247160712b1f4ec0d57e50be6cc3386aef00a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278089, "uuid": "febcb79e-c760-4630-9d2d-722857518b11", "comment": "Malware payload", "value": "c9bc01df181791c647a6dfc83a1d19846a683481c78b54aab04a51cf41a4bfde7c7eb017e8bfc39b3976311462788327", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278089, "uuid": "3c593e3e-e6cd-40ba-ba9c-2ac79fbd2a74", "value": "T1AAA1F750112C1AB07346697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278089, "uuid": "ce4b9b88-0ad6-44de-8e12-b1873fd81108", "value": "96:cRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:cRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278089, "uuid": "d535790e-2048-493b-acd3-8ab000081818", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278089, "uuid": "46064de5-9921-448f-a02b-11dc62504943", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278089, "uuid": "722f7d54-24f5-4f85-bf49-466b15bb115a", "value": "ddd5e3c798449b23cd9e0bea7ab6fc4ce17c5cfd983d9686eb107e6952389a72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f024da-b5c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649260060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260060, "uuid": "73db4e99-e5d2-4425-8049-91fe232772cb", "comment": "Malware payload (Formbook)", "value": "1f18b4c853eec2f96498ee5c3be8017f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260060, "uuid": "bf8df0d6-e30f-4299-86de-6994b51b3a19", "comment": "Malware payload (Formbook)", "value": "de7b53aa611115a5fd5ae91f3ad384b458e50e280c99e57b6c41ffd82a80b9e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260060, "uuid": "4a006dbc-e1ec-48db-a1c9-87a9898fcc46", "comment": "Malware payload (Formbook)", "value": "a6713789f283c8ecc7955f0e5a08fc70fdc79f89", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649260060, "uuid": "75a52165-90ee-482e-9a29-6029e9a1e1f8", "comment": "Malware payload (Formbook)", "value": "30362cd162beabf8b1460fef576ae5cd735040ed39bb8c6c5c1a88b462fc4f03a2ad69bc65b85ea18ff0f27eec1fe349", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260060, "uuid": "b7812cdc-bc9a-4bdd-bc17-11a8130605e8", "value": "T108B4121973AFDA11C06C56F3A0E209D443709B03A563D79B2BDE26DA2B127E60D52FC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260060, "uuid": "8633b2ca-0c83-48f7-9e2d-0a913f559d98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260060, "uuid": "a9d8c178-57f3-43e7-8c38-68fbbcbdea8b", "value": "12288:Ke4dED5iHyjz03jXexyBfajNskTZIf+RxOHWEt9Fh3cF:UdEDtjz03jXegQWkTZgoH29k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649260060, "uuid": "a903f5c9-646e-4535-a3d3-6a294bc3a5f0", "value": 502784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649260060, "uuid": "fab87d3d-4431-42ae-ab91-757f4f6649aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649260060, "uuid": "59a55d38-2625-46e0-afc3-e6f139a49ad4", "value": "1f18b4c853eec2f96498ee5c3be8017f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea1a969-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278090, "uuid": "5025a05e-c924-43be-9a24-17f1315ad067", "comment": "Malware payload", "value": "ba8f8e680e043db154752a822c14fa12", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278090, "uuid": "658f0c7e-dd18-4b67-a4d2-715d6021ac54", "comment": "Malware payload", "value": "deab447b6a513783150ec0053bdb9e6dad4d0cb5511aca7066f7120318282c6e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278090, "uuid": "3731deaa-b9ff-433f-80b0-efd333fb36a2", "comment": "Malware payload", "value": "62b0b8666a0c4f005d0c58262e352763ad9e7d2b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278090, "uuid": "59340b5c-5eed-4d90-8991-1bff2294b027", "comment": "Malware payload", "value": "2c9dc6978e72a0f1bf68230b849f23c5a4844e486b2afa82b82a89488b13cbcd6353485ba4956ddfd42e3de99a9fae3c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278090, "uuid": "4b65d678-b84e-41d0-8e83-d3c24cd9c33e", "value": "T1B6A1E850112C1AB17246697AD26FFA52B50ECC1B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278090, "uuid": "90025cb6-6ce5-4fde-8122-b02d4966040c", "value": "96:wRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:wRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278090, "uuid": "71464f8a-9a68-4a9a-8b86-3f766b1bcf02", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278090, "uuid": "30d2fc89-ff07-4bca-a356-0cf25a3791c1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278090, "uuid": "879d1290-44da-4818-8523-242883c38845", "value": "deab447b6a513783150ec0053bdb9e6dad4d0cb5511aca7066f7120318282c6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df2c51b3-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278091, "uuid": "22b29ee1-d0b1-4c31-a774-8239339579e0", "comment": "Malware payload", "value": "afb389e4190450739da6472f1aef66a0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278091, "uuid": "f66dcc6d-43c0-442b-8799-778c6136724b", "comment": "Malware payload", "value": "df0ab60e88222aec95222bad1ee94b0fb75a6f45faef1e7c51a24e93ae9130ff", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278091, "uuid": "08939df6-c218-42a0-8ce1-313b34032828", "comment": "Malware payload", "value": "c4cce5bfc6355b5261383b6e8744ac5e2f4a4ee1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278091, "uuid": "11c85fae-d812-48b5-8889-53f6757cd834", "comment": "Malware payload", "value": "4101154ea456e597fdc495e4902ec5bc5fbb073c8aa8e8502fe0cd03f8168f71795508d291015f45d4133782eceb5110", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278091, "uuid": "d6d27648-e871-4ee1-a187-236461fa04df", "value": "T180A1E750112C1AB17346597AD26FFA52B50EC81B0A777B358473A63C74F5DA8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278091, "uuid": "ef932282-bce0-4f5e-98b7-bd0b2aed5502", "value": "96:dRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:dRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278091, "uuid": "8cadb08b-f055-4f4e-a467-3745f8b7d10a", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278091, "uuid": "0d81194a-046a-4eee-bfce-7cacc5fbd196", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278091, "uuid": "dcd31a25-d3e6-48d9-a589-f9a480d9238f", "value": "df0ab60e88222aec95222bad1ee94b0fb75a6f45faef1e7c51a24e93ae9130ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "774a7216-b5a2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1649246993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246993, "uuid": "87f2640b-1534-4400-a389-e9a4531158dd", "comment": "Malware payload (Stop)", "value": "9ea43d7d80bc4b92a5211c45fbe75c25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246993, "uuid": "ae3f3210-c78c-4f77-94a4-d6ec6bf0efe8", "comment": "Malware payload (Stop)", "value": "df44772e8eb751fe42591ec02926257e5aea30820a82f19b7b8d2e46c506dd05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246993, "uuid": "ff5cc6d5-07f0-429b-b7b6-5d85ad51bc9d", "comment": "Malware payload (Stop)", "value": "898f838a5c1cef3d9bf8b5a79100867346b9ceaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246993, "uuid": "6d44d3dd-1c18-4b46-9635-e9fb0e0e3c8f", "comment": "Malware payload (Stop)", "value": "4af2aad4594701e4cccc3396b36d50299cff6518455e332d1660c4e373262f192e430b2ce930aa616a9eb5c4838aaf49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246993, "uuid": "27fb5843-7356-471d-937f-d0f0762e9f64", "value": "T17A050100B7A0D039F07712F4787A93AD652E7DA15B21A4CF22D62BEB16346D0EDB534B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246993, "uuid": "7a3e0738-f50a-4bd1-ae08-811d09b870ee", "value": "6bd64b13624a27b70b577055bad87689", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246993, "uuid": "4aad23e4-d854-42c4-a729-5c8672954d78", "value": "24576:A/NVjKkTxdWcNUE+Ggd6cjd6UnbbH1Iq:qP7UE+GWPd6UFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246993, "uuid": "5277c53d-6401-4df5-99c2-57971125f55d", "value": 830464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246993, "uuid": "866117a1-c1fc-4f35-9a82-8663dba3f475", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246993, "uuid": "add3231e-98b8-4ef8-a7c9-6919ffb2daae", "value": "df44772e8eb751fe42591ec02926257e5aea30820a82f19b7b8d2e46c506dd05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2d36368-b5b9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649257052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257052, "uuid": "33d80c0a-e0ab-4aa8-98fe-a762bb6eb3ae", "comment": "Malware payload (Formbook)", "value": "0089158de06987cb0f417cd66e65a64e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257052, "uuid": "818e2766-8ad9-4772-81be-bd8b4f53050e", "comment": "Malware payload (Formbook)", "value": "e07c12a4c17554763b40b0ca410493875bbdd907bc8ba261a732d935e015f852", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257052, "uuid": "5d83cd7d-65f4-4e1c-8073-076ddabd6658", "comment": "Malware payload (Formbook)", "value": "02ae2a74d66d34dcf1ec8d8e9abe232a02eaa598", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257052, "uuid": "db855251-ee9e-4136-92a1-ae7213d31e85", "comment": "Malware payload (Formbook)", "value": "2182a96760eac8289f0853c375b840e727634803b398889726fcffa5c596be29d4366afbe0c49d62b83a961bd24798cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257052, "uuid": "799afe8d-9d57-426c-aad3-6837f6de6067", "value": "T1DBB412587AABD813D56D5273E0E315190370FA0390A3EA9E2FEC52EF4A123E749817D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257052, "uuid": "38122d43-de9b-4f71-9fa3-3dfc531b4aa3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257052, "uuid": "a1ea9a5f-f194-499e-8ac3-44c25846215b", "value": "12288:kz2qBWR5DeYuLhBUfBYnJ1amYq7Kcv+xE0PkCPF:6WrfQ+w1hrVv+bcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257052, "uuid": "975ad203-baf7-41c1-b7c2-1e2b7c85170a", "value": 522240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257052, "uuid": "ae33a760-73a0-46f9-9157-375adcffbc87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257052, "uuid": "d65e7e25-8c4f-4492-b11a-dbdcf2de5029", "value": "PART SHIPMENT- FEDEX - Cargo Arrival Notification Import Track No 270962529096 MR V fKUMAR.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a41dcb-b55c-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649217086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649217086, "uuid": "c977d5a8-ab0a-4211-9f89-2d4b9b68f81d", "comment": "Malware payload (RedLineStealer)", "value": "fa5cb2a8414da4c2d51555ca9e0ecb46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649217086, "uuid": "602f43d4-b398-460c-b7ed-c18986f1b50f", "comment": "Malware payload (RedLineStealer)", "value": "e0841932ac73750fbf4fa0884a88ff8012cd699aa8439ff0b1e9fc3c8020bdb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649217086, "uuid": "d4876a26-2e8c-41b3-af61-4aa7622abca0", "comment": "Malware payload (RedLineStealer)", "value": "fdb3e47f0e1e20a1d1385b3d57a999acd0d901ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649217086, "uuid": "f969b2a8-4976-482d-8562-8d716cd93278", "comment": "Malware payload (RedLineStealer)", "value": "a10170f99fc54778503cd96a4c6158cee1456e75f32db587380687f09e6cadee552b9e74942370c0af30a46a31fa0902", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649217086, "uuid": "1a4f89d2-5c6a-45bc-a351-35201dcaeb44", "value": "T17394E1C57391D431C0513D71A869CBA0667FB832E670A657FBB86B2F1E703C09AB5B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649217086, "uuid": "ff1b6c83-2718-4807-afcc-3673d7e79744", "value": "3e1371bce2a7dabfc48c6aff7cfba706", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649217086, "uuid": "0e61301e-e15c-42cf-adb0-4f3ecf62c56f", "value": "6144:r7KU/CGHa4lLxhAmIWAhxcDDD8f6CMbg0Q7ITsq7igah:r7KGCGHXZxhHIfcDSmQ79J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649217086, "uuid": "156da717-0fa4-48e9-abf4-8878b0d08d78", "value": 419840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649217086, "uuid": "c52d5a6a-60d2-4cb8-97bb-54065384a107", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649217086, "uuid": "3110342e-0cfb-4ea9-9217-6404f5a2e947", "value": "fa5cb2a8414da4c2d51555ca9e0ecb46.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e138a82c-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278094, "uuid": "846ab440-e15f-4d3b-b2cc-feace9f5f5e7", "comment": "Malware payload", "value": "20c2d84e0f93d70a4cee1d548dd43dce", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278094, "uuid": "2eecb8d2-c4fd-4760-8f32-3886fc3980d8", "comment": "Malware payload", "value": "e08ae37be4e8037e19564dc7fb50bbed01ca01075a6b327751601c8740299540", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278094, "uuid": "45f9e84e-1972-4a7c-9ae8-9058bbc97088", "comment": "Malware payload", "value": "cfbdc84927ecdf637f75e11acd84b64d99f2e618", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278094, "uuid": "37a7e232-1170-4a37-af3f-bf01436e7acf", "comment": "Malware payload", "value": "ece280f4b12f4a96974b7e713aac48601389a11de4a6e63123ba84e2f23eb5598c97856002ece7de925257b35d2ab8ab", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278094, "uuid": "fdd9cafe-1957-4721-beb3-bce52efe70b3", "value": "T148A1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278094, "uuid": "4e8c1fdc-0161-4a74-801d-04d49de08c11", "value": "96:tRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:tRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278094, "uuid": "cef4f633-6e70-4f8b-8ae0-9001dc04f488", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278094, "uuid": "8db8db2c-0c02-40c3-9efa-311ae2b109f3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278094, "uuid": "04f87070-d45d-460d-8e59-5b02da6c84b9", "value": "e08ae37be4e8037e19564dc7fb50bbed01ca01075a6b327751601c8740299540", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2d3e6f9-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278097, "uuid": "66856c55-ac17-4cff-90bf-227a3d9d6238", "comment": "Malware payload", "value": "4d5f265735c270a499d04b5f5370eb9a", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278097, "uuid": "c81844b1-98e5-46d7-84d4-df6a6426fcf0", "comment": "Malware payload", "value": "e0dc38c603584e26828d595da30b331427d4947026ad077564b588ece20456d6", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278097, "uuid": "44516092-2e1f-40e8-bdd1-81ca26c316ce", "comment": "Malware payload", "value": "7ca7839a829ce4b7065a7cb9dfabe7fc0265fd83", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278097, "uuid": "b31eae48-5b17-4a20-94b4-e33f60217209", "comment": "Malware payload", "value": "d5803ad851479f502418b14fa986ea8d316e5679e47b0da2f04effe7a02d14bcf9dd669e49efc2cbd9b3a6923c691e05", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278097, "uuid": "8ff9e9d6-8d9d-4e07-9dac-d9c116eaa728", "value": "T10E36333EF27770B4AA06DEE155488D7277BAD70F3D8963261EF8A0DF612491B36B8140", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278097, "uuid": "8705ab46-c9eb-42e5-b786-83d7f87420be", "value": "98304:ijn5JcAsHYqsnvqZ7hcHVSdkOFOMs6HVCjzrbXbe8gGjAuv2p5qzdVjVo:KnD4Yqqvc7hvLFOMojzrbLVf2p5qzHjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278097, "uuid": "04d26f5c-6aa3-49c3-9bac-35fa815f4697", "value": 5238784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278097, "uuid": "80996ef7-8978-45ed-a99e-1b6fea76c5c9", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278097, "uuid": "0547a639-9642-4096-a492-90618d86a2f3", "value": "e0dc38c603584e26828d595da30b331427d4947026ad077564b588ece20456d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e35d5a6c-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278098, "uuid": "d1c00f06-c810-4b9b-af79-a401175a77e0", "comment": "Malware payload", "value": "4737fbcfa825502bf82523adcb75d708", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278098, "uuid": "1566e69d-a950-4f61-98f3-04d4283c97b9", "comment": "Malware payload", "value": "e1789a5cd44d53a3f86eb05e1446dec7770ae175e9bfc86d4cffbb6d07443989", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278098, "uuid": "339db2a8-e5a3-445e-9bbd-664693568032", "comment": "Malware payload", "value": "4b5096d0e9eec74d484a6d882e76dc9c18674040", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278098, "uuid": "52d58413-554b-4dbd-8970-eabcfb70233e", "comment": "Malware payload", "value": "91401ad489393c19e0272c799d0efb9c07b7b5927e01bc62431dfdee4af65d44e13e100faaa94ff1fca82297463a4e56", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278098, "uuid": "4deb15d4-afed-451a-a342-51af817dddf5", "value": "T19AA1F750112C1AB17346697AD26FFA52B80EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278098, "uuid": "5dadb9f6-08e7-4663-9caa-c27355cb0884", "value": "96:KRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:KRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278098, "uuid": "5422c6b3-61b8-4521-bb9b-a27236c47a71", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278098, "uuid": "74c063a3-1b6e-4ccb-97cf-2099107bb16f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278098, "uuid": "dd0a6d33-7e59-4f84-82ef-db3278c49be5", "value": "e1789a5cd44d53a3f86eb05e1446dec7770ae175e9bfc86d4cffbb6d07443989", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "735b2f6b-b568-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649222075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222075, "uuid": "52fa7416-baa4-4a5d-907f-c5343f838da1", "comment": "Malware payload", "value": "62b3f3c7c5438984b8e4dbfdc0e04bf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222075, "uuid": "35a5efb3-62dd-4a73-bd17-83aebb4edd96", "comment": "Malware payload", "value": "e1c639d702a9706cb7868a928b1c5253bc5fdff65024771a5faec9b53d260bbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222075, "uuid": "73b88879-c665-4745-b9e7-49678a194d37", "comment": "Malware payload", "value": "38170ddfc98391bc920fb162c150cebde491617a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649222075, "uuid": "fd247937-76d5-4b76-898c-b1808f434cdf", "comment": "Malware payload", "value": "1e17fc89c4d6bee01a6fcd2f6b92631b3389c23d31d84c7db70f23c73bca44885e932aead861f84651b150cfbccd798f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222075, "uuid": "6415e660-6c3c-41c5-a249-a13230bd9fd5", "value": "T140452364B0C3E471F19101F310F2B2FA85BC88356B8AE707D265B5BB9FF24761AA4167", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222075, "uuid": "04730c73-0358-4719-8c42-1cef9ff60f00", "value": "c1723e7036e1a4eba5a01a73e3b94fe0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222075, "uuid": "92bc6e12-e8c7-46fe-a84a-d1496c567627", "value": "24576:cnvdLRJaEmxQEinR2XMHvitOILXlR1CQVzEyq88JXjg1VCToa24qiwZFrE/Gb66:cnvQpDrXAvGLjoqbHCToa2DT/rwG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649222075, "uuid": "61b561f3-5510-4566-9572-f675f8044de3", "value": 1194496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649222075, "uuid": "a9007d9d-672e-4f61-b41a-baac7544fcf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649222075, "uuid": "01c34d61-8db5-4b24-bcef-9f571a295f15", "value": "selfxfe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adce0830-b567-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649221744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221744, "uuid": "e0737008-9d85-42c9-b64a-953a16e45182", "comment": "Malware payload (Mirai)", "value": "441da5902c04fc8e2196cd0f763dfbc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221744, "uuid": "f800f0b4-0ba1-4754-9d3e-56be899ef07b", "comment": "Malware payload (Mirai)", "value": "e1cd4c635c76dad38cfefcec93f336ba2724b794e3b27550ea131a5c049eb4bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221744, "uuid": "3892a285-543e-4ec6-9a3d-a31e433226ab", "comment": "Malware payload (Mirai)", "value": "709b2433b2106313dbad4e3e3cc7ea1a576b6aa3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649221744, "uuid": "cdfdf005-ad73-48de-a841-e6f64535561a", "comment": "Malware payload (Mirai)", "value": "a6a2e35bee30599af369e94f33c5e269bc0b1c7192d61c082ec8f2e8830ec7db1909ab3c80ba924286ea3b22a0680fd3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221744, "uuid": "8a5cde76-100f-4b32-8443-fea18dadb31f", "value": "T11764E08AEE01AE25E9C016B9FE5F034D73778BACD3D7B111E620C72936DA64A4F76044", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221744, "uuid": "207c6b16-0df4-4259-853f-d4519cf8828a", "value": "6144:p3lOYoaja8xzx/0wsxzSica77oNsKqqfPqOJ:p1CG/jsxzXca/HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649221744, "uuid": "ccd99b0c-d9aa-46b8-8212-342b6bd9e98d", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649221744, "uuid": "86856aa3-e82e-4de9-accc-5261f320c533", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649221744, "uuid": "cf5b78cb-dd0f-4054-8c8b-afbcb873a362", "value": "MIPSR3000.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e6f015e-b5ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649257178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257178, "uuid": "1ec47ca7-3022-4d74-8faa-c9aa7788743f", "comment": "Malware payload (SnakeKeylogger)", "value": "f79fa3fa50f4dfa8732a3ca0de23d0bc", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257178, "uuid": "b8f74ff4-89a8-4725-a040-fda2a0b5ba41", "comment": "Malware payload (SnakeKeylogger)", "value": "e1febd05f57a088e32e12034c9fb19123c4db8754d965678bf80837fa06a8118", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257178, "uuid": "ece9d31c-f11f-486f-ab58-f7bbbc5ffea0", "comment": "Malware payload (SnakeKeylogger)", "value": "aea3661900e852893b836f3490f5a292e4bbeb53", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257178, "uuid": "0afdaa1b-973b-4c16-823a-d3e1eccfc60c", "comment": "Malware payload (SnakeKeylogger)", "value": "4396660218de5e41def9d23c8a113200532f223b0adcd990134fe76040e243956090a68ec335257b0bff37ffed43e391", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257178, "uuid": "052e5afa-9aea-4c36-9f22-afe0aa2d1641", "value": "T14CA4124137785326E5BE97F2B03A156247B13A2F3428F2781EE964DF3922754C902F9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257178, "uuid": "9bc842c2-b850-4038-9d27-6e4f4158d9aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257178, "uuid": "f0c8bac6-7f70-47ad-b8bf-8690ba8f0b66", "value": "12288:bzrue9no+kf88D0UPAnLgJgSt7ofCZ8q64+UfNlF:v39ov5D+nLgJgC7do4HVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257178, "uuid": "e98e1d42-8a81-4f89-9e79-ede90f6a9ce0", "value": 452608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257178, "uuid": "33505195-a488-418c-bc74-c7035e8fef75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257178, "uuid": "d3388b28-a0fa-49e4-8e0e-3a4393aa6665", "value": "120045_669840_20220405.