{ "Event": { "published": true, "date": "2022-10-11", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-10-11", "timestamp": 1665532981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "7e0a07d1-4e1d-4e34-9812-167ed82ff376", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c6ae62f-493e-11ed-9266-42010a9c0072", "comment": "Malware payload (DCRat)", "timestamp": 1665476663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476663, "uuid": "055612e4-cc4f-4a08-82a2-aa3524b1da73", "comment": "Malware payload (DCRat)", "value": "2f6491b72dd5da951d5bc1605377c42a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476663, "uuid": "0ba6a741-9a6f-47e6-8c1e-52e77cefc457", "comment": "Malware payload (DCRat)", "value": "009ef7acdb9a3a7ff2262e8531e5273f307528a1e98ba61d6c0eb7117fbb