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f322ab-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278099, "uuid": "55b7a157-20c0-44b1-8d82-e518a8e8b137", "comment": "Malware payload", "value": "fb1ede9aa526094805dec0f4077e5fb3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278099, "uuid": "5e09f895-19ea-4727-9b0d-39ee4e63b2ed", "comment": "Malware payload", "value": "e212d441f843f65e781b4c466ad9223f2752b5cfbb0962e1669adbaa9d7e7df4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278099, "uuid": "41bae2e5-debd-495a-b21e-c11a02d0cfaa", "comment": "Malware payload", "value": "b07c0b0db8e87962687825d0532e7d20fd55dee4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278099, "uuid": "5ba6d469-efb8-4c9c-a847-440989ecb9bc", "comment": "Malware payload", "value": "45be048176d7a20fbdbd4b6ab30f06648ed812a84f60626eefccaac1dfbf0266afd29e5294ed8c5729eac2a39529ca57", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278099, "uuid": "2eb7b0c5-cc23-452d-9010-3321de6ae993", "value": "T145A1E850112C1AB17246597AD26FFA52B90EC81B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278099, "uuid": "3459aef6-3aec-4ce1-8fd4-2b34adb52531", "value": "96:1RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:1RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278099, "uuid": "0eaa1914-7d20-4072-85e4-2ac4f519a831", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278099, "uuid": "e3c4e533-ae73-4100-8fcd-c31f86eec3be", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278099, "uuid": "26a830fd-ad06-4f83-9deb-9d3a438d0deb", "value": "e212d441f843f65e781b4c466ad9223f2752b5cfbb0962e1669adbaa9d7e7df4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "241ece02-b5b0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649252866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252866, "uuid": "45ebef24-27a4-4b23-b53b-2e01c8b14af1", "comment": "Malware payload", "value": "895df41071a5369534edf364bd6f0fda", "object_relation": "md5", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252866, "uuid": "d7932408-b8fb-4a10-a9f9-47f387e18324", "comment": "Malware payload", "value": "e226e917ffc79648f4d48e21a884721a67b3daff23172e22529cef8deff291da", "object_relation": "sha256", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252866, "uuid": "3d7bc170-dffb-46fa-bee6-da01e8f3b834", "comment": "Malware payload", "value": "c83b0d3c1408ff64fa23a865079f902064c7c32d", "object_relation": "sha1", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252866, "uuid": "0b07a7c3-2356-423b-a6a4-15cd8aa29acc", "comment": "Malware payload", "value": "320de9d2c1bbc2cfc852e4f24461d7fc61dda6cf794ead574fe9c98a25984a43053abdbebd46a5bf43084849ca22a522", "object_relation": "sha3-384", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252866, "uuid": "46c2ee2d-b5e4-4954-a861-5f1e239e11ba", "value": "T147A633F4F15F0B5BC022EB7CF8DE49B67B50229E2251022798ACC4E9660A3B7B317755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252866, "uuid": "b948097c-11fd-4d01-9298-6513f566b5fa", "value": "196608:QYaw7Xi7IVmMdIaySx3ocRIjMjSl75bXzIyFVQMkIz4295NxulMx0Qc:Qw7oumMKSxY5MYtDGMkPQDxulMx07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649252866, "uuid": "bc5d37f4-7cf5-4047-8168-8bf7aaccdfe1", "value": 10380978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649252866, "uuid": "70a84162-9dd2-42d0-9aea-087846e0a4c3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252866, "uuid": "cf500b65-599e-45f9-9c70-ee1e8f6757b3", "value": "PVGfsc_.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9926023c-b572-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1649226434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649226434, "uuid": "2b1d7313-3816-45b9-8c62-2e3585456f3a", "comment": "Malware payload (Heodo)", "value": "3fbf622a8b52c01391fd34f2ec7e986a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649226434, "uuid": "d01beeb7-7c31-47d0-beed-087fd9c7aba5", "comment": "Malware payload (Heodo)", "value": "e29560d2b2c6de55a267554cbb2ac58a9df6c6750c00ed5aaa44b4fd7dc945ff", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649226434, "uuid": "ffa71991-c951-40b2-8cdb-369ac57ef0a3", "comment": "Malware payload (Heodo)", "value": "e79adf01e57a7c3b9276314d188fdfbc5e35023f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649226434, "uuid": "b90666c0-6441-41b0-9845-710c6a97fbea", "comment": "Malware payload (Heodo)", "value": "166b1a2babe07de283fd06350a4352298710b000e097807da94c6bc5d796d295e769ce6f52d01ef1edde4c26257cc09a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649226434, "uuid": "1d0fef04-d2a4-4455-864d-0e9834192839", "value": "T1ACB47B217691C836FC8A4F313583866D1FF9BF649AE48257EFD43A0DAB735018A252C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649226434, "uuid": "916fd1c0-9d43-4bb9-8bad-7ec1ce9af9ef", "value": "196752bd65f33bc6f5dd0426f39259ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649226434, "uuid": "5ae59dd7-c087-4748-8295-74756baf0da5", "value": "12288:bGptged525pthqnht+RUKyTpoOvHuf27xk:Ch525Dhqnh+mpvOf27m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649226434, "uuid": "ad114ef8-2b59-4eb3-a445-48beae5bf213", "value": 517896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649226434, "uuid": "a5fcc621-2be2-4491-8c33-a01c00788230", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649226434, "uuid": "04949d13-b546-45fd-be18-474f40b30b4b", "value": "emotet_exe_e5_e29560d2b2c6de55a267554cbb2ac58a9df6c6750c00ed5aaa44b4fd7dc945ff_2022-04-06__062708.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e91e1192-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278107, "uuid": "cb0671ef-af2c-49ee-b233-e48b98e96ec2", "comment": "Malware payload", "value": "8ef9da63767ab55b89336cb5c806e3e3", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278107, "uuid": "17d4f2b7-50c7-456c-a3b8-cd3aa65acc82", "comment": "Malware payload", "value": "e3fcc91ee849f94606c1c91eeaa99ee1da1fa3bc2a7d8ba85f35c234385103d6", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278107, "uuid": "947afabb-d16d-495d-8462-68502669e70e", "comment": "Malware payload", "value": "cd76c1376caa66783e74077ced7cf42a3242b8bd", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278107, "uuid": "292ee992-25e7-4123-a90a-4864302dd33e", "comment": "Malware payload", "value": "4137630ae3a193e811b06cdca87635856ebe5938c68121f39595c82677acfed992b17d4370ef1af898920c1c2392e5e5", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278107, "uuid": "a7d4f5ed-5d1a-491d-8360-a7016946365d", "value": "T16846336CA0E979FE4248987493DFDF1071AA1BCDB0A1D712D46BD54B0C1B322B9FD928", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278107, "uuid": "4d1d9a23-f745-40cf-948a-a82e5bbc20bc", "value": "98304:tos909Qg6ecEZHyEexmLaI9MY7bxTE8SSvEgP3N2v+KmFLBLRV2BpAX:td69Qg/JFeQ5x7bhE8SSdP8v+nV2BpAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278107, "uuid": "8e26575e-e74f-4078-9ecf-01c4900b42e0", "value": 5881856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278107, "uuid": "bcd1a25e-bee5-4ede-a4bf-848703ad5a7e", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278107, "uuid": "ae724981-9c15-4f9d-9e0b-ab6eaa083724", "value": "e3fcc91ee849f94606c1c91eeaa99ee1da1fa3bc2a7d8ba85f35c234385103d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b96828-b5a1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649246591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246591, "uuid": "25139b24-602e-4589-ba34-c56a8abc26da", "comment": "Malware payload (AgentTesla)", "value": "c6467ea662bcd1cfaabf40988d582d2c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246591, "uuid": "78338a02-a7d9-4cd8-aacf-83f2e71c05eb", "comment": "Malware payload (AgentTesla)", "value": "e400ed848e1fae8bc1cff4357811dd442d6fd2483f040c9b52807c5986e88327", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246591, "uuid": "d6de8f7d-876b-469e-899b-85c381430f19", "comment": "Malware payload (AgentTesla)", "value": "630199ac3a7b838f47346ff45f0581db699c9fc9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246591, "uuid": "3cab2fb1-68d8-4ba0-8106-ff3f3d43c1af", "comment": "Malware payload (AgentTesla)", "value": "5a1d3376490131aa90d68e309f2f9bea66f487b3f37c53856adb0117df42e1b2fbde1282fe249192990a92329e65c53e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246591, "uuid": "b9fcb96e-c94f-4d69-ba1f-c56d851bc21a", "value": "T11AC41269B3FADD25D85CA6B7D4A154110330A70BE293E39F59CF91AF4B023D22602BD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246591, "uuid": "5d7ebafb-4159-4c57-b7b5-e0e7b17d8de5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246591, "uuid": "0cce4432-6ca5-4bdc-8b81-6cfc711aa524", "value": "12288:a352AIKhHIeXB9AINgBvHRTRY3xQ2EOuEXI/XxF:W52AIYRHuBvHnY2mps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246591, "uuid": "2b4c48e8-cfa5-44dd-9d59-6e7f89e1220f", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246591, "uuid": "807a9a93-5b02-4ac1-aef5-08a40bf7c870", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246591, "uuid": "583358e9-6d98-46d5-af94-5a5c6bd13a96", "value": "PO-462022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eabd9361-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278110, "uuid": "f3cfdbe1-d212-46e3-b622-c0f0917131cd", "comment": "Malware payload", "value": "62272d8189b86ee162ed5b97ae11acfc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278110, "uuid": "ecf9c149-0541-4295-88af-13b2799b3549", "comment": "Malware payload", "value": "e46044043f44d0d503b85d1a48b7ef24dc292cd8fd9e3f33335375e44f234e15", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278110, "uuid": "35859d71-08c2-4a11-9a2f-4824383bdede", "comment": "Malware payload", "value": "84ec79ed67e650047c8f67a987669ca93c8e2a33", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278110, "uuid": "4cf053b9-dd92-4ffb-9df4-91494af2f7da", "comment": "Malware payload", "value": "b3c9e3b69638fe448c4798212e74d16d45c81370f6571e7a443fb7820e5b315d4fd7fb6938077f69285df79d8be5c5a6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278110, "uuid": "c7c7618f-ac94-4257-bd6c-b87aa8bd9d43", "value": "T1FA715DE4B834B6793CF2E97763E64606B2807126A8D45D46E2D5F0A8448EF91F0A06E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278110, "uuid": "08aeca10-d690-48c9-8078-43ecb047e236", "value": "96:ESX3qSXt1SXxmSXzCSXINDEptSXp8SXFhSXVbSXN2SXvkSXNLSXF/SXrt:ESKS/S8S2SYt4tS+SnShS8SMShSVS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278110, "uuid": "a7557c3b-fdcd-4faa-bace-3d4b70fe8ad6", "value": 3580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278110, "uuid": "0932da2e-48cd-433c-9c60-ef94ead35646", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278110, "uuid": "10f55ca3-2059-4ff4-8765-9412e8e9c8e7", "value": "e46044043f44d0d503b85d1a48b7ef24dc292cd8fd9e3f33335375e44f234e15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a12e428-b603-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649288632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649288632, "uuid": "d5881f94-8343-4b60-a517-700a75ed5580", "comment": "Malware payload", "value": "2b99e5c85cd8b0e6decf30d6daee094e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649288632, "uuid": "c1388327-a017-457d-aef5-d1de2af0100d", "comment": "Malware payload", "value": "e4defd8a187a513212cb19c9f2a800505395e66d9cd9eb3a96c291060224e7dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649288632, "uuid": "f2ffb853-a8d5-414e-9b66-3bcaa8e8d31a", "comment": "Malware payload", "value": "c3e7652e16a2e03d96b0274b5520d19b96196a03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649288632, "uuid": "9c2b03f8-7b69-4e74-92c7-a94c164a704e", "comment": "Malware payload", "value": "5676991b08fc6d9e3128c1425ceb03159b934d4c5265ea3fe422171aba78ff4e376d9a417feaeed14a2fd0ef02ae62fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649288632, "uuid": "df921c52-07fc-4063-86f6-3ecb4ba1f3e1", "value": "T16464D0A7A354C5A2E75986B0A813CCB92D283E35D941762BA3C4BF5F3C7035A345932F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649288632, "uuid": "82adc6ab-5896-4d3b-a370-ef5055f0ec92", "value": "818c0e000ca7da0505349e2306c68948", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649288632, "uuid": "20e602eb-3ff5-40b6-be2b-a4fdab234355", "value": "6144:9mEdSunAqHdroKcykhPBbiMV5xzr2fXGzN:94ujKyUp+gOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649288632, "uuid": "59983171-3b1c-473d-b230-21a18967b38f", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649288632, "uuid": "b5f50a6b-130b-4de1-a673-df3a506da050", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649288632, "uuid": "29a02921-46bc-44ec-af61-b6321345478c", "value": "e4defd8a187a513212cb19c9f2a800505395e66d9cd9eb3a96c291060224e7dd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccc1c43d-b5c5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649262169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262169, "uuid": "97c027d5-ede9-49a7-852e-045bc4b9567c", "comment": "Malware payload", "value": "4eef7295afb031fa080e465d5f5de298", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262169, "uuid": "de4157f7-be29-4049-8c76-4368e94847f3", "comment": "Malware payload", "value": "e538e6eaa72721a0af5c82b49a550de0072bd54ffc9d76a46e15c054357d1f5f", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262169, "uuid": "15bffaa6-bfce-420b-8f6b-37c0e083e74a", "comment": "Malware payload", "value": "74d975a54c57e75bebed333ebee9303452aafc58", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262169, "uuid": "4ae48ab7-857b-4e69-98fd-415af01d1db8", "comment": "Malware payload", "value": "80dcb23940d0660a90adbadc3791756f107726bc4669bbcfd636e86264a0a62dcfa47f9f33b448b9538f4675f380ba58", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262169, "uuid": "3948daf6-f72d-44e4-9e34-96fc76d2ca03", "value": "T1F6D56C33F284B53ED46F1A3A5537A7599D3BAA6265229C1B07F4488C8F354803B3F687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262169, "uuid": "97bcc10b-53ba-4140-9517-1f0f371b3bce", "value": "49152:wI9L9KKl+QdCjkIsCgNFDqtzIGCE6psShdxJT7ryOTHbVjAuTG1YS3A:tLDAWuO0QG1YOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262169, "uuid": "95fff9a7-e5a1-45fd-8896-d78a5c547604", "value": 2987008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262169, "uuid": "def2dfe1-5731-454d-8888-370983c72d9e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262169, "uuid": "5fc93d27-650d-449a-a031-f23cf89d2576", "value": "Archivo.FactEndesa0604.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc2a3add-b56c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649224023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224023, "uuid": "0ac56610-2e68-4b3a-a2f7-41883c2102d5", "comment": "Malware payload (Formbook)", "value": "9626cc512dbe8965189adfa61cf157b1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224023, "uuid": "174b2246-b9cd-4b09-8842-5d3d3cfe430a", "comment": "Malware payload (Formbook)", "value": "e56ee0037f504e8c54ffa8f4f180cb8fb7dc6da802e336bd67ccdaf4616c2370", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224023, "uuid": "b2c7b22f-740a-43bd-a7c0-f0f84e70d7c3", "comment": "Malware payload (Formbook)", "value": "bd69e0fbadb68487e1f47c4abf5d404b65a884f0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224023, "uuid": "7982d685-eb17-4f20-b1f8-ae3a56f8ab72", "comment": "Malware payload (Formbook)", "value": "0dcc041e5a4f98936330a4e1c678236b11c06e16d506f3e1e51e8354bd557dc4695b4ca290b7df67744b644481f08321", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224023, "uuid": "cf8e9b30-905e-4861-8fee-069bb487906b", "value": "T1E434238784AB37B513AEB30FFDCA44EFD5803C92928092141D659594ED4A33B3B946F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224023, "uuid": "0a8bbbaf-3d5f-49e8-b615-18926d3beccb", "value": "6144:2cy0xtt88VuF7Tpd7CS1VAn5bOxQHkkP06Aabm:7PT8lTb9SnuQHYabm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649224023, "uuid": "bb6b9db4-b166-45bd-bbf3-dbe8eb3a51f6", "value": 234071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649224023, "uuid": "1980c177-e82e-4b6a-a7dd-01e7fdf748c5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224023, "uuid": "66c9b444-6205-46fa-9562-51b8a19ac5cb", "value": "Payment Advice.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc0999d-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278112, "uuid": "35623c34-872b-40e4-bce1-9e5ce755361a", "comment": "Malware payload", "value": "22a4f64c31c781499e786b0d9a489688", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278112, "uuid": "2c4f9900-db3c-49f2-9e9e-a30257dd501e", "comment": "Malware payload", "value": "e69f3cad1f3ddbf383b851fd2819d26d842bc2e5fc5db79579d544fa1c76538a", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278112, "uuid": "ca9ee073-d125-45d9-9378-9c5035d8ed09", "comment": "Malware payload", "value": "548bae48887f231315f4df0cd707db6023a86d55", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278112, "uuid": "d1c05503-c157-4215-a136-9f98f03bead5", "comment": "Malware payload", "value": "a49c917fb2527de058869cff392a479b9ca6dd5d3e7f7c3ec9c8785c6391c5529713fd8b253ae3a5ad2f5fc6b9a15136", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278112, "uuid": "31b63f3a-9317-4132-8a98-a1c5f8f91e2d", "value": "T1C745335669C02FC8E0A8DD0B2F8C1426117AFE827168FAC741F1E7D2114FB556EE6B29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278112, "uuid": "ee69450a-0ded-4107-8e28-d2f4d45ca5b0", "value": "24576:G1HxKBpxMjuBd5QUP+GDxDQjKS4hoczMEPy0WeTOA/A37:G1wBp0uBd5QU2GmjKSGLZyQOA/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278112, "uuid": "2d34e052-2dd4-4c61-bbd8-914b6f4b4db3", "value": 1167360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278112, "uuid": "bcf1d558-5320-4588-bc58-d097adcad71f", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278112, "uuid": "5acc1941-fd71-4020-95e8-6ae50463def2", "value": "e69f3cad1f3ddbf383b851fd2819d26d842bc2e5fc5db79579d544fa1c76538a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec55388f-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278113, "uuid": "163b68b9-0f4e-45d6-a3ce-46f99df3749a", "comment": "Malware payload", "value": "56b1e141128321e25ba27948f5c8ebb8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278113, "uuid": "2bcff388-7333-4a9d-96dd-dcb306812e90", "comment": "Malware payload", "value": "e710a07f188afeb42c31568337656bdc4fd6388a6b40c25e1fec7d8774fa473e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278113, "uuid": "7cfc35b6-b65b-4975-8784-264bad9145d4", "comment": "Malware payload", "value": "0e5d8dae171d17d95d5cfdb76b8dad4c7b5bd941", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278113, "uuid": "f258f33f-95d1-4442-a9be-5f00e334cafc", "comment": "Malware payload", "value": "a00113e3eafcee1c392e354166bc33b235d5eaf5cf14f03c7af0bd8d48419533df1e16874fcf41c3ecc9c26e7c420aa8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278113, "uuid": "40a8e3a1-20e7-469f-b55b-78673e3adeb4", "value": "T112A1F750112C1AB17646697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278113, "uuid": "d6ee5e9e-5b73-4679-a024-32eda3987762", "value": "96:4RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:4RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278113, "uuid": "94f339da-c70b-44fe-aceb-64ee5ac5216a", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278113, "uuid": "c2b5fd49-9616-46cf-9c6d-b9df886a01c8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278113, "uuid": "2242ea54-1e3d-475a-b5a8-ab202c8abbf5", "value": "e710a07f188afeb42c31568337656bdc4fd6388a6b40c25e1fec7d8774fa473e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade39942-b5a1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649246655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246655, "uuid": "9957a6df-49c6-447d-8989-55a9a13bd1d1", "comment": "Malware payload (AgentTesla)", "value": "a59ac2754c357397269adad6561ce79e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246655, "uuid": "f38092de-3c74-485d-84e8-be81de4b5696", "comment": "Malware payload (AgentTesla)", "value": "e80c22d89f182a9d2faa29f8fd1694841fd6d69bbad99aff9d6434a7aa3438c5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246655, "uuid": "a0e2b42c-16c9-47a5-aaab-cad2bff68b10", "comment": "Malware payload (AgentTesla)", "value": "7bf9d9cbb25821babca80a31565909aac741ce0a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246655, "uuid": "2de66b78-36f7-49dd-b969-e2f9a0307d2c", "comment": "Malware payload (AgentTesla)", "value": "fcdd3127001bc5e2f74ce7f4e769e220d94d05e0a59543f52b2b1ee300aefff94b372cdc2ccdfc6ed5644f37d9388d0b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246655, "uuid": "66cc1cdd-0aa5-4113-8e03-c8e875a2888e", "value": "T1DFC4121C67A7ED22CA7D65B3B4E6690103709A03E06BE71F1BC8619B0A037E74D52BD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246655, "uuid": "c0fd93c6-4cc8-49f9-a48b-7cc1dd4f58e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246655, "uuid": "160cb94d-2598-4e4d-9a18-b86bfca19a70", "value": "12288:0Qr5lO2IgtaeQxnv7KXW1kV7nVQBtv8gRr5XF:NrPygtaeanvemGJn2tkgJ5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246655, "uuid": "42767ad4-9e14-4533-8d64-bdffbb35687a", "value": 563200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246655, "uuid": "0cbc6e05-a09c-42ce-9200-90c36f44ed53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246655, "uuid": "fc0e263c-e288-4932-b1db-9c16fc48ef78", "value": "316977 C SKF-TALEB\u0130.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec28cdd-b5ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649257367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257367, "uuid": "474d39a7-b520-4d49-a92f-356d2d522e46", "comment": "Malware payload (SnakeKeylogger)", "value": "7ac88d744dc0308901487b0c8c1cee6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257367, "uuid": "4d7de4bf-0aff-4a02-8547-f8cdc9be2ab9", "comment": "Malware payload (SnakeKeylogger)", "value": "e829564a304290022c171e69c8a83395ceb1ce0de111a70485bd8fd002b4bdec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257367, "uuid": "da59c9f4-3def-453c-bfc8-33b7865d63df", "comment": "Malware payload (SnakeKeylogger)", "value": "790879f1cb131c68e5ed23f8fd0d1a804b6795f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257367, "uuid": "e3a12966-fd26-42dd-87ab-97d29a199374", "comment": "Malware payload (SnakeKeylogger)", "value": "43945fb0b54452ad1671454feebe9d0038100589656011cb2e6cec17331c813d6c1201ef62692734f4a9606bbe9a74aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257367, "uuid": "7c649275-5a02-46e1-9272-01ed4534fd2b", "value": "T1A7C4E012B6A6CF15C9B493F5D81092F80BB06D99D265E34B5DC9BCDB3A3ABC00E44763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257367, "uuid": "0e6e1de0-23ec-4960-9b8f-ba8c8601b22a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257367, "uuid": "9bf7bca7-068b-4653-bb5f-b373df9d3a1e", "value": "12288:nnSDDIW2XW2XW2XW2FvYPxyBLEIWiSzRjY:n6U7X7X7X7FvYIOzHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257367, "uuid": "7bdd2fad-8650-4e3f-8b5a-53f534f23ac4", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257367, "uuid": "d18d7b8a-cb2f-4392-8092-f419040c6290", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257367, "uuid": "75c79820-58b5-4d68-aef7-b32380b1c335", "value": "7ac88d744dc0308901487b0c8c1cee6f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ccd96f-b5e6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649276305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276305, "uuid": "713c11a4-91c0-420e-8331-6f1d4099c343", "comment": "Malware payload (Mirai)", "value": "401c437858e931995803993fccad12cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276305, "uuid": "a0326a16-a572-4f1c-8841-72027ec3dc77", "comment": "Malware payload (Mirai)", "value": "e987eebf89055c9daf6f52666baa4ddf55d2d4f77832068a3e3684cf6c9ee621", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276305, "uuid": "5c220657-b869-4fd3-86f8-4345015df40b", "comment": "Malware payload (Mirai)", "value": "955566ca0ff96c1b36bf975ed6dec16fa534395c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276305, "uuid": "482dc5f1-e59e-4931-9648-043480f3a09b", "comment": "Malware payload (Mirai)", "value": "6225ef1a3f57a28ac31e60d48f091ab5fca83ddbbbee9238e99279983bc646b4d0581708a70856621b8ddcb3e16d0a45", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276305, "uuid": "7a769655-6be2-45e0-a3b6-bb02503c2468", "value": "T12CB2CFB8F0250FA7EFBF5DF4A99B49D5ABF1591E1B2909A020C597073B13809531E8F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276305, "uuid": "da43f474-df86-4d48-9c97-06677c482963", "value": "384:cu1rAxQO0URgL5yHI0Ml4ttSNam9eN6snYgCJwmzHZM4uVcqgw05VxJs:ceAxQOHgL56O442XPCeYW4uVcqgw09y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649276305, "uuid": "c2cf92a4-a943-4578-bf5a-8d3c5e7af9b5", "value": 23900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649276305, "uuid": "a02fd47c-a782-401d-8817-b12246e95504", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276305, "uuid": "cea17bc3-0508-460b-8341-b29d47969de9", "value": "401c437858e931995803993fccad12cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a450d2-b5c3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649261054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261054, "uuid": "d8f57ffa-5201-40e3-af5a-4f0869f0496a", "comment": "Malware payload (Formbook)", "value": "fcb154b336e968c49ae9853a41b2c469", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261054, "uuid": "d42e6684-87ea-4699-b0fc-b07ee8ded9e2", "comment": "Malware payload (Formbook)", "value": "e9aa5ead78afd5f5b233ce0f83e8f5e9fac12c110ee558516d7239c31680c606", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261054, "uuid": "89a72132-75a9-47f7-ba97-02839860bb38", "comment": "Malware payload (Formbook)", "value": "6d199f3d73e544758762eeda8793e6c607083b6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649261054, "uuid": "5c722d7c-f4e3-420e-b40b-35d00fe001cd", "comment": "Malware payload (Formbook)", "value": "85bfb7be8361741c59fe57f2145fb9061f9e4074ac7ac256afb69b856298a5ee832b55c2f95ff60d7bf6302993407e72", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261054, "uuid": "738e8029-58b7-4462-840f-2dd85c43bf49", "value": "T127352385EAFAC162EDB49F336120D430B735E6F97E97821C149D25E3A6226D1C3780ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261054, "uuid": "b4931218-251c-4c0e-a948-6cb356691abc", "value": "98af55cea50542926ec50c986b130f44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261054, "uuid": "31b211cd-c9eb-4ee3-988b-15e4301df772", "value": "24576:374GNC7/ZbJJn5dFhd1hqm/TE10uhsRt97aSyKcOlZyMOyB:L4GNI/pJFjFXhL+0uhrSVr6MOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649261054, "uuid": "5eaa5a42-03d5-4993-849c-c17f09a50fba", "value": 1130360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649261054, "uuid": "57daf218-7dac-4a31-930d-f391fc38b4dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649261054, "uuid": "df637a05-65d1-48aa-9c18-01fd99fe4a19", "value": "fcb154b336e968c49ae9853a41b2c469", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91de8031-b5ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1649257345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257345, "uuid": "daf754ec-9b07-4b88-bb5a-f51ff6dd2b18", "comment": "Malware payload (AveMariaRAT)", "value": "59868d326c8790316288ac4f104b66b1", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257345, "uuid": "0727c664-bfdc-4d3a-a20b-3ea1218d79a3", "comment": "Malware payload (AveMariaRAT)", "value": "e9ac72abe09539d39453d6370227fb6b584ded9ea8dc79fe889d206d2f661acd", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257345, "uuid": "40db6761-39e2-428f-bfa3-da17608d67fe", "comment": "Malware payload (AveMariaRAT)", "value": "79aea46d9ff9747ee35e9e95e63b49b5363dc0c1", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257345, "uuid": "8fa1469d-cce5-454b-b076-c9db9cd15020", "comment": "Malware payload (AveMariaRAT)", "value": "4a53297155e57d3a553f53f424c34e87681f9755acecb015a6e36f88ef05285b670d55d2dcd614fa0f7c0f57120bcef9", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257345, "uuid": "29011a4d-f622-4168-a23f-ba21f77ffd5d", "value": "T129F4021E7AF5CE13C9A41AF584E62A1007B1F34AB173CF0A2DD902C94E533B69D4A797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257345, "uuid": "ede53fa1-e87f-49ad-80b5-fa351fdece98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257345, "uuid": "a86fb505-bbb5-45cd-bbb2-5444a057b029", "value": "12288:eBO9ZgMT7+iQtQkqxFYeAjJu7e4ooaJSbvovPWt2A3rQqCzm:AO9Zj+iQCkEiIopavo2prQqCzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257345, "uuid": "39096d8f-43ae-4a94-9ec7-78a4342220ae", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257345, "uuid": "3398a3b9-c805-447d-a98b-f7a4ee71a669", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257345, "uuid": "56b000e4-13cf-455d-b6a7-14de0a017289", "value": "59868d326c8790316288ac4f104b66b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1e58aa-b5a0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649246112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246112, "uuid": "185ca91b-e99a-495f-97b1-cd7d98025f36", "comment": "Malware payload (Formbook)", "value": "2f1e7ca21a15eeca3391d69f899b2a07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246112, "uuid": "d7c0ed6a-33c4-46dd-a3de-7b0ddb266603", "comment": "Malware payload (Formbook)", "value": "e9b9b1c8e972c4882a540641d04979d3c7d6c762ee64707a1a2b147d06a43326", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246112, "uuid": "add5d70d-05f5-428b-ae40-a84641035327", "comment": "Malware payload (Formbook)", "value": "1240a5a6dcd47c47e36c41a5aa46e05abd92219e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246112, "uuid": "135b49e2-29cc-40aa-bfaf-b8402589c42b", "comment": "Malware payload (Formbook)", "value": "55360258fb9b4e4a362f0651be2fea7ec296ace396e52e25cb97cc5c798568f64d6d76265c0a1eca55af3cd7adc537ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246112, "uuid": "4cdf7bc6-736e-46f6-bb4e-f4f786d853d8", "value": "T1B4159E62B1924933D0732A3B7D1B567859367F057E28B94A2FF43C485FBA24239392D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246112, "uuid": "ba5bb0a1-aab5-4d5f-9ace-ec65a7c07b9b", "value": "e2cb83827e1125c5618e1207782dc0e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246112, "uuid": "82fda226-f1f4-45f4-bca5-f37456dfb9db", "value": "12288:emdY/VmgU/BLiB+neZyCMc3501+5QKj1u6XU3OolQn5TvEkQ2h2+TnwcBz:zdEgGB7/9+1+aK9U365TvGywcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246112, "uuid": "8bbb825d-8592-499a-a465-0352454ffd21", "value": 933888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246112, "uuid": "d2383c32-b4b8-45f3-957d-6011dc59c33c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246112, "uuid": "fddb978f-f3de-4176-8d52-b598e0b53f17", "value": "Order confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29234548-b5e4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649275208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275208, "uuid": "0fe41f1c-f36f-4d86-a2aa-5c6da8ab4ae9", "comment": "Malware payload (Mirai)", "value": "bed287254b2216e53eb250a17098209b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275208, "uuid": "d3d063e1-0751-4352-a43d-0e14fc01ee65", "comment": "Malware payload (Mirai)", "value": "ea01b4f4fb4696048e8b3119c54c3b7e1c117c44e8408e380a8525240e3d99e1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275208, "uuid": "65523ea0-6441-4326-a23d-b1373cdc9994", "comment": "Malware payload (Mirai)", "value": "7e40c9920d02445420f22f81dc0160b57f3a9d26", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275208, "uuid": "c20a5dfc-3669-452b-a2c5-e3a567f1f7cb", "comment": "Malware payload (Mirai)", "value": "79ec5700a0d23d073bd861a64a8a28ff9fd2c3b1c142b58038a261f10dcc2f856740164b731783cfcd5516b8c0f6d7e7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649275208, "uuid": "bbbcaf84-bdb3-41a4-9f4e-8fd33a17e70d", "value": "T14D532A85BCA1D626C7C453B7FE1F018D371493D8D1EF3202AD285FA4768B81E0E6769A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649275208, "uuid": "81eca733-c34d-404f-aaf8-180727007b22", "value": "1536:HN5mtgbxqRVe1THSI0yf4wZ+pkwhciB7gCB:HN5mtgY61DSIJF5EciB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649275208, "uuid": "5050a4ce-d83c-441f-8971-a2214b732723", "value": 64996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649275208, "uuid": "4ca1882a-78e1-4e66-9185-5f90eb86aac9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649275208, "uuid": "72f4dc94-899a-4848-8a09-a1541657f1b1", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0af28fe-b5e2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649274604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274604, "uuid": "75f77165-0aa8-4080-bf12-f0f6599f7149", "comment": "Malware payload (Mirai)", "value": "f649024bb88819c559615b113cb1067a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274604, "uuid": "4f98f59d-870f-49b9-90fd-94e923b07b22", "comment": "Malware payload (Mirai)", "value": "ea15831018fd97534620b88ef57c348bba7bf63bb6cbb306b2225bdf44b7227f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274604, "uuid": "db1e7631-e16d-4de2-9d3c-da87e1e56a80", "comment": "Malware payload (Mirai)", "value": "83c86bd4e9b005e994805bc173611d373f38f019", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274604, "uuid": "5195ce3a-6bbe-4dd9-aaaa-4bee8a2ce75d", "comment": "Malware payload (Mirai)", "value": "de30b1c9f22fa9147dc66069f21a2c40752867ac2545c06a7b3509fee26d0b4bf2421c75f433238c8309afae6afb8477", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274604, "uuid": "f9decb75-f9a1-48e7-96f1-7d4b8249efee", "value": "T100A2D027B1C38E8BC51BD27EE12D8C795C297E56438EE11F2DA805D396891ECDB7040A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274604, "uuid": "8fb13ed6-e4d0-4bc6-a082-fbec0d7b94cf", "value": "384:M3Tua+Hgb2d7OV9xmYTkMjfxVwbg7OSQ6Lc5t0RUiVxK87laTumpgUgIyLv1Rt:qX+Hgb4Obdn7xVAg7OfOIt0Si7taTumu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274604, "uuid": "643893cc-f420-4945-b4c0-d92db7d569b9", "value": 22604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274604, "uuid": "9f6da99a-9e1b-4ba8-94fd-1e3883976a94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274604, "uuid": "19cca8e1-d3cc-4a35-ae9b-678124486e90", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "665f403a-b5a0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649246105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246105, "uuid": "a3a60288-962a-47cf-a31d-d7b27f9063bb", "comment": "Malware payload (Formbook)", "value": "9b18c55f441442f2a6a03534a374d7d2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246105, "uuid": "79c46a90-9629-4eed-9cbd-2f85c428835e", "comment": "Malware payload (Formbook)", "value": "ea15ede936758ef65f4641cd2ac14ce93ec9d76ddfec4a2d6ec542db8fdc57b2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246105, "uuid": "a4570177-2a32-4169-a6c1-6573c813242f", "comment": "Malware payload (Formbook)", "value": "61cf97f315cccca05ec3e2ea7d43e19680bd52ab", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246105, "uuid": "3f7ca3a9-161a-408b-aa59-d9bccb0f2a68", "comment": "Malware payload (Formbook)", "value": "aad228b46fccd0d927e7cfc15ef9919786b3137fbab671661a52f922f0c378bc8d5a52fd0b72423647c4f322c80d360d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246105, "uuid": "306b3e63-b638-43d5-a013-a6b8773fe325", "value": "T1ADB423D789E54F29A50179386B8EBEE7B09DE1014EA2B54E7418B6F851018BBF78C10E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246105, "uuid": "701dd1a9-93f8-4aff-abd0-ea7ba4b0cd35", "value": "12288:hANjd3j2JF6qcp42fPR5fTzvRdYyQ9g5y+3jDY+XKkHjGg:gZT2J8P22D/YZ9n+zZXnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246105, "uuid": "fb94b394-a156-4d27-a43b-d48a6238ce3d", "value": 507234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246105, "uuid": "b73a692d-164a-4a04-9fa0-6a5f47b34e19", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246105, "uuid": "f813eacd-5775-40c8-afa2-8d2103eacb73", "value": "Order%0D%0A confirmation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed04a392-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278114, "uuid": "61ab4c26-fcbe-4995-8b7a-fbf5fb2dc90b", "comment": "Malware payload", "value": "a57d97b20076a62969ec87e4b0056dbf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278114, "uuid": "a9893231-0361-4105-9bbb-8ded94f59c41", "comment": "Malware payload", "value": "ea3c223fef8527593c5eac2a29bb1c1b9365eda558c82a99a263772b27583a8f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278114, "uuid": "2e7c9114-e1d5-4677-af57-77cdab1aa68a", "comment": "Malware payload", "value": "951f31d3094b65e98d315e6fbde4964aa01d4839", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278114, "uuid": "6a05afad-ffda-4324-a1af-0510c9a402f4", "comment": "Malware payload", "value": "ee6cdb8df92a8c8e8c0f1c36426d60416194a2ab02ecc226975778cd2c8780242d0c97d8ebeb5518a7eb0f2bc4012fd0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278114, "uuid": "2c5aab8d-2327-4823-a84e-23a5039e4a0c", "value": "T13D4145C602422171ECB69DBEB675451530F0A09A9ECCBA05E9E4F4B9414DF2AA5C7B43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278114, "uuid": "c330f31c-923c-49d4-acba-6b93808b6f88", "value": "48:vDWcWvDWHWKDWVoW7DWoWXDWEWDJDWzWSDWHWCDWyW3DWLW1oDWEtWEdKDWZWj:vD5YD0HDxaDxcD78DMnDGNDlCDaZDXCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278114, "uuid": "5606d302-4aaf-4340-93b6-b5eadc2d8532", "value": 2214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278114, "uuid": "a2de4856-6263-4d4c-a493-ed0147a95a53", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278114, "uuid": "63c71180-26c3-4e68-a237-7a66610c1461", "value": "ea3c223fef8527593c5eac2a29bb1c1b9365eda558c82a99a263772b27583a8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee65c72d-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278116, "uuid": "9b75a06d-925c-42f5-97ea-d254ab0a8e54", "comment": "Malware payload", "value": "8620e8e50bb20585dd59cb3aa28d902e", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278116, "uuid": "ca99779d-f00c-4737-8b5e-f3441e47bb79", "comment": "Malware payload", "value": "ea7af49cbd6feb559c602d608fe6ade8cdd348e595884ed5e62df4a4c1f8b3ad", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278116, "uuid": "b34a7dee-9c72-4772-805b-d8f47e19ccdd", "comment": "Malware payload", "value": "f41021fa1680b04eba7026ade89a9096a7ca214a", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278116, "uuid": "60eb7ee3-4176-41fb-bc7f-151e6ab1da31", "comment": "Malware payload", "value": "4966bb938af6e1ee893ee39e03280786f4c141554ba3579bd3934dc867f300dd15d39afac1db9ad9ed1a5de5888e2d78", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278116, "uuid": "fc9a3fbf-0aa2-483c-b884-e3c8ba67f0f2", "value": "T196C5330C13ABBCFDF99E052927638DA5C1BD91E0B58260A3D76418985C3F57E13CF962", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278116, "uuid": "70c0138b-306a-4ed3-aab4-12fb5e8d6ab8", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprcM58YdL4/:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278116, "uuid": "a71529ed-39b3-45f8-855b-d93ee708d542", "value": 2732032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278116, "uuid": "28b35563-7e47-4c0f-bb3f-5ccbf8a451a9", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278116, "uuid": "036ce956-afac-4421-aa42-1ea8a9b5e804", "value": "ea7af49cbd6feb559c602d608fe6ade8cdd348e595884ed5e62df4a4c1f8b3ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0238d31-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278119, "uuid": "fa59d285-23ac-4b86-833c-0658db88c563", "comment": "Malware payload", "value": "2bb380b8b50d605548668715c6898122", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278119, "uuid": "15501ebe-1614-4a05-b48a-8e9520aab748", "comment": "Malware payload", "value": "ea9340d0c496a2b319b75ccb593cd02d6fcd47a9ad061a97c2e55f54a7c383f5", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278119, "uuid": "2ca01750-bd74-4150-b2eb-7c9f872f9bd3", "comment": "Malware payload", "value": "2e56799bad86784497bf9076bd09ed0d42a619c8", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278119, "uuid": "d266dbc1-bc04-40d6-9cb5-7ce97c26e845", "comment": "Malware payload", "value": "2a4c30368ad2631f601c7f0707b4f94da17082a6ac800942c9d8fbf0bbd3ef32847442c3b21ccc0dbe7227ec64b98068", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278119, "uuid": "f5061893-305f-4cc2-8859-406ea4c62de4", "value": "T192B5330C0379BCFDF95E46292B634EE1C1B9A1E1F44261A2D67408A85D3F5BD03EF962", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278119, "uuid": "8d2c8613-93a2-4dea-9cd2-dab82f56c7ae", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprcM5c:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278119, "uuid": "8def4fee-e69f-4e01-92e5-c52ef80733a2", "value": 2433024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278119, "uuid": "5f9ce345-2396-4860-a5b2-1b60e9485079", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278119, "uuid": "6d135024-a3a4-4d2b-9d56-ff72f2ff130f", "value": "ea9340d0c496a2b319b75ccb593cd02d6fcd47a9ad061a97c2e55f54a7c383f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2712395a-b5a2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649246858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246858, "uuid": "0319e609-ef42-42c4-b679-96728d81ade2", "comment": "Malware payload (Formbook)", "value": "55b32f8cb1bcd6ffd791d8a3bbba9a0f", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246858, "uuid": "22b95d15-dd48-4ba3-907c-a1e8e7e31dfe", "comment": "Malware payload (Formbook)", "value": "eb32e1adeeeba5d510e2605abd244a56518d55527a4880854e92b4208e412ad6", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246858, "uuid": "e62ed514-325c-4684-af57-e7871c082343", "comment": "Malware payload (Formbook)", "value": "7331860136ea049a133616b4212e785bbbb94473", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246858, "uuid": "bc9044ef-26c3-4b96-83ba-d52057ffce5c", "comment": "Malware payload (Formbook)", "value": "4b8efe86c228f9488582f8f948f57aed08024f519b8930cb47ebc1d6be9423659b88205c8eb9697cd95477fbf81b58e4", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246858, "uuid": "4f5b429a-2192-4fb8-a001-055c65aeaf68", "value": "T125A423E597B66BC7AECE0C6ED1BB5B8C3396732EA24405A3F7790D72B45A94054E0C80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246858, "uuid": "195e5d06-a60c-4b9e-86ca-cb6ddceeeb5d", "value": "12288:nlsDinudvuLFwYnb8OxDEVcgsiI/IZVT+r0EiY9Cs:lwlvuBpQQEVD5ukU09Y9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246858, "uuid": "a3e91d1b-3c95-48ca-8c4b-b16bf11dfae6", "value": 458814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246858, "uuid": "dffbc888-37aa-4576-8d24-43cafe71020b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246858, "uuid": "7e1740f5-82f8-4be5-b5f0-52331e64573d", "value": "Payment Advice doc.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0990d22-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278120, "uuid": "9a4e8820-b9ed-456d-80e6-76d93570850f", "comment": "Malware payload", "value": "ce6138bab525fdb54093c689633c23ce", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278120, "uuid": "daa9f595-b3c9-4ba1-84d2-64b622ba00da", "comment": "Malware payload", "value": "eb5125f4736f54160dc9441adeb4cb5987025807d574916b14bf03a13ee12fc8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278120, "uuid": "40a721d4-e1cb-417c-9b87-f9b9c416bb6a", "comment": "Malware payload", "value": "4458474cc0561c7426848737aa86ee9bfcaa053b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278120, "uuid": "954298cf-24f6-4540-9010-8afba699aa70", "comment": "Malware payload", "value": "a49170778848c052324ce49ea260729d6cc1752c04e9afc1c87766d03d2c506e52a388dd1994fd377b1204b1402701c1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278120, "uuid": "6fb0a076-9663-4001-b2d2-e81e536bd0ab", "value": "T1B4A1E850112C1AB17346597AD26FFA52B50EC81B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278120, "uuid": "47114565-ec59-4e63-8f61-73a402264fed", "value": "96:3RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:3RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278120, "uuid": "88b16dab-d820-4dfc-ab40-33705027cf78", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278120, "uuid": "8966165d-b88f-4135-929d-208ffe2d035f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278120, "uuid": "2e65f402-81bc-4e63-b61d-73b27e17fbe7", "value": "eb5125f4736f54160dc9441adeb4cb5987025807d574916b14bf03a13ee12fc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f10f987c-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278121, "uuid": "7647f085-ca23-45fe-8161-7158e1d8bde5", "comment": "Malware payload", "value": "19a5fbfb4078fafa1be2d7a9e0f153c7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278121, "uuid": "92d54423-fac9-4112-91a4-0d3aa306075f", "comment": "Malware payload", "value": "eba3d0b14c1b45dc2d285c6cd1854809e82a368f51de2a730fb17374a4902dfb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278121, "uuid": "d387a9de-64b2-44c0-b12f-58d16bf15b4a", "comment": "Malware payload", "value": "dfa5d5dbc84bed7f5f5986551a958d11fe167a75", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278121, "uuid": "98bb672b-9e08-47a6-ab0b-4b9f24c2160f", "comment": "Malware payload", "value": "fdbe4685338388faca24184a55ae4c57deba4e17d09162707ceaf56d5f4740ff36c24a81c51639f29d3adfdce5e6d193", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278121, "uuid": "a25f86f8-3d22-487a-9b37-738226001a4d", "value": "T12EA1E750112C1AB17346697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278121, "uuid": "a48e1628-db70-48d2-be80-4185c20f07ec", "value": "96:dRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:dRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278121, "uuid": "c11e556d-8787-44aa-b9e5-fabd98485010", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278121, "uuid": "f2ea1526-ace6-412e-ab1a-703409312248", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278121, "uuid": "a78ee288-9a76-4727-ba73-95c25f464343", "value": "eba3d0b14c1b45dc2d285c6cd1854809e82a368f51de2a730fb17374a4902dfb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5319cf4a-b59f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649245644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245644, "uuid": "b9cc1080-f027-45b1-af07-17232285195c", "comment": "Malware payload (AgentTesla)", "value": "2bf13792a8954757d15e272fa9d7ef7a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245644, "uuid": "bd4e47c1-8053-44d0-9a5a-de53309ffd29", "comment": "Malware payload (AgentTesla)", "value": "ebdc733eb18c94758c2116b89b9c02380543b922a18d3287a72e9348f1ae89a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245644, "uuid": "56ce42e5-7f65-4dc5-89e6-266d3c7bb5d6", "comment": "Malware payload (AgentTesla)", "value": "d33f7eca3a9cbc1fccb6605bf16b9fe647dca66b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245644, "uuid": "26f3df9a-400d-4a9b-8753-3335af3bce57", "comment": "Malware payload (AgentTesla)", "value": "54c070fdd210ddc0202e531e8eade2e05f4e2c1df0249419ba5e537700840628edfc21d2c51b6eb370731918df9982df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245644, "uuid": "80b38a47-8b67-446e-859a-38498d38ac39", "value": "T1A28423903CB036419DA2E37659A4605D0ECDFB0E0AED56AB74F0D8CFE1F068983D6C66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245644, "uuid": "ad6a167d-8591-49c5-9362-7e67e0d37d22", "value": "6144:WTOZazVV9pLzxvmGY8lPtcXX/tvY6dkQYrX0AaIqT5qU1m+BGRUsHH6An3y:WiZaBVTvkG1PtG1zd2rj3sL1BURtnfC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649245644, "uuid": "67eb0da3-d11a-4402-8cba-fadcaa26611e", "value": 398161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649245644, "uuid": "96ccbcd5-570d-435e-be96-e56deb697d56", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245644, "uuid": "6cf74778-1d7a-4a47-9c31-27e35ff190a7", "value": "BL AZOV.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9467fb3f-b5ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649257350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257350, "uuid": "3cf3232e-05e7-4a95-b702-3811d9324fc2", "comment": "Malware payload (SnakeKeylogger)", "value": "bd88f5ca5eec2a2cabd9c2da2a9b4ef7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257350, "uuid": "9abf596f-bf33-48ce-b528-a3a400bcfacd", "comment": "Malware payload (SnakeKeylogger)", "value": "ebdf124b6e7420a794061161521a5d0227647d3c3c18a8ff680f20067bb9882f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257350, "uuid": "cf9b4190-1b99-4674-ae5e-ac5b714ed1c4", "comment": "Malware payload (SnakeKeylogger)", "value": "41a53a7ed7fb1a49ede6da1d2866cb656694f690", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257350, "uuid": "732aadbb-5d28-4c7d-8438-42a4c9aad128", "comment": "Malware payload (SnakeKeylogger)", "value": "fc62c70ecb9c134b0614362bc7c2f6de6fb9a0238509d4a2403ed1b88c7c36765996e41c0d3f57e4bbd97e8cb337cab0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257350, "uuid": "c29e35df-992e-4c15-981e-f7739e188792", "value": "T13685D51B617DC4D1F98CAEB4C4BA179516309E2645B5A703E3BF38A8C47B3ABDD016C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257350, "uuid": "162c01e2-0da3-4830-a5d8-dfe8a836c724", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257350, "uuid": "2aaa82b1-24b3-4b19-891e-0dec6583f5f1", "value": "24576:XOYIFAIu83P3+qKmjAJbWn0GUPQZdxJVP66NMQCd5L:XO97ROqKvJbE0uP6u+d5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257350, "uuid": "10edf0e9-d2b0-4811-80d7-fe92aa596edd", "value": 1858048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257350, "uuid": "ec1b02eb-e000-4c3a-b930-603f13e6d9e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257350, "uuid": "e68d8781-db2e-4628-8d85-ba674340dcfb", "value": "bd88f5ca5eec2a2cabd9c2da2a9b4ef7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ce41946-b5bc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649258008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258008, "uuid": "b415b5e8-a23f-42b9-a841-ce6b33cf68f0", "comment": "Malware payload (Formbook)", "value": "2f976c05351f4e307d0829dcac829ceb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258008, "uuid": "ac836c06-598f-47bf-bb4b-d7591546d288", "comment": "Malware payload (Formbook)", "value": "ec36d17d14bd6cd291e3019042a313d0e8465cfa825f280d51551eb91f828945", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258008, "uuid": "97db5d78-fcc7-488e-a6d5-390efacff981", "comment": "Malware payload (Formbook)", "value": "113143c4a786028cf664b91ab44d3f36214afa0b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258008, "uuid": "725d7955-774d-4b5d-9e8f-4808417d0eb1", "comment": "Malware payload (Formbook)", "value": "6289bda5d362c3438e514b04b0c3f0f04c8a87731637ea069d31d11266b33b5a20b36d4ee880cfbe02f87f0b4e0a563d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258008, "uuid": "f4d062e2-c6bb-45c3-a3fe-163f6a51a250", "value": "T1F2141241A606CD57E3DA383009F0912D15F5BF1EEF0D4B7E4A477E96BB31A808966728", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258008, "uuid": "4b36ce24-5a44-4cc6-88d1-036747c59926", "value": "3072:J3QJKZ1XVV40cRAvMjNhkx/l8hDcAoIB/D7XY34RtgLwHCOWyMJG/dcuPEulE9PM:DV5cu/98l3/F7XYIRtCOMI6Tp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649258008, "uuid": "7eb75739-48cf-4f2d-8d0c-7bc268d9d3cb", "value": 192088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649258008, "uuid": "4e2f94e2-21b8-4690-8703-84846cd08bb6", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258008, "uuid": "1aaeed2c-ef51-4ad2-b304-556d564625dc", "value": "Payment Advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e33561-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278122, "uuid": "06462d33-072a-44b0-83a8-05635de91e35", "comment": "Malware payload", "value": "575a2f3aadd9147a87ba6232f186032e", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278122, "uuid": "1ffa88c4-0fcb-4b68-823c-242ec3b3fa1a", "comment": "Malware payload", "value": "ec719c4a8b068a63d0eef66c0ff8f8435b817062efbbd59d1e41fedc717e90ed", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278122, "uuid": "68d8b17a-0297-4f96-8af7-4ea9bc36d3af", "comment": "Malware payload", "value": "c2480975ab135bd417524dcd099a27c86df0d24b", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278122, "uuid": "2115269d-6406-4c96-8e00-4a9add6d1af0", "comment": "Malware payload", "value": "a03a99012ed97f46970754cfce15ceb5795718a736e310225918ab0ec97a35ab17dff03fc7d9ce53f6e9569d976f42fb", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278122, "uuid": "57335db1-056c-47cd-996c-aa6ee752869a", "value": "T1882533D423A2EC7ECCB9204A2686B15F15F13F55F232930F949486DA1B1D32A5F9C7AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278122, "uuid": "98f8ebf5-2db5-4921-8128-6a9cd9796dab", "value": "24576:q1+oX3Hxnnko/Y4t7pDQjX0aKgNzfDoP2MNUlYO:q1XHxnnkot7KjX0aKgxC2Iqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278122, "uuid": "94af773e-612c-4de7-a0c5-40e4dcbf893a", "value": 999424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278122, "uuid": "3f57dffe-bb88-42d6-a84a-ead738f99538", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278122, "uuid": "031eeb26-2bd2-4dc3-b80d-d9bd23cafb47", "value": "ec719c4a8b068a63d0eef66c0ff8f8435b817062efbbd59d1e41fedc717e90ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebee24a9-b581-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1649233015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649233015, "uuid": "ddc03dcb-cf4d-4547-adaf-95c7b2522357", "comment": "Malware payload (NanoCore)", "value": "a0678a59a132ec1307b78306ccd56a2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649233015, "uuid": "39ed9487-1dfb-43da-911e-d2897fb0bfa7", "comment": "Malware payload (NanoCore)", "value": "ec81c8de8fb62f7d5c83d14a27ac15784665d4acd0afeb060b6d266fe32404e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649233015, "uuid": "47a171a9-cee9-43ab-a872-f96db786a791", "comment": "Malware payload (NanoCore)", "value": "a3df5499fe222d0d15f20acb6da1e9eb0ce88fa6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649233015, "uuid": "5ad23a40-946c-44ae-9110-9f77633d8440", "comment": "Malware payload (NanoCore)", "value": "63cbd9d2e5db4cb74092df646d0c70e0396e229aaf93d933dcf0753ef005ad50f4e514ccef4a84b704697c8b976889f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649233015, "uuid": "f699f187-020f-4722-b8a1-f51985341443", "value": "T10854126C6790803BE11747B9077E626F9EF3991C64A58A2F83209E8A36371D3C51DB23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649233015, "uuid": "fdb5fe15-a5c0-4f93-9dbf-e866d2ce864a", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649233015, "uuid": "eda1ab88-eceb-4d85-bd61-439abd308440", "value": "6144:HNeZmbtuMEFClci37iE3tz+e44gKcQJLPxdQbjQZrGY4L:HNlJuMEFCCG2E9z+9oJPxqbjQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649233015, "uuid": "8bc12d42-1b1d-4069-86e3-cd366511f5e1", "value": 294074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649233015, "uuid": "f7100aa5-a88f-45a3-9f2f-9a0575747159", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649233015, "uuid": "512c62c9-d164-43e7-a2eb-292c579fe7ed", "value": "32421032421162307.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f27be8b5-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278123, "uuid": "121600b0-933a-4432-9e38-7495f7151472", "comment": "Malware payload", "value": "500ff75eee017bf6c8309f9966fb4859", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278123, "uuid": "55f7f629-e55b-4ece-a595-65ef8eb7417d", "comment": "Malware payload", "value": "ec9b115233b21cbbd7d565d15ffae13f97d9b915cc3889a0f451a9d83b4afde8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278123, "uuid": "6b57ff5b-d8c3-4098-ab2a-6ba7d9c491dd", "comment": "Malware payload", "value": "1bd3d1b5bff4b1550ff46b8a9fd2c71519968cbf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278123, "uuid": "0661cfed-9d35-4cf9-aa9c-a68ecd8d52fc", "comment": "Malware payload", "value": "9806be85fc8a16a1a24d83636997399e55bceaa12f0b42f9b2bbf8c57af753d3875cbf9bd7dc319613e6cae1ea48d634", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278123, "uuid": "91e25b98-06aa-4c7a-82ca-74888980dde8", "value": "T1F03180C031E631B83DB618B7A729295431D550B72C92AD4C68E4F4F588CEE45ADE0AEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278123, "uuid": "628ce0ff-3ea4-488e-80cf-4a42cc808dc8", "value": "12:JCkmoHNqPMemmoUKQYQbemmoTMf+emmooNSemmoSN3emmo8/cemmoe5emmosrdeZ:IjyNoAm2D+mKMmm9wmDmzImtmHmCmiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278123, "uuid": "639effbf-ec66-44f3-993c-6f46181c9892", "value": 1850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278123, "uuid": "3d529b81-ba53-49f7-aae0-c2e66e3ed95d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278123, "uuid": "156dd557-ffcd-4a68-9af1-1ebdd5ca5f86", "value": "ec9b115233b21cbbd7d565d15ffae13f97d9b915cc3889a0f451a9d83b4afde8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f35beff8-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278125, "uuid": "c23dc351-5d58-44b6-bd67-892182f7f4e8", "comment": "Malware payload", "value": "769e6b8da459fe76c6609aa4b4acea11", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278125, "uuid": "12531e87-4e4a-490f-a703-f1f3640fec09", "comment": "Malware payload", "value": "ecd53c68ffbe7f19794a42a457fd2d1208a2b55c0f3a8a6f137a2cd15ff6760e", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278125, "uuid": "9f06245a-2249-4de4-b568-ba4df6905ce2", "comment": "Malware payload", "value": "9aa304b47fdb14c27ecd6b5ab51dbc06457905ab", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278125, "uuid": "4daf30fc-8026-4cde-9beb-d303e0ccb501", "comment": "Malware payload", "value": "823a7e2ca0554828adc08049c11a716d2f66d1d5c0beb656040ab82469131f03ddc173a5f88d55813cd374697bce99b2", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278125, "uuid": "d655c97d-fbe3-4160-809d-386627344f05", "value": "T11DA5330C527578FCFD5E062937634EE0C2ADB2E5F94221D2A2641CA85D3F5BD03AF962", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278125, "uuid": "6e56609c-fb96-4ee8-b8b6-5f5fb1a90cd5", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfpK:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278125, "uuid": "df7aec13-aed6-4a46-85a6-70c2a32dbff1", "value": 2252800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278125, "uuid": "7de35635-bff2-4cdf-8353-255179b56f0c", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278125, "uuid": "89479431-2ef8-4650-9dc1-475833c29b65", "value": "ecd53c68ffbe7f19794a42a457fd2d1208a2b55c0f3a8a6f137a2cd15ff6760e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7002ff6-b548-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1649208445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649208445, "uuid": "5a76ef5a-2904-4f5c-bc77-132ae848cf48", "comment": "Malware payload (RedLineStealer)", "value": "8af50bf6484099e499fe52bd63aa5984", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649208445, "uuid": "727c9060-a4f7-4d60-97c2-3b66f6e3f329", "comment": "Malware payload (RedLineStealer)", "value": "edac570132e4c737462b9dc190018490b70d97f36ce68892e9661cb2c7708a6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649208445, "uuid": "5d1756dd-74f9-4554-913f-75b8408472ed", "comment": "Malware payload (RedLineStealer)", "value": "1bffed55f7fb29f2b05a5d58e16edfe552bb7f50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649208445, "uuid": "c1c68a60-d8f0-4a29-bb6c-94770fa4e122", "comment": "Malware payload (RedLineStealer)", "value": "e1cdd7c4f41dfac8564302fbe0817d1acbff0dfa494df4c504d920f31a6b85c51339ce4a5393e04033b101bfca484db4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649208445, "uuid": "0c98e442-31dc-44c9-8dee-1b36d2282b9a", "value": "T1BE94E1C637928470C4117E31A4A5CFB12A3F7872E674951BF7B89B2E5E603C06AB5B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649208445, "uuid": "28e885d4-90dd-4818-a2ea-f81d0e121530", "value": "3e1371bce2a7dabfc48c6aff7cfba706", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649208445, "uuid": "dec9413a-4d29-4bc1-a0e4-a1fa1e09e66a", "value": "6144:SKD5/okrQiZ9iQLOPC2A+lxW5hYhmcOf5S2r5r44qD0Q7ITsq7igah:SKDdokBZ9F2TlxWUEcOxSQpYoQ79J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649208445, "uuid": "013a4f20-2942-440b-b29a-973ff697dcb7", "value": 419328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649208445, "uuid": "cb40ac95-b12b-4829-ace2-71db0cabdba2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649208445, "uuid": "87b4db78-5ea2-4fbf-af40-1951558972f7", "value": "8af50bf6484099e499fe52bd63aa5984.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a1ab2b-b604-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649289002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649289002, "uuid": "2d9ef32d-91fa-427a-857f-0fc31222e0cf", "comment": "Malware payload", "value": "9473335efad8e3ba312a0416bdc6cfb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649289002, "uuid": "7a1e30d2-a0ed-4f50-8e44-30cd65e318f7", "comment": "Malware payload", "value": "edff28749ed42411eb3dc82e356b6422fe75c57771d24420274b308f09109c19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649289002, "uuid": "3f9adf7b-c847-47a6-8e3c-ad407cdc0158", "comment": "Malware payload", "value": "dde2d9852ec12403b60dfc8159369337bba463e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649289002, "uuid": "59a032e0-af0d-4161-a858-e0a245045f20", "comment": "Malware payload", "value": "87f71ba39e10e11ed8adcc89323469c46d40a1c5e31f290282df930cab4ea197c5bd016dfc2e36a3e8af3560099063ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Vovabol", "colour": "#23B0B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649289002, "uuid": "9a87f42e-838d-4e58-9b96-a0524002cecc", "value": "T1FD64BF93A3648561E7184579A813C8B5183D7F359B03762BA3E1BECF3AB0247366532F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649289002, "uuid": "21261295-6bf5-493f-a3de-92b13d3ac907", "value": "a758f977f5c6bfb8c4eb2cdb0c48b781", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649289002, "uuid": "e1867275-f966-4e9c-b876-7c7c047b467c", "value": "6144:ymEdSunAqHdroKcykhPBbiMV5xzr2fXBPxppY9N:y4ujKyUp+gO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649289002, "uuid": "b149abe1-70dd-4644-b4f0-4c821ebbddc5", "value": 323584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649289002, "uuid": "5b6d9ae2-2dd1-44c9-b418-ee88c8eb71c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649289002, "uuid": "d6259cef-f268-4131-ab17-58051ba7cd50", "value": "edff28749ed42411eb3dc82e356b6422fe75c57771d24420274b308f09109c19.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2660ab8b-b5e4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649275204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275204, "uuid": "4f437cb8-9967-4144-8df4-b12fa0d2dc5a", "comment": "Malware payload (Mirai)", "value": "627f3b29898d8dc68ba705b406e37cf8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275204, "uuid": "2d1ba68f-f600-4f11-a63f-08d4e3135f8d", "comment": "Malware payload (Mirai)", "value": "ee1655c81559e97605e841510b50aa4be2fca70424ba923cb079d6cdb3967953", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275204, "uuid": "0a9e5037-23b4-49fd-b347-7cd468c73fce", "comment": "Malware payload (Mirai)", "value": "486a9fca48609b6c1e02079d4d1e853b73fcc689", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275204, "uuid": "bf043554-9e48-4b08-a139-a67301352768", "comment": "Malware payload (Mirai)", "value": "e59ae2267b8fc19f5626c313b0e85963c807897f52b31f7d210e93aed1e3b779040a564593a93504696451a11bbda099", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649275204, "uuid": "d111005a-3889-4598-8f63-9d233b57c6bd", "value": "T1EE23F139A80386129E20953CF85B49406E158BECD9F27426835473FE74EA2B35DEE8D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649275204, "uuid": "9af2e12d-a567-4260-8872-852c7f1574ca", "value": "768:y1LmPdMRrITER0IiQ/Ww+Y0Ptvd+2eSh5VihxJ+zJeA3ybxZR8/x9q3UELr9oqDX:yJmVC0QRtnt0PtVCxG30zGkL5t8Xzh6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649275204, "uuid": "473d4f85-9e94-45cf-a3bb-fa6cc5951261", "value": 48732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649275204, "uuid": "9bbbf891-4157-4973-b068-9a4113f8cc29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649275204, "uuid": "f85aa23b-03ea-4d75-a1e0-4975b06456c6", "value": "phantom.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc34e843-b5bb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649257899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257899, "uuid": "7307b329-a599-4b63-acae-65c86aa77412", "comment": "Malware payload (Formbook)", "value": "b4272b04a3e1677b897cdd459c793934", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257899, "uuid": "df4f9aea-010c-4195-be9b-6988a71cf17c", "comment": "Malware payload (Formbook)", "value": "eeb670a15a7e86df96a4dfe152558d62a32cfc197c17228c76bd395911e6cf7d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257899, "uuid": "17c6d641-f40b-4cad-b13f-06d24baead0c", "comment": "Malware payload (Formbook)", "value": "b16c0e1e0f7f57474c1581597e2a7423eccaaacb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257899, "uuid": "6e12e397-9d22-4a42-ac7c-c41eaf9de2b3", "comment": "Malware payload (Formbook)", "value": "75e87ca1378c698c5c8052045f763bfb04792f33d0cccb30ef2a237ea8c4a197b57340b8e772838a953c20dcb45d15ab", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257899, "uuid": "7d17263b-4b84-4c93-9cef-7a1f1324d3d3", "value": "T16D14121A376D0793F5C16BF4918ED06D4667EC54563325042389FBFF86322BEAED28A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257899, "uuid": "055c6a85-ecd9-41ab-8187-f4fba5373c12", "value": "3072:WWAfF8p5uo9m4hlhVwDOMbMWT4YJCfieAEa5sg1avCRg2k64WpIyzGuAIdTwOKJq:R0F+Qo9m4jjWx4NfieUF0CRHx4WpIBI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257899, "uuid": "9b9de560-dff4-4c3b-a18b-391d09707b6d", "value": 192280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257899, "uuid": "1a461b42-ac0f-47ed-928f-073553fb9b2f", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257899, "uuid": "13b79546-4a45-4ed3-8508-5e8e0e3e9518", "value": "DOCS 4-04-22.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3d49759-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278125, "uuid": "a83466f8-5c0a-491c-87ce-c1a375ead872", "comment": "Malware payload", "value": "b317eb89c253e04c0164a3ea150f6629", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278125, "uuid": "89f78aad-7cc6-4e10-9297-aefe09956f0c", "comment": "Malware payload", "value": "ef7861a6e2b89f6b4c92a7047c4f0c0101fe5449f914ffc57b1ded1425bf8998", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278125, "uuid": "2f5b050d-ff0c-4283-b4fa-24bcc32080ce", "comment": "Malware payload", "value": "2264f2279d60687182a4d63da53789b8d26722cd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278125, "uuid": "0b7852e8-21c9-4051-95ef-3ae522cfc306", "comment": "Malware payload", "value": "bb6ccf2894c81bbbb24fc006f2ecb96090121585deb4ed0b27968cee09bb686cca97db50df4c6d857d84c5b8d74caa46", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278125, "uuid": "434edf9d-3bc9-4c12-9799-0c09e633f6ec", "value": "T1A3A1E850112C1AB17246697AD26FFA52B90EC81B09777B358473A63C74F5DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278125, "uuid": "73a9dff5-d92e-471a-80fa-d017d9094891", "value": "96:ZRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ZRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278125, "uuid": "34c74459-475c-416f-bf38-e117fd0a9953", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278125, "uuid": "e7eac197-e12e-461c-92e8-7b5f55781517", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278125, "uuid": "419a78cb-1708-4a2a-b865-35b213adca51", "value": "ef7861a6e2b89f6b4c92a7047c4f0c0101fe5449f914ffc57b1ded1425bf8998", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57dd10a3-b59f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649245652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245652, "uuid": "8dc041e3-281d-4719-9b38-6778a30629c7", "comment": "Malware payload (AgentTesla)", "value": "f511b61dcde91adf0ef79345d8372940", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245652, "uuid": "0903a75e-cd9f-458c-96bb-9a1032376acd", "comment": "Malware payload (AgentTesla)", "value": "efb54efbfd3094bad75126848e7a49ed65461631b83e096e06f0b0c162f6c336", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245652, "uuid": "9ae75b83-d44e-4867-9bcf-4c8c0d56a561", "comment": "Malware payload (AgentTesla)", "value": "0d9909857bbeff74ae34f7b2d33294a9d9a2f940", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245652, "uuid": "80ec3fa1-2484-45c6-ad76-54ec05f3f08f", "comment": "Malware payload (AgentTesla)", "value": "175074d6f3e6c02ec13aec71cd98dccae0484b031a6674badb6a9b1b48634c1f5001de5f480fdcd0d5075bcdd2e50c35", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245652, "uuid": "bb83891a-faa6-4ab6-a769-bee924c5611e", "value": "T191F40661E3F45B0BC57F89B5243441483AE1A90E2623EBC9EF65319DCBB1A4127F8F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245652, "uuid": "c37e1003-cb15-4d60-8f4e-0c0e8ac9cce9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245652, "uuid": "275fe359-2ae7-42f2-9c4c-92aaf997c4a2", "value": "12288:jqrRtCNCeABjk+qlPL0soSj8w1IALWr6gqZwLhOyS2kZuRTN:KRmbjz1Ilr6gqZ09S2IuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649245652, "uuid": "2405894d-a68e-440d-b334-1fe0329e8c5f", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649245652, "uuid": "900e0f59-7051-4a7d-88d2-7aba990d8384", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245652, "uuid": "817149e1-f8a6-4ab7-a18a-8880f60084ad", "value": "BL AZOV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f450ad54-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278126, "uuid": "f8837dc9-1c66-41a8-aa4c-fcd31701e963", "comment": "Malware payload", "value": "76226672f2f3ca013b7fd34f630dd11c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278126, "uuid": "e53ebed3-9cae-4ab4-a7f7-87846594168e", "comment": "Malware payload", "value": "f0869b01daa7d4ca611de720e87a8423c5ab03b194d4dfe92b54302a7ee74ceb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278126, "uuid": "dcff0279-6a7f-4c74-9956-300ab358a00e", "comment": "Malware payload", "value": "8c70567e94fba76369c206d4b6bdf0b6f44069bc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278126, "uuid": "dcc441bc-6361-4181-bb75-379f485c3f8b", "comment": "Malware payload", "value": "ff71cbdf06f41a564e649c2087c2faed4afdfd9297daee880606ed17f07266b2d040580a7f7ae7502bcc54d6ec35a4dc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278126, "uuid": "5a022774-d9d0-4cf6-a42b-c4422254300b", "value": "T181F022EE3124F438214A4972691299D4F81CF1C47424AA8CAEFC04F1C8CAF883838B5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278126, "uuid": "ae80f2ad-52c3-4355-ac87-63b726460533", "value": "12:ebwN9p9PMvN9S7s/p4EiaBCi2kVjHWrVfdZ63:NPENrON+j2rVfro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278126, "uuid": "0bb846db-2500-4fd9-ad2a-f3b4b1bc90d6", "value": 557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278126, "uuid": "dd84b1c0-f96c-44a4-8a9e-e1ce22bd8ca0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278126, "uuid": "5b93f8fb-c43b-498c-88cb-4ae89c9bfa9a", "value": "f0869b01daa7d4ca611de720e87a8423c5ab03b194d4dfe92b54302a7ee74ceb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c96daa-b59f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649245838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245838, "uuid": "afb3d279-aaef-467f-9fdf-bcbfeb3f60bb", "comment": "Malware payload (AgentTesla)", "value": "3c087fba1abee011aad0afbfaa1ffc89", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245838, "uuid": "b0fb1791-5375-4208-8c93-e934807998f5", "comment": "Malware payload (AgentTesla)", "value": "f13aa63843934a093dadcaf5227c5f6ab20b7a6474a5fb8fc029ddd966026bbc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245838, "uuid": "e2654462-0836-4e5e-a252-4b5aff5665ee", "comment": "Malware payload (AgentTesla)", "value": "d0b466bc5d1605e13755cf6ade89eff0feca65aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649245838, "uuid": "f76f4692-f79b-461b-9714-0ab70a745b27", "comment": "Malware payload (AgentTesla)", "value": "0938267e459c3cf23dc1fb1844ef238b0460c0b6c959a97fd8fcaf5e8a9bfd219b37136d0aa9285761c9564f8fb4448f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245838, "uuid": "eb85f7df-030e-4764-9296-b5c8365c5ded", "value": "T1B9B4233164AC8C04A5BE4C90B60B3F547D70B0D7EBC6792EC9B6A09D034736DD5BAE26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245838, "uuid": "145a1a40-6fbd-425c-b6d0-86bdb8ea2162", "value": "12288:BB/yBVVdNWrUunGFs6vA4JUvuE4bJ4R8ci:BidNGUSys0pUGlNyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649245838, "uuid": "f3ede812-486c-4e17-b6b3-d12af0dc798b", "value": 516362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649245838, "uuid": "4807f205-df52-4b65-9631-3f6985c1f1ab", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649245838, "uuid": "7455f1b6-f51d-49a4-959c-f633bda7cf87", "value": "RE P.I-118.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4df7b14-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278127, "uuid": "40c01521-01e6-4ce4-8960-11c2c3a564f7", "comment": "Malware payload", "value": "3a6fa088cbc676d771ae778995893d5f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278127, "uuid": "bd9d4587-c866-4b5f-829a-b10d37da5ab5", "comment": "Malware payload", "value": "f1695f5c24da6cfb6cc6ecd2059664f3b24154c01feb8126d70da722332a02fb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278127, "uuid": "ecc28a3d-595f-44c9-a749-cc1560dfd49d", "comment": "Malware payload", "value": "6e045b7b144e3429c1dc516259c144d4be7d67df", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278127, "uuid": "f4a5e900-cead-4584-9627-d012508159a0", "comment": "Malware payload", "value": "164e65ea63b9cafb34585c4c649ef4ccf5bd7f6f5f24d9e5148c1523ac84d18404fee12de5925f09fd918b995c3774f0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278127, "uuid": "3bb20e40-ed88-4d7e-91d6-e59eacead1af", "value": "T19811D71E37D1FCBC79A77650870EC124E540D79B907F6B927A9A55ED7890484822C43C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278127, "uuid": "42f8bd92-0bd5-4a70-9ba3-94992d806ed8", "value": "24:hX6WnSlPPPmBePxSJo3ys4Iad9YYIBYI8u0aNP1FzqoA5:t6QgnuBeUJo3y+adCYQYyP1FGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278127, "uuid": "f02707b8-c9e7-4426-b277-1a1d777dc158", "value": 1104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278127, "uuid": "807d3ef7-f4cc-4632-8945-f1d83230eb1f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278127, "uuid": "45c9b4f8-67e3-4a67-b560-0e7f733eeafc", "value": "f1695f5c24da6cfb6cc6ecd2059664f3b24154c01feb8126d70da722332a02fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f56f5305-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278128, "uuid": "b7f57a4b-efcf-4cfa-b6a7-0a3edc059ab4", "comment": "Malware payload", "value": "65ac62339fe07db2ff92b39e41dd7044", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278128, "uuid": "866243a9-5dba-4a21-969a-8550ce815101", "comment": "Malware payload", "value": "f16e3e682490eb317b44ee1f09b0286a1cee4ca991bc98135f19eaa93a49b756", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278128, "uuid": "1c7b17fe-b4f2-41ca-afdc-c211522fc013", "comment": "Malware payload", "value": "e4a17ecca9e4ed6c5a60a69666dd75da7b10d357", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278128, "uuid": "1ab72ebf-0a44-4315-9f90-e91851a36916", "comment": "Malware payload", "value": "28ad5569b61fa98782325f3fffedfb7bc973517c660d4e1ef4f118a8264bbad2fa7c1935a58317bcfb20e465214fe3ef", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278128, "uuid": "1d2aa673-c9f0-4c3a-bafe-f42808fa7d97", "value": "T19FA1E850112C1AB17246597AD26FFB52B50ECC1B097B7B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278128, "uuid": "b201ba23-c35d-4ca1-8ee8-57697b4f51fb", "value": "96:ARYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ARJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278128, "uuid": "b3aa8be8-b268-490d-91a8-c6988bcf90c2", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278128, "uuid": "f91b9ab9-f938-45d5-9495-8512f81b8644", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278128, "uuid": "0e0e7db7-89da-4092-9508-b4a70720c966", "value": "f16e3e682490eb317b44ee1f09b0286a1cee4ca991bc98135f19eaa93a49b756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e0f2b45-b59b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649243971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649243971, "uuid": "8bf9843d-55a9-4e35-85f9-c60c2d23666b", "comment": "Malware payload (AgentTesla)", "value": "a0c3c916aa05d1fb9a571aea9cc4a773", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649243971, "uuid": "245d1e69-ea0c-4180-b9aa-9460dd04a94e", "comment": "Malware payload (AgentTesla)", "value": "f1b3eda5dbaad1a268315f167569263590958f173df85e05bfdbb1e2629dd656", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649243971, "uuid": "ec050389-ec3c-4b85-8e28-29c329c05e0d", "comment": "Malware payload (AgentTesla)", "value": "fcc98fac2dcbbda380065100d86d677e83f89850", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649243971, "uuid": "4fe22804-c295-4fbb-97be-7c219530682f", "comment": "Malware payload (AgentTesla)", "value": "e2ce6fe4d2ecb80f41cef27e060737d34d01f01e0cf319a0065e8304f37bf7533325e917f80a89e18862a23f358ecf18", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649243971, "uuid": "2a0760c4-2eae-426b-a7cd-a2fabc7d7630", "value": "T10AC412052BD81711D87EABF2BA7E50910B71886F25A2D74C4DE739EB06037A4C641FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649243971, "uuid": "50548ecd-bc30-47a9-b9a0-f19b205a7d2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649243971, "uuid": "3d8b51b9-b5cb-4d2a-8d83-12096ed6a6a7", "value": "12288:BwG2WTfAPvpmh6A0mDVcJioBH2hi415ExaTFvtCNGTet4UF:D+v8MA0mDV9sq6+emU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649243971, "uuid": "7fb717f0-70ed-4811-a9f4-b6b09861a0e6", "value": 548864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649243971, "uuid": "40e588ee-5fd4-44c2-a65e-c1bd9112ecbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649243971, "uuid": "8a8c3efb-3a3a-41d1-80e4-d256c78d7464", "value": "Swift Copy_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5efc5ec-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278129, "uuid": "3f7a1388-e133-420c-afd5-bd27ec602fd7", "comment": "Malware payload", "value": "94b683ccab02f35980b9deb9e9c7cece", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278129, "uuid": "ef095ffd-c490-4950-9716-98dd8af73b16", "comment": "Malware payload", "value": "f1c14299cf0b93c48eb6028a48265415b796b4bb1ba361d5d09d4d5b2fbb2cc6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278129, "uuid": "5e944791-8547-418e-af8c-fd8ed9f72c36", "comment": "Malware payload", "value": "205cb3814988e9481f44efa8ee2c2e2927364d2a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278129, "uuid": "fe39bd02-5841-489b-ac93-0ee9af0a3f05", "comment": "Malware payload", "value": "2af3940e6e784792efdf112c90c077eb50c1de605088bde8304ff02bad205603e32877ac8e9661e0395cad4a76018d50", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278129, "uuid": "53d27115-1023-4bc2-a518-f1bd08c2059a", "value": "T103A1E850112C1AB17346597ED26FFA52B50EC81B097B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278129, "uuid": "a023cc8c-2047-4199-84a0-e0786ed6a706", "value": "96:SRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:SRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278129, "uuid": "0aadaa4e-3921-4798-ad29-8acd00e87e4e", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278129, "uuid": "d98c8246-2b99-42a3-ae23-4db3a58066be", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278129, "uuid": "de8bc894-ad9e-47aa-9f7e-de06c9587c11", "value": "f1c14299cf0b93c48eb6028a48265415b796b4bb1ba361d5d09d4d5b2fbb2cc6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d2acd3d-b5c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649262330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262330, "uuid": "c1fe950f-484b-4949-897c-b5ae7e6ebab0", "comment": "Malware payload (AgentTesla)", "value": "22beec4cb4beda3c9d65f75535cf90b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262330, "uuid": "75660728-b6cb-4fc5-be53-46da49a8a177", "comment": "Malware payload (AgentTesla)", "value": "f1ecbaaf259f7176e2397708f5215f8374bdde577e37ad8656ea0618d0b5d509", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262330, "uuid": "10d0b3af-3af6-4049-99d0-0bd4e99ef65d", "comment": "Malware payload (AgentTesla)", "value": "1191ad264ec502f250ed4bdb8b33e5ba690a347a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262330, "uuid": "8f159c40-8ce2-4f23-a575-f830a6ae3bd2", "comment": "Malware payload (AgentTesla)", "value": "eb774149bd2ed87237950bc79c6a94f8c85fc5e71b4823d62e951538921ba89b31fa3efd5108768638508fd6dfe24041", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262330, "uuid": "ca17dbee-2864-4de9-b3cb-7b8c2e217b73", "value": "T16BC412297B2B8921C96C4BF3D5E1410503B09B02D463EBCA6ECD56DE97033E65D86BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262330, "uuid": "f3395165-5a2d-4398-a1b9-fb0bf6ca60ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262330, "uuid": "8f47d9a0-b7ca-491d-8f3c-b9877f021f9d", "value": "12288:kGP8yaWREbg5zfiXm2AUcFzKPOaV3aaomUMRkR9YLX/L4F:kGPWJUuXBAUclTaImlk8LvL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262330, "uuid": "fc64a1fa-7778-4e20-821c-ad57a7872619", "value": 563200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262330, "uuid": "fbb1ce16-4ce4-427e-b048-efc0126da810", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262330, "uuid": "ff764ae5-5e6c-4ad2-945e-1f1833202182", "value": "AWB DHL 7214306201 Shipment Notification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b6083d-b5e2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649274604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274604, "uuid": "438c92e1-5404-4829-974b-ca3e128c788b", "comment": "Malware payload (Mirai)", "value": "c51d8a22a8427dc69cb344cd38242355", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274604, "uuid": "cffab14d-c44a-4f9e-80a9-95f353259b59", "comment": "Malware payload (Mirai)", "value": "f201dd55844905dbba1569e228f457f13202c7f07759e39b2d596644c8796f10", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274604, "uuid": "15798e5e-3aad-47de-ade0-8f97c085e1b6", "comment": "Malware payload (Mirai)", "value": "1f861105ae768c071f26f424b8b43fbe69f840cb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649274604, "uuid": "f4863b64-16b7-45ae-9f2c-476c5e82b50b", "comment": "Malware payload (Mirai)", "value": "f12d0d22ab8c35ed6e3ace40c9f3dd5f1bb4b5d9b29f249f7c85c0179533f8be3c53579ff573f9a454dc599f86c33b78", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274604, "uuid": "a42ca031-158b-4bd9-936b-da6193cfc5b6", "value": "T1D833022C8A745F5162E02F3ADCA60E020ECF5DE982FB44BF95863CD48A80DA345FB755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274604, "uuid": "880f1a78-5870-47b5-abda-0b1d2fe8bdc2", "value": "1536:Ir/1ZrCnDfRF9Gy+0xXIe4QOR/LDdwu5CczGIQr:IrtZrYlFgy+0xYe4QOtLJwFczG7r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649274604, "uuid": "2e42bc27-11ef-4571-9967-0bb2eeb4f11c", "value": 54544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649274604, "uuid": "db92cc3f-28a4-4400-a410-9467ac1bc8d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649274604, "uuid": "25a8b308-1bab-4649-b218-949713f933ff", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6964d39-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278130, "uuid": "b4c5783c-c4e8-4548-b705-50a13190598f", "comment": "Malware payload", "value": "ca9a16b2a42688189aef029dfa903edb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278130, "uuid": "a7c7be96-6abb-456d-8249-6e95414196f9", "comment": "Malware payload", "value": "f206e89e9b215417cb6187088f6c31b35f3903866abd874922147bb4a319f144", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278130, "uuid": "f9340109-d9a2-4aa7-afb9-4ec0bad28bf1", "comment": "Malware payload", "value": "6151fe19901d043f9e8e2541127bb0c1fcf72b5b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278130, "uuid": "f8726c23-9fbe-4c98-9335-2017903da706", "comment": "Malware payload", "value": "92dcf198ad7ac40938f66d7179dcf315b73823fb20026b0bc1f2a3ce160a31a500715385055e641373690b37b78d984a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278130, "uuid": "d3496d34-3592-42a2-b8df-a2e87222ce68", "value": "T108A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278130, "uuid": "8f42c977-7e56-45f2-8fd9-9e92f491c59f", "value": "96:8RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:8RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278130, "uuid": "ce8404e2-3187-4386-b4de-3c49a923a1bb", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278130, "uuid": "cd995208-5017-41e2-95f9-359ee92b124d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278130, "uuid": "9fd1b5e4-f1b1-4438-99e2-582ba8bac432", "value": "f206e89e9b215417cb6187088f6c31b35f3903866abd874922147bb4a319f144", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "231ccd52-b5b0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649252864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252864, "uuid": "8284196d-12ca-46d0-a451-f770031ec58c", "comment": "Malware payload", "value": "dcc38713a0e0082dd7ae59da3309412b", "object_relation": "md5", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252864, "uuid": "a32c186b-9536-437e-b1da-925737eebb1a", "comment": "Malware payload", "value": "f245c441370e7bb3382e5073756ab49c5e553a2a2b6b3a5a9bf6767617f78055", "object_relation": "sha256", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252864, "uuid": "b3f52b13-41d4-4ae9-835f-9d6c758436e9", "comment": "Malware payload", "value": "82c89381c26753b73291ac8dee09c6afddc22a91", "object_relation": "sha1", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252864, "uuid": "44b52fdd-17e7-4d34-a65e-87a6b45001ca", "comment": "Malware payload", "value": "efe83bf2459d3277241acb9b7f30d812ac1205c0c8181e6f6bb83067dcd430d535caf0f4d40001233f3b588b4b113139", "object_relation": "sha3-384", "Tag": [ { "name": "Emissao de NF-e Pedido", "colour": "#1EC236", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252864, "uuid": "105b7b71-8eb6-46e2-91d2-dfce12ef7006", "value": "T146A63375E15F465FC020DB7DFC9F4BB677D0219E62910213C8A844AA2E0A393AF1F769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252864, "uuid": "c3f1b991-4888-47bb-bbad-6ce7260436e4", "value": "196608:aYaH7Xi9IVmMdSa/Sx3ocRIjMjSl75bXzIyFVQMkIzHMA5NxulMx0QL:aH7iumMtSxY5MYtDGMkypDxulMx0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649252864, "uuid": "477cf5ac-d6f1-4eba-9207-6ed781d85d88", "value": 10383455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649252864, "uuid": "cb32a94b-68e5-45f5-b2d0-de9d9d9da72b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252864, "uuid": "3af2a592-eb1f-4b2c-ac5f-4cf08506cf28", "value": "PDVs1nver_.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f786d4bb-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278132, "uuid": "f71f69e1-0804-4c2b-a227-05d957239e54", "comment": "Malware payload", "value": "f16cfa9643ae1313e8b9fbf0eba7f064", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278132, "uuid": "d7c4f163-8b19-4d9b-89f3-06c2fb694a61", "comment": "Malware payload", "value": "f2d804b9253a992121d095964ae963686bb18345f9d239a4ac4c7636835778d9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278132, "uuid": "727f61d4-25f0-4ea0-815f-8c05b1d73c5f", "comment": "Malware payload", "value": "45c5cf25c0db43e3e25b9e6a1654651a70113021", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278132, "uuid": "c1707265-bc1d-43e7-88be-74681b6ce1ad", "comment": "Malware payload", "value": "cc9d4c7a0b47e3e5a461f9d781c73696c9b967db9138a7ef35c741e44efb755413eefa676074797235395cd81ef7e3f5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278132, "uuid": "5ea07a4b-9591-4493-93cf-448859ab2597", "value": "T14E413D86F1964CF02C90D51733F9445030E4A1CEA5D69F4F79DEFBE9088DDC86629687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278132, "uuid": "9306d680-b8da-49d7-b203-22e7591340ff", "value": "48:vYsAhY1ZYDYfYnYGiTYrYTY+8YAsYTY/Yw:vYsAhYvYDYfYnYGiTYrYTYPYAsYTY/Yw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278132, "uuid": "b9485419-9546-4011-963c-cbb12be55d91", "value": 2085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278132, "uuid": "b9e7610e-5ab9-4c95-ac8c-978e90505723", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278132, "uuid": "239a0bc3-7fd0-4f8b-b4be-07e40a4f7d50", "value": "f2d804b9253a992121d095964ae963686bb18345f9d239a4ac4c7636835778d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b2f1c4-b5c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649262133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262133, "uuid": "0aea03e6-8cb8-4693-a8ab-5f92fa060793", "comment": "Malware payload (Formbook)", "value": "0e2a65f8f4ae3cd1765943f5afcbbda5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262133, "uuid": "8a659db8-c59a-42e1-b032-688c397aaeb4", "comment": "Malware payload (Formbook)", "value": "f31667770a80006582ef56709280bbeb3e1c2b8c3bb86b4c6f7aea2001de959c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262133, "uuid": "83883bcb-6cc8-41f5-b101-ad65d4891913", "comment": "Malware payload (Formbook)", "value": "f6a7dee2ed9edfcab765b6ff0ca5dd52348c266a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262133, "uuid": "c129f31e-cf67-4e46-a49f-d2e917150a28", "comment": "Malware payload (Formbook)", "value": "af838e204b9e6509c73dc4d9ec67455a2ee4dfd6d01669bb7fafb7c03307081dc4166254ab5c19fb1e121ff301061be4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262133, "uuid": "9f97cdc9-b307-49ce-99b2-da760e9177c0", "value": "T17F341215A791C427D6910E365E3A62769EFAF33208A8432F47D44B5CFE376429E0F782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262133, "uuid": "ff237093-764e-4da3-85cf-0110f010b59e", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262133, "uuid": "42f1ead0-b860-48f2-8716-4e6b81edd965", "value": "6144:HNeZmKHU7WBeejleOBGFObFKd4V+4sHCNdl5SVlP3K/qx:HNlyBlJeOBGFObFU4//QlP36qx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262133, "uuid": "0043999f-32c2-4cb5-bf11-c593ab9d0cae", "value": 246727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262133, "uuid": "c23473b1-ace0-4194-8e48-3a4546a0f295", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262133, "uuid": "e39931e3-9627-4233-9db7-4c118cb8c0f0", "value": "DEKONT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc7ab2c7-b5af-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649252746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252746, "uuid": "c577e20c-dd50-433d-acf0-50062114cda0", "comment": "Malware payload (Formbook)", "value": "8c9b753aa3d47efde3583542b4f65cfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252746, "uuid": "f6115559-6594-461f-8108-bc2c149b4438", "comment": "Malware payload (Formbook)", "value": "f33558b7d1ef191efc6420ceda8f5a274cc3c4bf51c25e15b81eb4b98ac2c642", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252746, "uuid": "e18f7acc-777d-4f01-99fb-9f36b4018352", "comment": "Malware payload (Formbook)", "value": "9fd3dec5aaba2ec6ed45feb2ddc4c02f979f6e4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649252746, "uuid": "eb47c2a2-25a2-45d7-8195-bbc26f7a6637", "comment": "Malware payload (Formbook)", "value": "0f14e7cc6119658870ab12e9b54e8696fe4fe0d32413d612283f1a89b7d44c2b406beae87d936bfa073e7c4e01e7b649", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252746, "uuid": "5d5bbd0c-bd19-4a8e-964a-25acdc1b02ef", "value": "T111E4AE51F2C14D33D8332E789D57669A5A32BF033E1E31572AE86E586B796823C2D0D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252746, "uuid": "e830a535-0ffd-48ea-a177-0d2458b3177d", "value": "fb9ef474a56916f76519e89c228acc2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252746, "uuid": "35880cec-8f9f-43e5-b5f0-4dda32886920", "value": "12288:lQyjrymhNAiouMnzgVf6KmIMMorwgfDxRbXBpDadB7h2jZec4qO:2gW4AifMnzgVyCMfrws39pDadmjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649252746, "uuid": "28348ac9-17cd-456a-992d-de01effc7ece", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649252746, "uuid": "01557cb9-cf4d-424c-a4e6-74b783d452c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649252746, "uuid": "c3fac62f-e982-4f43-8608-06f0ea4b3e4a", "value": "swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f3464d5-b5e8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649276990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276990, "uuid": "5f55ab3f-cc9e-4474-aa09-6d1678d63843", "comment": "Malware payload (Mirai)", "value": "cb5dc0f4a41f0ad82d19ee2890bfc888", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276990, "uuid": "a69c5a1b-12c5-4513-9193-b47407305cfe", "comment": "Malware payload (Mirai)", "value": "f34360f64533fac1487b40ad533ad4fc50c199e5b6bfe36ab6ae22766c72de06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276990, "uuid": "6878dcfa-5afb-4347-ab95-fc36b4903a7e", "comment": "Malware payload (Mirai)", "value": "eb97f2cec65fe087755495a25702e83864bab950", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649276990, "uuid": "88c61878-fba8-45ee-8583-cbc6abeabf7a", "comment": "Malware payload (Mirai)", "value": "53ac57905e672427bac248df902bb7ed19c6bfda5820ba4e5e033b1f9d5356d7d9f9d1f78c506097424f921f06bc2c2e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276990, "uuid": "c1ca0437-5072-41ff-8ac7-6f2bafefdfb2", "value": "T1CDD2F23AEA529769C0206C73E2EE84473F8935FAE05EB01215205777F5D24536B716CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276990, "uuid": "f8e82ca6-f304-492f-abc4-d834ba4a5f62", "value": "768:4onP0fMESnpKjt1zHEm4FdRvfKQF9ODpwRA29q3UELQ1:rPwi81zkm419ODzbL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649276990, "uuid": "0a611737-16dd-4231-b7c2-65e54cc4509a", "value": 29560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649276990, "uuid": "5a524f13-50ac-4f2c-b695-5ea147983b07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649276990, "uuid": "3257204a-7224-40e3-a81f-a7228327f0ac", "value": "cb5dc0f4a41f0ad82d19ee2890bfc888", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f804df30-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278132, "uuid": "567d14f9-5a9e-4297-8298-d29b722bd973", "comment": "Malware payload", "value": "54b0537964db44b57c17a0045fb60f38", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278132, "uuid": "119bab14-060c-4386-8c4b-f67865f89ce5", "comment": "Malware payload", "value": "f382be7a36df47188600145e8e9705495b7ad3f23b2274b83703047f2d50b5cd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278132, "uuid": "e62d8e03-d4b4-4917-b508-f425ef12e9db", "comment": "Malware payload", "value": "c43bbc09281e4c1942c40a07c66c127de08f9b6d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278132, "uuid": "82572e6b-6926-4ad1-9926-510be2d1136d", "comment": "Malware payload", "value": "7bc9129fe9fe62e4b52329864c97c1573614ce244fb35e7bfd5065151af169486ea9b2a01fc2fd97813ee5ba70d9788d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278132, "uuid": "a3a8b5bf-7521-48d0-9e5c-8c58ebcbc2d8", "value": "T13BA1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0796C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278132, "uuid": "51036878-2e40-4fe2-b3aa-3d08fa685296", "value": "96:cRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:cRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278132, "uuid": "44ae4cf8-7788-49ee-8905-e0980f59f648", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278132, "uuid": "8e4f469e-1fc8-4bc2-91c4-114a89d344b9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278132, "uuid": "3e22e6b4-1da5-41ff-a2f1-711902fa6179", "value": "f382be7a36df47188600145e8e9705495b7ad3f23b2274b83703047f2d50b5cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4edb0084-b5bc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649258092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258092, "uuid": "a0a73076-a0b6-4804-b2b8-6a63f5145554", "comment": "Malware payload (Loki)", "value": "058564a9dd0aed80c10c3347c04f97ef", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258092, "uuid": "7dd12f81-daf0-4417-99c8-f90c767d0910", "comment": "Malware payload (Loki)", "value": "f40be1bf04a363bcce123f26dbbb1aa211116eab6c1e76e0fcf6ce9297c442c0", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258092, "uuid": "974745fa-ed8d-474e-ae9a-676a606184bc", "comment": "Malware payload (Loki)", "value": "b429fbcaa8b225c6485150f3f7b9fe19ae874ea6", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649258092, "uuid": "f4ab4383-13d2-448c-9837-4caee2d66e4a", "comment": "Malware payload (Loki)", "value": "a0dcd01db29de2e26b4a1d74a0d96a7fa1ed76238dc6d216c0457cf76e5f0dabd2f940cb7a31adfa07ab22600988add3", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258092, "uuid": "8e150c23-9f61-408e-903b-d305438a619a", "value": "T1231412683BF19992F9B72F754891D47EA025ECC18940C6C9F98B3F288CF65D28B103E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258092, "uuid": "a4111727-f23e-4292-abd1-50a8de5ad7f1", "value": "3072:tDIHDnDTsmhE5FA9QR001bFr9zwhJXJHTS/5DKL/53iPy5LxbNXWv7DPkUuGAa5L:tEPThq/nTwRMJKbNZxbNXWv7DPbFlN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649258092, "uuid": "cecf74a6-7fd2-4b4e-baea-3f6b80e01813", "value": 192184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649258092, "uuid": "e6d8b13b-ff69-4e13-96fc-018361e75227", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649258092, "uuid": "0f223dee-3b2a-4a73-99b2-cc88a1953f4f", "value": "PO2224477.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1dd63d0-b5bb-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649257909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257909, "uuid": "1af44f91-3a02-4d12-adf6-150a4599b20a", "comment": "Malware payload (AgentTesla)", "value": "c5d3f30dde9264c3d2c30d4f858bad1b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257909, "uuid": "d58c75e0-099c-4454-ad38-8276fc0682f2", "comment": "Malware payload (AgentTesla)", "value": "f4e001e0ba0d35cf9513827506e0ca7be8b051905afb5cf3a619d099748e3d6a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257909, "uuid": "18da25d1-fe31-4ac1-b9d5-d968edcb4b07", "comment": "Malware payload (AgentTesla)", "value": "0f39c608a820d2c4b3426a2ee91e62238ddc4ac4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257909, "uuid": "5c2d00ed-ce99-4923-8269-47a4cecd7810", "comment": "Malware payload (AgentTesla)", "value": "fcbe235f414805c716bda313d22a266c6616ef65e602db202366ac581a57d50b3bc6b74c17a6db9c4819215c156a0df1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257909, "uuid": "6412deaf-8131-4a98-a83d-a646478d56a5", "value": "T118141252651C6641F205C5B38371C2618FBEAD0D48B82B2A0697FD984E3D79C6CEE6F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257909, "uuid": "3d5b9710-a790-4c9c-b9e6-9d1ff3b7c740", "value": "3072:ckowVP88HhCLcnYOnEwozAqOzeiHCIcz3B9ERbrQabsPz11zD2XK7aYLr204cqzH:PVE8tEwwABN+2/yr7rucqKcyoyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257909, "uuid": "aca63caf-03e2-49f0-aa86-6597e7b3dd80", "value": 191752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257909, "uuid": "123372d2-1501-4ceb-b6ad-4ae6ad6f91e1", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257909, "uuid": "3967fc26-965b-4585-bfcf-0e6d43021a78", "value": "Shipping Document#8504848.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8827980-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278133, "uuid": "83c5635c-5dbc-4c16-befe-c4e4d56b7ad2", "comment": "Malware payload", "value": "ced19db416c461dcaa0a9a2b6f3178d6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278133, "uuid": "c17ebde3-b3ec-40bd-a44c-807a7f1d2ec1", "comment": "Malware payload", "value": "f4fce1ba4ffd7ed0a3e2b3b7aca03c446699943426faa0a582152a4053c0acf9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278133, "uuid": "fdfe6539-9aa7-4fb2-a7ed-09d90c143746", "comment": "Malware payload", "value": "6e48a3675dce91fee3248f0b4d3d91236abee6e7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278133, "uuid": "2a39a8c7-41da-4120-a38e-3572d106f4c3", "comment": "Malware payload", "value": "5670c7013c074f933ace702928a8ff45e8a5e89a36bcfdf4b60c143f9c9b2675d5727550d9b6d14d9ef6f96d2fa838f9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278133, "uuid": "ed522d84-eaf1-4865-a771-e06aecb5c6cb", "value": "T1E5A1E750112C1AB17246697AD26FFB52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278133, "uuid": "147505a4-4608-4a3d-a58f-54a444712c5b", "value": "96:LRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:LRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278133, "uuid": "1542b710-d9cf-4e06-a1a4-f133b27672a4", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278133, "uuid": "73498d03-114a-4e6c-a0ef-c50c4fe8226f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278133, "uuid": "d636e1bd-9c42-4e30-bf95-5ad129359773", "value": "f4fce1ba4ffd7ed0a3e2b3b7aca03c446699943426faa0a582152a4053c0acf9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9002d37-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278134, "uuid": "9b0dff29-e512-460d-ac5b-2748d6e677d8", "comment": "Malware payload", "value": "8f67876b1a3e62f8778ee25abbd64958", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278134, "uuid": "2f6f6b61-1bdf-4239-8e10-f7ef8e1aaa46", "comment": "Malware payload", "value": "f514ccfa155510cc1cced1d49f409ad2c5923218231c2a1a9c398f1b3156b273", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278134, "uuid": "6d307e68-cdad-4296-ab8e-13c2b84b8aa7", "comment": "Malware payload", "value": "a8d9180f211a0c4723e1829efcecfa4348bc1bdd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278134, "uuid": "cd39700e-1cac-4313-b5c9-4841da0c76ba", "comment": "Malware payload", "value": "f3e9098bfeb1540bc46fd5adb7329599f30fc29b09a9a03bc25624d1a9be1ec7d628c9c46dfe3eaa9dd162d58eb03bbd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278134, "uuid": "9da8d3ce-6e22-4fc0-bb1a-2b4e72143635", "value": "T1ED11F31E33D2FCBC79A7B950870EC128E540D39B907F67927A9A4AEE7494084822C43C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278134, "uuid": "dc6a22b5-e4f5-4212-9068-d91eeb955986", "value": "24:PjWnNJP8PmdPxSJoasYIad9YYIBYI8u0aNP1FzqoA5:PjQnkudUJoa4adCYQYyP1FGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278134, "uuid": "787f4fe1-f56a-4512-b31f-b26e39a76ea7", "value": 1053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278134, "uuid": "9aee8e7a-40c3-45db-b5a0-6dc602200962", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278134, "uuid": "b80eb20c-012b-4e20-a638-2585c23f7a4d", "value": "f514ccfa155510cc1cced1d49f409ad2c5923218231c2a1a9c398f1b3156b273", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f976a84c-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278135, "uuid": "0a76d835-7171-440a-9c9e-8b5e0bf41b8a", "comment": "Malware payload", "value": "12221711b829559662c7bceb32605340", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278135, "uuid": "53947035-48f0-4054-9ab7-9726326a0490", "comment": "Malware payload", "value": "f57033e869fba8449127000063dbc34632005236c6a63235a23e2e431f83da2b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278135, "uuid": "037a30c4-9609-47a8-9078-558984b86468", "comment": "Malware payload", "value": "4124a26c1d8dd676dad935a4f6675342b2add69b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278135, "uuid": "8772afdb-67c9-4873-b8d5-c00d03644685", "comment": "Malware payload", "value": "2386cbea7ef8e52ba9764bb8793190d2ac239d27c6a8ed64d04c05a643b4f682dfec3753073ae5c1b9bd312e9ad65b76", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278135, "uuid": "59375d58-c17a-45b2-a8cb-743791859bd7", "value": "T108A1E850112C1AB17246597AD26FFA52B50EC81B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278135, "uuid": "b8177553-d25f-4e67-bfdb-c6076103b152", "value": "96:fRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:fRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278135, "uuid": "281571b1-fcda-43e0-bc49-ef911ee1a5be", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278135, "uuid": "ebd68691-a7fb-4fbe-8780-176bbc3cda2c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278135, "uuid": "83bbe3c1-fd61-4f05-b8e2-1d0d421324d9", "value": "f57033e869fba8449127000063dbc34632005236c6a63235a23e2e431f83da2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec0a79a7-b5bb-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649257926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257926, "uuid": "31b11722-aedd-47ba-9c8b-b5904f781894", "comment": "Malware payload (AgentTesla)", "value": "4edd9483d5964b6e31c9c50e422e2654", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257926, "uuid": "b4779ee7-b130-4f95-afd2-330dbdd04c11", "comment": "Malware payload (AgentTesla)", "value": "f5db91253eb9e54e31769c60b8ef34d248e0f07008eab10f3cab493c823818fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257926, "uuid": "a40a9a54-c2c6-4d8a-8b33-fe0b90a2553a", "comment": "Malware payload (AgentTesla)", "value": "52da967333dd510e448c311853bb2f6475892d71", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257926, "uuid": "fe74a610-94e0-4b2d-8bcb-5086411b0bcd", "comment": "Malware payload (AgentTesla)", "value": "2cec8e8a67b56187f072e6429ff0dca7fe97e39ee8af3686c9d948a96e0dbdf7d5f7999d9d577542320b02f54efd1465", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257926, "uuid": "d884762f-f270-4b7e-bf4d-b4ef789ffd6d", "value": "T10E14129AF0705A30D76036BB876BBD2125438C563F3AACE605543D793275E83B084B7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257926, "uuid": "60569458-729c-48fb-b036-df8c4d45ecd8", "value": "3072:FHZhnsS1x2tUhfYW9XarkK0I/iRvyS3eSe670NbgfRmrDwzZ16u+L72N9phQoKI:RfsnUhfdnK0IaRAO0NugrEzZ16369plz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257926, "uuid": "49c61d1b-eb3e-4718-85f0-f6cfca87d361", "value": 192216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257926, "uuid": "a0814368-7dd3-4132-8387-a469140b8197", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257926, "uuid": "1c3ef02c-f7ea-4844-9b36-7a4381e6619b", "value": "AMENDED DOCS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef4e2367-b5b9-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1649257073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257073, "uuid": "88ba06ea-1425-4d16-8e63-0daca8fe6d9b", "comment": "Malware payload (NanoCore)", "value": "e5bdb55496c5058bef286b17f32c31e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257073, "uuid": "03318333-7d8d-4c25-9c73-56016f691910", "comment": "Malware payload (NanoCore)", "value": "f61cb6448b00917c426f5b7220a17043f1d3f777550d495031605d31284b824a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257073, "uuid": "5d147c6b-92a7-42fa-8f76-23a58372f79f", "comment": "Malware payload (NanoCore)", "value": "7d2550e865942e129dee155e9d8c99eb2bb94748", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649257073, "uuid": "6031f242-b7b5-4dbc-88b4-50f310b65183", "comment": "Malware payload (NanoCore)", "value": "4658fe2cd17e4e12db26bc89685c92604a6d02491b40e959cebc77cc740aa14a4d8e8917d9bab4b393824148df009dbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257073, "uuid": "638cc17f-9bbd-4e69-9134-88ba33a23065", "value": "T126150110149067AADAEBFA74DDB9C7105E2E7F01E978CD0FB5B9709919D3383A082763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257073, "uuid": "4ef60a3c-bf36-41ba-aba3-68917ee717f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257073, "uuid": "18e313ca-f269-4774-9c3b-babfd34e5866", "value": "24576:z1GuyRckCO/bzio92zt8/kyx9g56Qd2jiHT:zIeGioQzt8/ki9gpQUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649257073, "uuid": "e9b56df6-7858-4a2f-9dff-4c18711f82c6", "value": 900096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649257073, "uuid": "26e177ac-c434-4001-8ec1-179241086b4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649257073, "uuid": "6e71e2d0-0280-4746-ad95-222385ff6761", "value": "OBL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "639b3779-b591-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649239658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649239658, "uuid": "80901aeb-d07a-49ff-9398-e03839f5dc6f", "comment": "Malware payload (AgentTesla)", "value": "14ec84a4ceceb006baa2fc4e3aca1ba4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649239658, "uuid": "1c3b44c5-a94a-4176-b3ce-eb4616384335", "comment": "Malware payload (AgentTesla)", "value": "f6d858bcb58f4b8c633ca0ade96170f23b8e064798e0767dedbce11ef7944602", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649239658, "uuid": "d4bc1ff3-a59d-4b87-8485-f555a1057294", "comment": "Malware payload (AgentTesla)", "value": "9724e52b8dff0d403ffb6352f9e9ce76d9c3cc67", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649239658, "uuid": "b0304441-6995-46ee-8314-cf5f22082cee", "comment": "Malware payload (AgentTesla)", "value": "00837550d2a99d1294012ebc3c93df3d8611434de08b17000472bd3c56fe8de07dc5a6c45c2d81122bd99ccbf73a883a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649239658, "uuid": "e4e42eff-6134-4d13-9cbb-6927e83dcca9", "value": "T1B515939D722072DFC85BD4729EA81CA8FB6174BB931B4207902715ADDE4D89BCF244F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649239658, "uuid": "d933d415-422d-4474-9149-6aadd873a280", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649239658, "uuid": "8e8a67eb-e94d-4c12-83b2-cfa82ec5ee86", "value": "12288:QKz6OMtR54YPRhRKAjHdGAse8cZZwep+Gi2PQp/bS51ZSGnxtsX60TdM21GiKnSd:QKGFRWYPRLRjaH/dBQgeZYo/Tk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649239658, "uuid": "cfaa2c7c-e8a8-4662-a0e9-f3f82d7e0fac", "value": 924160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649239658, "uuid": "2b5533fc-ce6f-4271-a6b2-c1cf687f9601", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649239658, "uuid": "88714c3b-d0a2-4ed6-ac1a-fbb81c005dfe", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ef3320-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278136, "uuid": "30100e79-e158-464e-86b7-ce328d19b749", "comment": "Malware payload", "value": "f70d89775d3df5829ab344b769861ef2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278136, "uuid": "4ba9b3b5-49da-4a13-88b8-81ffbe68a3bb", "comment": "Malware payload", "value": "f6fd99e9ed7c4cfe6ad88441a852d48d151ec4eefa0bcae621093b0825520e43", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278136, "uuid": "8d1369e8-995f-449b-b903-4167f9b784ba", "comment": "Malware payload", "value": "e1eff80fbfffe25938d9f854bf67639903412fb9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278136, "uuid": "9df94fd3-6427-4457-b221-e286cd28e6fd", "comment": "Malware payload", "value": "e3e880d7f642c86c772a68dac62e72e587f6c8d7d154755c67041f8be43c7b9092e25ace68cc4b1091fc2688fc7f13b0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278136, "uuid": "13da73d8-cc46-41f3-97c8-e9c40e1879ee", "value": "T1F9A1E650112C1AB17246697AD26FFB52B90EC81B0A7B7B358473A63C74F9DA8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278136, "uuid": "ae1e83c0-e0a6-4552-a1cd-bd55458c637f", "value": "96:WRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:WRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278136, "uuid": "25353b7f-b142-435b-9b8a-a311217a26cf", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278136, "uuid": "785d77c6-9cce-45a3-9851-f270ae00fede", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278136, "uuid": "da9bc03f-79b7-464f-b83f-af291044c845", "value": "f6fd99e9ed7c4cfe6ad88441a852d48d151ec4eefa0bcae621093b0825520e43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2935d85b-b5e4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1649275209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275209, "uuid": "e43df63f-bdf2-4b68-ada4-5c8a4cfc4bc0", "comment": "Malware payload (Mirai)", "value": "3c14be3c468a4a45df6b81cd2040a15f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275209, "uuid": "413e005a-8781-458a-8ddb-bfe7bc5d36bb", "comment": "Malware payload (Mirai)", "value": "f786ccbc0119898defbd0c103b05b1ef451c3030ab1213ce2b0c26a85e3da14b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275209, "uuid": "8ba9354c-ac0f-40ef-a19c-9824f82fe4b2", "comment": "Malware payload (Mirai)", "value": "e3fe5539c39ae6783c26e7d5cd8518e37d5c879b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649275209, "uuid": "bb31ccd0-49f0-4d28-8a0a-d7c9588fa00a", "comment": "Malware payload (Mirai)", "value": "f9fb3f289343e7a83c07b2a14d650642d24e3002458215d04d44015b2682b394c76b27a0f0552dd262d1534125b85702", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649275209, "uuid": "7b32ba8a-005c-4c62-b1ce-e3909661ff63", "value": "T12DB2C131B381FCB2C67284B2666995C357F7077CC4E976302B2156BCB263E972AF4582", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649275209, "uuid": "773021ef-c692-4533-bf10-1faf09ea50d3", "value": "768:5Vp8aUm8JDSZL9oHa3oxbAzVN6FZpViVyAs3Uoz6:5fBsSvo63oxbAzb67pVj1z6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649275209, "uuid": "840151d5-e694-4e25-8f17-994e4881eaf7", "value": 25064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649275209, "uuid": "c8842023-28c0-4749-85cd-5de2ae74245f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649275209, "uuid": "f61376af-5548-40db-a1a0-9952df0e480b", "value": "phantom.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8254c3-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278137, "uuid": "2913effb-6ecd-44d5-953f-aee8295dd9cc", "comment": "Malware payload", "value": "03f2fa280288f0e6206c17b56d4f473f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278137, "uuid": "7e457734-92e3-4135-acba-acb27857e027", "comment": "Malware payload", "value": "f79eb13f3ff41ee3882c4df417910a97d76970c74a05afb1e87f173e4ed932d3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278137, "uuid": "99fc82aa-42a0-4d13-9e5f-f4ee8447be00", "comment": "Malware payload", "value": "077d8f0da2f5a6adf78fb999e11674a0c865ab43", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278137, "uuid": "cdc0572c-f32d-491a-88ea-5b447fd08065", "comment": "Malware payload", "value": "2e41519f8466a78a2666f86f4919e4a7cfbe91a3e1ecac0c1190433318dad655c8f0bd0a8489f6a49ef56534637beed2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278137, "uuid": "ef23be16-0a53-48d8-8af0-aff95c4f7778", "value": "T10751A0C5E4FB4A30BE66E85331F74C153BC2D9D115E66E0EA9E87CED887FD009181A82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278137, "uuid": "ce5156f3-ea9f-449b-ac3e-afa23455638c", "value": "96:vXJ12zNHBBQbnliL43tjcDXjvBoFw3ASZP:Pr+hH4lKsdAz5GK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278137, "uuid": "42c5f8bf-e13a-4392-a8e1-24baed6b7157", "value": 3150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278137, "uuid": "067464c4-9c77-4f8c-8d13-44a4945dc795", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278137, "uuid": "fd48bae4-1363-4b6e-aa4d-2c8dc97baffd", "value": "f79eb13f3ff41ee3882c4df417910a97d76970c74a05afb1e87f173e4ed932d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb02e7cb-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278137, "uuid": "b81362c3-ffb5-4f6a-a778-125f78cdde6f", "comment": "Malware payload", "value": "72534526befbc9045fe7cc8da047173a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278137, "uuid": "d72bfa66-5a62-47dd-b99e-b76f7ffc3bc0", "comment": "Malware payload", "value": "f7c254c69ac52f582271a4bfa8cfd6c75299f382dd3e1f8dbf96a38939c345fb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278137, "uuid": "20c07186-3d9f-4a0d-8889-29843be87a01", "comment": "Malware payload", "value": "16f9d0246b375335705371261690079a135ba744", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278137, "uuid": "52427556-72f6-4799-8278-c857e71e281b", "comment": "Malware payload", "value": "3390f36a374b613f1337a7674d0d41aac0686a1f4b2f31cd5df163524a8f30033a6e59c787a8cc8738853fa41efd9e4e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278137, "uuid": "942c214b-6420-42b4-964b-03b773ce3470", "value": "T11CA1E750112C1AB17246697AD26FFB52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278137, "uuid": "edee59ea-6c1a-42fb-bdcc-69d7fd898270", "value": "96:TRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:TRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278137, "uuid": "61336f8b-2300-470c-a4cc-505e20f7792b", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278137, "uuid": "f3c8b1a1-3616-447d-9503-a6389d91d513", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278137, "uuid": "1e4ac20b-6cea-405f-96af-b0dc831a2308", "value": "f7c254c69ac52f582271a4bfa8cfd6c75299f382dd3e1f8dbf96a38939c345fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3334c43f-b586-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1649234853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234853, "uuid": "dd046562-7b5e-431a-8edf-377e55d4fdf4", "comment": "Malware payload (Loki)", "value": "ccbd0660b2a03fb6e4447a08eb1a6c03", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234853, "uuid": "7835c077-3275-4e28-aba5-c2526c88bfe4", "comment": "Malware payload (Loki)", "value": "f7c58dca13dc0e826bb7aaa08448949c45217fe25f80e6f3b57f9c42770bdba3", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234853, "uuid": "ca299c53-34ab-460b-8f5b-f8b57e2f7271", "comment": "Malware payload (Loki)", "value": "fb7315b0225645a5736f1126bb6ec8e946e26200", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649234853, "uuid": "a3389dda-4196-417e-b27a-f00aca782154", "comment": "Malware payload (Loki)", "value": "cca3989aae884ab388c8756d2564447fb9176457877dd5a3cef69d10b7e6554ebb2effb113d211070a5302eb453068d1", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234853, "uuid": "64a96702-d36d-474b-99ec-eb420bb487cf", "value": "T1091412393652CE8AC3168876C5DB087F971BDD59C90AAFA2F30FFB4D253995488013B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234853, "uuid": "214ac061-ddd2-4fcc-a97b-c5cc9371ab37", "value": "3072:RaX9Dl4LYVB1wVxFbyGogknntqcbN3iEjkkYLnrO4fmZdIRU+BUNaGpDToZq:ATVfwVx8eAtjiEjkkYH+Evyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649234853, "uuid": "133e8f03-cb44-4e05-9d1a-e2f9d1781ab2", "value": 192136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649234853, "uuid": "f91c45d7-ab86-4577-a39a-06ac77875beb", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649234853, "uuid": "32e7e814-8180-489e-963b-928596547a38", "value": "SMIEC MARCH SOA SHIPMENT TT SLIP.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca56224-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278140, "uuid": "80ebb91a-c719-4478-9eb7-67142f262f31", "comment": "Malware payload", "value": "2145b083c7f3b1b447ac428b133a0312", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278140, "uuid": "3a477946-ecab-455f-9fde-e57fb7055818", "comment": "Malware payload", "value": "f815c0c295f1bb8702546a5159e14e9902444a618e2589c8b04b053f8c1e96ca", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278140, "uuid": "0ede954d-1da9-4d60-b0c1-de9703976da5", "comment": "Malware payload", "value": "cc9f460ce57638a031255a16152bb4d845923b91", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278140, "uuid": "b3316e36-4bec-4abc-8db4-258ba97cfd66", "comment": "Malware payload", "value": "4e5bda3a601c205a764b28941efda5c30e4553b72ba0c75b93708690894285a7b588361022931947eaac21ddc72d72c8", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278140, "uuid": "3abbc5ee-10a3-4247-8a85-90a268d61960", "value": "T1DBB533229D3BB5C784690915A45393B396B1BEDC1815F409F3BAEECC25CA4F6B0C2D72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278140, "uuid": "860e50b1-a735-413a-a31d-6d79b58a3d0e", "value": "49152:DJMych6OZaIU6M9yZ29jsE4dKi4qi7/RhQrM+mvsx562dQ10LIKR7a7:DJmAJI9M9yZqQEmKlqi7REM+mvb2TEKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278140, "uuid": "1fc1fab7-5563-4334-86a2-15b3104046ce", "value": 2269184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278140, "uuid": "4d518e9a-f8dd-47bb-b42d-26e81ab12ee6", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278140, "uuid": "f0375f52-13ff-4a2a-a108-9a24fd438ca3", "value": "f815c0c295f1bb8702546a5159e14e9902444a618e2589c8b04b053f8c1e96ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd3c4ebc-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278141, "uuid": "1b7df4ae-f8cf-4e1a-9363-bfee2aff8cbc", "comment": "Malware payload", "value": "53b6f1ab0df67c805996a61126904ae2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278141, "uuid": "8363f7de-e40b-43ec-aa50-9b0065bb7c7f", "comment": "Malware payload", "value": "f83862c77e4438d2a88449a84a331e32297b84a104fd5c1ee2f61535fa760acc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278141, "uuid": "ce5cfc8a-a52f-4dd9-8737-35a3dafd8f38", "comment": "Malware payload", "value": "415b29c6801e36587fb407f8fe25280f8c2fbbf5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278141, "uuid": "2a9f3bdb-a60a-4a57-bfee-e9027f3d6be3", "comment": "Malware payload", "value": "e1cfd7d13b0dab2782d4e9c994a0268128212161a0b08a114140f668a59a15bc8f5b4386345ad861d2468c5e64e57d81", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278141, "uuid": "89df1afd-286c-4177-aeda-c65fba0c4f22", "value": "T1074172C511C616BD6FB2597FA765024870E770B314E1AE0958E424F6808DF44BCE2F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278141, "uuid": "d74e5e9b-b47c-47b7-a440-03b3cbc65ada", "value": "48:v3+g3lA3Lsa3sgJ3Lk32K3lk3R83A+3tgM:vTenvo5S2H+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278141, "uuid": "c86e0b61-05f9-4dd4-9120-427b4ea63660", "value": 1943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278141, "uuid": "a98fea89-4028-4051-a198-e096cd3c1a8c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278141, "uuid": "af0e2909-78c4-45e6-a899-8e0194e852cc", "value": "f83862c77e4438d2a88449a84a331e32297b84a104fd5c1ee2f61535fa760acc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8723ad03-b5a4-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1649247878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649247878, "uuid": "7ebe56b2-4927-459b-80e7-884c699a2988", "comment": "Malware payload (NanoCore)", "value": "be553d78e4562fe590c962dcf279ee6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649247878, "uuid": "07f241de-1850-4da4-8478-077d221a0a7b", "comment": "Malware payload (NanoCore)", "value": "f8f26046f1389769d945b80ab5043d1e7d98579bba53fbebf5a08ccf65d62e76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649247878, "uuid": "a52fdbe6-c3d3-4aba-b4f4-3d05b43f9a9a", "comment": "Malware payload (NanoCore)", "value": "cf9d31bf9848420de9918ce945e6697b6ae96def", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649247878, "uuid": "fc0d84fb-eb46-44b3-b674-99f355415667", "comment": "Malware payload (NanoCore)", "value": "f549bcb1a134f72b063360cc352d22a396ddb68bef8cd35866fdfdaef5cb9376e818d936bd1c7bfbe8b79f38a4753534", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649247878, "uuid": "8be1439d-82de-445a-b180-268d27918a6e", "value": "T1DDC40269B65BDA26C62C837384D3685503F0A713E497D38A2BCC52EF5BA23D60D41BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649247878, "uuid": "2dcd31a3-01dc-4852-9e36-31898ed8f143", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649247878, "uuid": "b4200ecf-8034-4524-9fd1-316cf8d28f06", "value": "12288:d0cJSAsWzzAM/3puW4JgfEmYDvqfdI7h3SiSEYWZcIYF:FJSnW4M/ZN4Jgf0vqfdI71D+mcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649247878, "uuid": "260e60b7-6bc4-4bdf-803d-7d6c8f77af25", "value": 556032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649247878, "uuid": "307710b8-96e4-45cf-b1d3-1da483e1970a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649247878, "uuid": "83330857-fb52-4e0f-b0ff-a5a507af5525", "value": "DOKUMENT_MIRJANA_DOO_PLACANJE_891390510_aprilo_ORDERZZ_DOKUMENTI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdadd1e0-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278142, "uuid": "6296bd8c-ad83-45de-9b71-6534d3e36a72", "comment": "Malware payload", "value": "715af6dec645b5ef828ac4482acc3142", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278142, "uuid": "a1d764d3-b49f-4dad-ab0e-58222e398657", "comment": "Malware payload", "value": "f93707985947d8922281b69ba0432a68821c5c94fabd8ff6679baf63d39b1379", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278142, "uuid": "fdd18722-f4a5-4e58-a011-b6c337431d60", "comment": "Malware payload", "value": "7c44fcc95d35830402dadeca921597a61b24f468", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278142, "uuid": "27afc7ff-c3f4-4663-a6ce-15f4b5931e13", "comment": "Malware payload", "value": "92781ce799dbce09c2af5303833a9d579ee374d6c1fef6a57c223d48ab0d033f8ceb165314d359848182d0d4cb03c170", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278142, "uuid": "7564d3ab-a7ba-46ab-9a83-a44cbea2a703", "value": "T136A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278142, "uuid": "f6d11a63-0eed-40ef-a6b8-093474b4d770", "value": "96:uRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:uRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278142, "uuid": "eb156792-2f8e-467e-8bc6-6c71a6fde430", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278142, "uuid": "a804d2d0-0c64-4c9a-a038-20775b96377a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278142, "uuid": "089ae715-dbd7-4939-bb1e-95d45776f4d1", "value": "f93707985947d8922281b69ba0432a68821c5c94fabd8ff6679baf63d39b1379", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b97ee0af-b59d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649244956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649244956, "uuid": "4c334cc8-fb75-41e1-9006-74139f02821a", "comment": "Malware payload", "value": "ebf9e37cbe33deca05f7b832fe593c1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649244956, "uuid": "cbfeb178-964c-4d2b-a620-674787baffc8", "comment": "Malware payload", "value": "f950a8dfcb770b402b1369be1b9f0e6e900279f9b5474356db7673ac0df78245", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649244956, "uuid": "d0af925e-ccf4-47c1-80cc-088d0ade4e1a", "comment": "Malware payload", "value": "bab4ce2ba1aacc6b46e109e84e7facaf76424bca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649244956, "uuid": "34cdbe3a-2db0-476a-be8e-3ee1eed272f9", "comment": "Malware payload", "value": "410bfbd552157bb9bfde2d1083cfc4d52e545b626443769a073e419afb5a97dea5e69a2c86fb45d3716a50c86b58f9c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649244956, "uuid": "cd9a1b72-3b1e-4197-86af-c59d9f51d8b3", "value": "T137810D4E946104E7EA5DCEF44AA3855C3FAC228114A1483189670ECCEDF3B94F21372E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649244956, "uuid": "95a7ecc0-306e-48d5-a3b8-37da6c8547cb", "value": "190c6a3947676ff3239bab46bb6e508a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649244956, "uuid": "087de59f-4b46-403e-8a7d-52971356fd40", "value": "48:i7pTs7TSxM8dUh/QZPRWuxxSM7hyChmDTbsAQapRk:mWoK/E5WuxGTnpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649244956, "uuid": "998b79e9-0d4a-433d-b8c2-1614bbc28323", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649244956, "uuid": "d319c3e5-aef2-4771-8e9a-d36b345c0958", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649244956, "uuid": "b2a3548a-69e6-456a-b4b3-59f0d275b101", "value": "f950a8dfcb770b402b1369be1b9f0e6e900279f9b5474356db7673ac0df78245", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6304a04d-b5b9-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1649256837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256837, "uuid": "87f3b0f4-3a9c-427c-9c29-2aa2bfe67cce", "comment": "Malware payload (SnakeKeylogger)", "value": "de9885c0774155523e30c91c446f9bf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256837, "uuid": "78d732d6-6288-41a3-a972-d4fa00cf786b", "comment": "Malware payload (SnakeKeylogger)", "value": "fad57f5e38d607e110e979af2a37d5c837fc3ce9e5028ef3ac6f9ea124a4d781", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256837, "uuid": "59afa4e9-904b-4d99-9f98-225dc9cb94d2", "comment": "Malware payload (SnakeKeylogger)", "value": "f9d60ccd6e8ca1263093c761d86f8d4ec0052b1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649256837, "uuid": "7fee2a7f-c653-4836-9936-68196ca8f95b", "comment": "Malware payload (SnakeKeylogger)", "value": "b2c625e578d332ec5c9a1a44213a792a0e9493e1b32fb076712db120d917e3e7e9e0ba5ae7b8f088bddff798cdfcce07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256837, "uuid": "2fe2d9ac-41dd-4bde-95af-dfa796a2fb90", "value": "T125D4F126F2A6C95ADE58173BC4F6C4780332BE466533C71F39EA2D6B39533A34840B59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256837, "uuid": "d33a235e-05e9-4688-bc31-b428739d0e1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256837, "uuid": "7091e9aa-dc49-4dc0-a561-811a8d860686", "value": "12288:AZ8hFFbA4jz40z/ZfjDwM+aS6AXIGVmziBUP:w8NzxzFDwM+60RL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649256837, "uuid": "17009612-35d4-4bbd-8421-933191d4f11b", "value": 600064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649256837, "uuid": "d942fea3-c012-4f6b-b459-910ed85ad993", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649256837, "uuid": "1cadc6bf-088f-4b6e-b086-5a449bd29e51", "value": "de9885c0774155523e30c91c446f9bf7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32bea588-b56d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649224114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224114, "uuid": "cba080c2-43f1-467f-aa28-785d73180e1d", "comment": "Malware payload (Formbook)", "value": "a5b39e8c2e8abdb45d46ef8565b9e1de", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224114, "uuid": "5effbc68-e8c8-4c77-8fb3-66dc5368f174", "comment": "Malware payload (Formbook)", "value": "faf23d7a12b7d54dd2b16ccb3af80c37102a95664a15120d3b2a608757f9e10e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224114, "uuid": "06b7e185-7520-43f5-9540-a50843395cea", "comment": "Malware payload (Formbook)", "value": "ee7d7baf3a00bf83ab41cd45f5f7e5c7f45b75ec", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649224114, "uuid": "9d485603-320f-439e-8a5a-c84510f46bce", "comment": "Malware payload (Formbook)", "value": "663f15b7e5c4c527d8178904a4381747bc49c1517aa300c2d30a11eabfb0c3114e2be60dd77f5c2d2c3801de761dc0aa", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224114, "uuid": "05d9363c-2b64-41d1-8224-08588569df1b", "value": "T1BC440C02257CA8C3F69C6C73A8DC871E1EE16C6C4676502DF64BB6E9D63F143E5212E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224114, "uuid": "c18c43cf-d9a7-49a8-b0ee-22c4d783a6ed", "value": "768:Py1PgPp+gXOlrLUgx1fjy7QcNlS1Br/k0DblnhwDq2PrW6/4/Ve6ame3EkGVBKcN:PyOPp+gel8gjy7VNgvr/BDb9hgWS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649224114, "uuid": "9186c54c-b007-4fcd-9e20-056438104833", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649224114, "uuid": "c8543927-58f7-482d-8698-e4c4c2d463be", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649224114, "uuid": "1ee6e961-1ba3-4298-bf61-6b4212efd63f", "value": "PURCHASE ORDER = 62048-2.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe2844d9-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278143, "uuid": "330cd4ae-6984-44ce-81ca-258d4793fef2", "comment": "Malware payload", "value": "25872b31c475a67b368811be37c90438", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278143, "uuid": "f9ee16ea-6c4e-47ed-98d4-80087382f12e", "comment": "Malware payload", "value": "faf81f5b6b6c7fb6186f02854881445c65d05a02396d16c52fa8224847fb8dfa", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278143, "uuid": "8a6435fa-8fd4-4c62-b5f7-af6e5c5a9458", "comment": "Malware payload", "value": "b653301bda28b61afb8eca73e6e246596f4ea1f1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278143, "uuid": "4a4f2246-d6fb-4b14-afc7-ebb3101bf23e", "comment": "Malware payload", "value": "cd97bb93cb0191364e8a969df9aaac41779724e5304280486d6a18d500cfd89cba7eda1546c96d5bd8c7dd21a6cb1190", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278143, "uuid": "4fc1165f-8f8e-4abc-958e-af0f3f6fd8ef", "value": "T1F8A1E850112C1AB17246597AD26FFB52B50EC81B0A7B7B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278143, "uuid": "6c5bf365-53d8-46e9-a649-aa5c89ea4b0b", "value": "96:77RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:77RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278143, "uuid": "0855423e-f6ab-4b5e-acf2-16ae3af41045", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278143, "uuid": "b1e5c575-3a11-4947-956f-92c1c4620f8f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278143, "uuid": "1d0d1682-acbd-4430-ba35-f16892f5db40", "value": "faf81f5b6b6c7fb6186f02854881445c65d05a02396d16c52fa8224847fb8dfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc8b4b5-b5c7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649263106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649263106, "uuid": "a4ce3469-7625-49d0-8a9d-623395e34f4a", "comment": "Malware payload (Formbook)", "value": "ef653132d0f9c9a31c2b4fe7d915ad5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649263106, "uuid": "cc46601e-1997-40b4-b878-75aa5b20655b", "comment": "Malware payload (Formbook)", "value": "faff2bfbf22cd4f7d3d79ae04fbff8db10e9e0c5416dd27644f5bcb0d5dfd98c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649263106, "uuid": "95d134c7-559c-4be0-a747-03ba1588a190", "comment": "Malware payload (Formbook)", "value": "31a737292b12d6f733d4dac1457ccd0dfa829c16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649263106, "uuid": "0793df61-5c09-47e7-802b-4eec06659099", "comment": "Malware payload (Formbook)", "value": "c3c2dd4a345e0a71574e188181a42b04f88696a9c86ff16eec110a57e34d41f58f931c24af8b9272887ec345d196fe39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649263106, "uuid": "a62be545-5b27-4c0d-a4d8-3098bb40dc62", "value": "T10EE3BF19BF5CD923C700077544F2E3304B34AD85BE06D717ABEA2EAB3D367446D86262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649263106, "uuid": "296f5e68-d133-447d-beee-a298135b04e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649263106, "uuid": "77eedb38-a30c-4ed8-8298-9e7e34e1f8e4", "value": "3072:S394t2D09UGJfUCy1YK3o4Zn1h2hAdmJ:SE3tWrp3Xi6dm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649263106, "uuid": "d6b9404d-6cac-422a-993c-2f1093562262", "value": 146944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649263106, "uuid": "5888e975-0921-49a6-8bc1-487f1f178de1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649263106, "uuid": "a458d81f-54ff-4af2-b7ad-524848af49ab", "value": "ef653132d0f9c9a31c2b4fe7d915ad5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9f7c42-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278144, "uuid": "a46e1d46-7f63-4895-8e92-b7a33b750479", "comment": "Malware payload", "value": "c1d813e8ae1439347fe1baceab569f05", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278144, "uuid": "05a03269-bcc7-4595-96bc-a0b75fdfeae5", "comment": "Malware payload", "value": "fb29a8013922a97055e8c02f6a27dc333ab03dc3e1519cd7b34aea00611171d9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278144, "uuid": "cf60c631-acff-47d7-bd17-0a120012bf33", "comment": "Malware payload", "value": "c962c3f27d4d2caceecd5d52cbbb4dc30eb33ead", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278144, "uuid": "c02f406a-d877-454c-84ad-402a0490a6dd", "comment": "Malware payload", "value": "5f0bea9fc87e876ca49a0141602af22a4e71bf476d43f08b8d63f6830d44f703817b68ae7d31c1acb5bb66f15c90a6ab", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278144, "uuid": "eb984ba3-40db-4fc5-b42b-8235c36f1004", "value": "T141A1E850112C1AB17246697AD26FFA52B50EC81B09777B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278144, "uuid": "f8e4e34f-945c-4b19-83e9-82c43b0fadb5", "value": "96:rRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:rRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278144, "uuid": "066f68b4-d04d-4d80-8510-3f2b0e73a14e", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278144, "uuid": "a55a1f6a-07e0-4a17-b0f6-7e15544965e8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278144, "uuid": "793c2b7b-91ca-4c22-afab-490e96cf5338", "value": "fb29a8013922a97055e8c02f6a27dc333ab03dc3e1519cd7b34aea00611171d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81689f96-b5c7-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649262901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262901, "uuid": "e887477e-55e6-47ba-ae3b-5c8350572e48", "comment": "Malware payload (AgentTesla)", "value": "7f9d131061c185f5a1ffd1cfd7378275", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262901, "uuid": "cfc2e79b-604a-4fef-b5af-0f0c9fb13eab", "comment": "Malware payload (AgentTesla)", "value": "fb37efb44fe9befa68076e623e3f2ba4d1f4f13c65892ce04227be3857b77f04", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262901, "uuid": "9de04539-bd66-4cd1-8429-70f7b647307e", "comment": "Malware payload (AgentTesla)", "value": "4b09c6fb034a8643ab80a32a11aec2bbfc60ec69", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262901, "uuid": "e031ab5e-f44c-4fb6-bb6f-2f5932c81385", "comment": "Malware payload (AgentTesla)", "value": "31dd9ee97883e4d3f1562e84ebc5c6bd4e1d51898ce02a37161a463ad8d14567914eb48fd1a1508f01c82b43b2db925e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262901, "uuid": "23889faf-0c84-4109-a278-24f7d0335f87", "value": "T1C4C41205A63BDD15C96E9AB3E0D7590403759A07F066EB4F2FCC129E6B123EA0E05BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262901, "uuid": "2d62e290-c5be-4b2d-abfa-6ccfadc80d8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262901, "uuid": "2ea01cff-f673-43d7-b65e-feca02f46ac1", "value": "12288:IacmDoCz3kEizCR09e8JrOG855liFK6CbnzlZN17tPp7kUJF:Bz0fCRoe8Jr8vD6CbnzlZNLpIUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262901, "uuid": "177a8119-bbfa-4974-9d10-1e40f955b7f1", "value": 556544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262901, "uuid": "3dda7c54-aef0-4ae2-bd6c-2ef7b6f93e69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262901, "uuid": "34a21e4a-69c1-49e5-a1db-508044b1a5f4", "value": "7f9d131061c185f5a1ffd1cfd7378275.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff1a39f0-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278144, "uuid": "82852fc2-0a37-48ac-be3a-85d3b58bb126", "comment": "Malware payload", "value": "dc8967123a323792168f0fea17122b9a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278144, "uuid": "33b543e8-a472-41c3-8017-795a5a04ac70", "comment": "Malware payload", "value": "fb8117b6744d87f38d9356a299ef39adc90054363f934c40d85c90d8542a0a9e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278144, "uuid": "f17cd3c0-4a35-4ea1-860d-e5d34ee60268", "comment": "Malware payload", "value": "96bf0b1ff98a82c9423c7a5dca55eea9d1673390", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278144, "uuid": "d8dc6199-d5f3-4426-b35e-264a0ade307b", "comment": "Malware payload", "value": "b393d8010e4cc21934c95562665eb3925b9de807c20a020afa8994b8efa9f9afd8470b60eff5da59d979fd280af448de", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278144, "uuid": "7d5ee2ac-3b86-430d-87ff-402cafc1781b", "value": "T112A1E750112C1AB17346697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278144, "uuid": "b3362c63-41e6-406e-911f-80be577b9a28", "value": "96:aRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:aRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278144, "uuid": "4e06f7a2-2b70-4c24-9926-04df6bf82bb5", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278144, "uuid": "e83e5fed-48bb-4fe6-a86f-b27315437d18", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278144, "uuid": "07671c72-ad4a-4103-ad5c-4dc14a8fc589", "value": "fb8117b6744d87f38d9356a299ef39adc90054363f934c40d85c90d8542a0a9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8fe116-b5ea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278145, "uuid": "e809e291-54a2-4c5e-b9b5-d5705178fd97", "comment": "Malware payload", "value": "94421581ba390ebb0e5fbe31bca70ba4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278145, "uuid": "4dbeae56-7ec3-47d8-8ade-0c065beb8ed9", "comment": "Malware payload", "value": "fba95d5f807fe0db5ecc85fe87adb9e67ecf976ebc6894f7155ddfc66eb03ffe", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278145, "uuid": "6ee7d101-95c8-48e3-822a-42144d523f76", "comment": "Malware payload", "value": "33e1ecd2a74e9c76055844d3693a91882f5ec5b0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278145, "uuid": "5a02aef7-c477-4972-bbe2-7191322e5c30", "comment": "Malware payload", "value": "54dbc94d0648e0fd01e4f5a2ddea0f261c7b85bd6971e45d27a1b0c2ff4f741890be482ca655ec23a62c155dea868fa5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278145, "uuid": "4da8a8e6-da9d-42a8-a501-59a89d15f9ff", "value": "T1C7A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278145, "uuid": "54e93eef-a625-48e3-8716-da4288c72947", "value": "96:SLRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:SLRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278145, "uuid": "f512f6f6-a91b-48a2-886c-e00ea6b87bab", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278145, "uuid": "b84931b1-6db1-42b4-ac99-fc6e86fcb251", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278145, "uuid": "6bd4c7fe-539f-4766-b0c0-e32bec2e6534", "value": "fba95d5f807fe0db5ecc85fe87adb9e67ecf976ebc6894f7155ddfc66eb03ffe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00016b18-b5eb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1649278146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278146, "uuid": "a2bc7dcf-1e15-43a8-ab64-da655496ee4f", "comment": "Malware payload", "value": "bbf7516e44e8ee9de5ec9536e9ea2a42", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278146, "uuid": "70c859e4-5d1e-498b-aeed-51ab05aa30a2", "comment": "Malware payload", "value": "fbaca5d51cc67c57f20729bbacb027cb312fa431801abb444977e1a2ca5e39d6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278146, "uuid": "047c9f3f-82cb-47c1-9f8d-0a8b8cc1b070", "comment": "Malware payload", "value": "581350e7bd9201a4814eecdc271abd9752bbeeb2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649278146, "uuid": "1062d804-f83b-4e4b-a6c1-89b7c59656da", "comment": "Malware payload", "value": "d826bce256b94b48404339b546b23c94a626c5b01040e1f5a9fdda1a1392fad4e701d523cdbb9e06f0fe2b1e4267483c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278146, "uuid": "3edc9ac8-086c-4899-9cb7-42c70c270005", "value": "T1B7A1F750112C1AB17346697AD26FFA52B90EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278146, "uuid": "43fd1879-4a40-4dc1-b81a-620e832e3380", "value": "96:aRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:aRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649278146, "uuid": "ae2d6b70-0da9-4d47-b8fb-41055a13ea64", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649278146, "uuid": "ef731fc3-747a-4dd4-bba0-606cfcca9f16", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649278146, "uuid": "63c07e1b-b242-4d56-b5d7-2d50eec2ad9a", "value": "fbaca5d51cc67c57f20729bbacb027cb312fa431801abb444977e1a2ca5e39d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f053bf5c-b5c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649262658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262658, "uuid": "af37cd30-72eb-4f72-8e3e-48ca2e4d94a6", "comment": "Malware payload (Formbook)", "value": "15d03d077d4883d801c4420895d3ba63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262658, "uuid": "c56b2031-0ea3-4d43-8c5a-f762ad1d36ac", "comment": "Malware payload (Formbook)", "value": "fc0298b6968720affc88ee57d037699606f5bdeb5d6d47db892c4fec474c062d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262658, "uuid": "6cfe8208-4487-4939-8e05-805ce7c1c8d4", "comment": "Malware payload (Formbook)", "value": "77f59a4ea5ef5df02582e2a918f0cd0179660273", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649262658, "uuid": "eebf2669-f657-479f-bc13-1c253173464e", "comment": "Malware payload (Formbook)", "value": "2fcaa595302aee3062c78d36fa1ac8aaab25aa0160bfbc3020d6bb3e9df5d33148156b3694800307affd1f06bf5792b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262658, "uuid": "85e9e7d3-55b1-4dba-bb41-3b4fdc6c3e45", "value": "T1AF34125033E5D49BF1A30A319A39B65369EBDB0645744B8F0760BF28B429EC2CD2F752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262658, "uuid": "5100a5eb-f099-4078-bdfe-9e32ee5b7e5f", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262658, "uuid": "781de515-308f-4063-8c84-657561484e36", "value": "6144:HNeZm0hg11HoIWN+u/Dg/RwnXkcIe8bhoxKr5fGn:HNlL3HoZNDLVqhoK5Gn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649262658, "uuid": "529fc4f7-b634-46aa-b237-d84799fd2b99", "value": 249984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649262658, "uuid": "cb7db698-b52e-400a-b9a8-84af00311434", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649262658, "uuid": "ea60abc3-68e5-4f70-8097-056107763bc9", "value": "15d03d077d4883d801c4420895d3ba63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79dbe41f-b5a2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1649246997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246997, "uuid": "22a8dead-44f8-4193-9bf7-1c87692cf8df", "comment": "Malware payload (Stop)", "value": "d500c755e3627f7159a746e891b2116a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246997, "uuid": "88ec4bd2-de56-4970-876b-98352e993992", "comment": "Malware payload (Stop)", "value": "fdf17bd486e8fe2827d8552fe04349f5eaf50d913d2739b95bde28435fc2176f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246997, "uuid": "680ac46a-dc89-45bb-865b-f92d60bb3a29", "comment": "Malware payload (Stop)", "value": "543061358bd9503d91418e8f8190b8cf51a604c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649246997, "uuid": "b339f8d7-ced7-499f-b89e-1fe21a4b9fb6", "comment": "Malware payload (Stop)", "value": "1a41df2c561996a63b4fefb42e8efbd01f2bbec5d28e61174c16d0eaee63b24e53981a5a5f292fc448429c4d8637f4ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246997, "uuid": "390fc644-89da-4bdd-9f93-6c18cf142614", "value": "T145F40210FB90C038E1B716F448BA8369B52EBAA15B69A4CB72D517ED4734AD4FC3170B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246997, "uuid": "7e677207-9208-4bd5-826a-0539e1b5e135", "value": "0eee5b00eee30e3f45148ced95e2478e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246997, "uuid": "531aa6a3-34be-446c-bf4d-fbe684b240a6", "value": "12288:/SYC9LqdOlXpAi6yNETl6+ukNAGUsl87ZXkvrJVID1QCy7:/23lWiSpxuNGUsl9TJGD1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649246997, "uuid": "fd2f015b-c3a6-4fd0-83eb-abb8c7e286e0", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649246997, "uuid": "18200e13-515b-4759-ba99-5a9e2060c67d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649246997, "uuid": "156688bc-e514-4cc9-bd68-8fb5be0ff837", "value": "fdf17bd486e8fe2827d8552fe04349f5eaf50d913d2739b95bde28435fc2176f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "043a8241-b5cf-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1649266127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649266127, "uuid": "060d3240-ae23-4ae2-bbcc-f96d393d66b1", "comment": "Malware payload (AgentTesla)", "value": "6aa089da1b3580a1aaefdc3f7b7856fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649266127, "uuid": "6499d226-22d3-4633-9ce8-9e5762119c8b", "comment": "Malware payload (AgentTesla)", "value": "fe1f268ea15153b6f0e9935ce18b75a2da354ab2f84c3662b29e21054bf2cc22", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649266127, "uuid": "cd6b4484-bc73-415e-aa8b-7ebe1dc2e5ee", "comment": "Malware payload (AgentTesla)", "value": "32cb589bbcae3f339d6ecd0a5a68231a50b2a92c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649266127, "uuid": "f9726538-2768-44c9-96d9-54be492a59d8", "comment": "Malware payload (AgentTesla)", "value": "59197006c04e43c8d0bd8552de7c057225e00fb39749e7801d30cb5d444e789b971646efdf006f0287158d5a1d032849", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649266127, "uuid": "76a8eb95-5997-433a-81c3-dd381c459747", "value": "T17405BE0DFBBACE12E2980B77C4D9580447B1E921E656D71FBAD126EA15033AF8C4364F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649266127, "uuid": "11595f26-4bf4-47d3-bf51-9d93b90452a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649266127, "uuid": "ff460e61-47b9-4d3f-98a9-a75ce8e2cc2e", "value": "12288:rTv/BVuBC6ywQUubq3OBD+BIJ0w7tTo0ggwe+GJ/t53ul24/:rTvecQQbuOBDEoS0g++GJ/tNul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649266127, "uuid": "d8077b62-dd32-438d-b27e-b493837dbda1", "value": 862720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649266127, "uuid": "f0b142a5-3c95-441f-b651-62a0be7ee2b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649266127, "uuid": "f489dab2-a0ec-460b-ab2e-e7b5b4d230cd", "value": "Tender notification05.04..2022.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b50c18c-b5cc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1649264877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649264877, "uuid": "94b10881-c625-4b7e-9c9e-dbf3a8799103", "comment": "Malware payload (Formbook)", "value": "7943f78d4a3f852c6c9b68b19139d5e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649264877, "uuid": "07f86018-d033-46af-8e05-12d8deb4db5e", "comment": "Malware payload (Formbook)", "value": "fe5228dc8dd399335b380e7cca9fa87c3742003c9836d6d9d8e2e6152d6914e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649264877, "uuid": "49ef2835-cd7c-4aee-816b-b030df65476b", "comment": "Malware payload (Formbook)", "value": "331b401fae94f338fd0915ec4470e1ff4c62372b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649264877, "uuid": "83877510-36ed-48ab-8c40-87a794950302", "comment": "Malware payload (Formbook)", "value": "b6ba9c1368e42659d38f9ece2ea24865741d3cdce51d12b1475d173b5b477b6940437bd4021c4fb7c7f006f644c2adb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649264877, "uuid": "35f41b9f-70b0-4111-9357-5fa6e755b713", "value": "T148945762D030849EC7552EBD3B55C7B2259B5E332ABC94DE3A123DA066300897FE5E3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1649264877, "uuid": "7048b607-8abb-41d8-92e5-ca814ea76444", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649264877, "uuid": "67469c73-c1b2-4464-b39e-f80c6d4f627c", "value": "6144:qNeZTeP857xctbCsMNsskhpBxw5Fp4JS+2lLNkm:qN8CaxabCsMhwpBx2p4d2Zt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649264877, "uuid": "b9365945-7037-4dc1-b898-b7a22d508268", "value": 414250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649264877, "uuid": "f07c08d1-d749-438a-b113-fa682b309c62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649264877, "uuid": "f793c55a-a656-46d0-9600-02904e4ff0b6", "value": "tt-copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a98c7b6-b58a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Joker)", "timestamp": 1649236744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1649236744, "uuid": "8e5f959b-1797-413c-9f40-a6a81241bd86", "comment": "Malware payload (Joker)", "value": "8388d890325fd8ea69b479f0dd3d5187", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1649236744, "uuid": "16c8303e-019f-4774-b6a4-40fcd2e8dfe5", "comment": "Malware payload (Joker)", "value": "ff351b81338e6115c1280c5f51c43fbbc06e477513087f45e0582bf14b26c6c6", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1649236744, "uuid": "2ccc6f3e-d360-47cb-9a44-42287920129f", "comment": "Malware payload (Joker)", "value": "3a96562e0a25587c3f053163fa9db03df2858971", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1649236744, "uuid": "c409e570-fc7f-4487-9ed2-309ddff816b3", "comment": "Malware payload (Joker)", "value": "6afa8aec0ef19aa3b392eb0eecbf54b5b712085c427cff61320c968e867962c31712f5e4f4b235617853267b6dd31ad7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1649236744, "uuid": "c2bc567f-72ff-4cd1-94df-6b813b45d5ab", "value": "T18BE62267F72E949FC8F395328E3A126216A74D644743ABE72D01B23C59B3AC05B59FC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1649236744, "uuid": "53144273-b19f-4fbe-b7eb-9de48c918f89", "value": "393216:xRsrl60FK34h8qCtMgN8qL24gbkvA8rY44gBy2JJK:ocg/5CZ/gAvAbgBy2JJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1649236744, "uuid": "c9b91109-79de-43c7-9adc-58f093215fca", "value": 14690138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1649236744, "uuid": "ae9c45d8-4fbe-404a-bc35-e8292ec7308f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1649236744, "uuid": "3522109a-998d-4702-8034-9e71f22a07ad", "value": "com.vei.messenger.wallpaper.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }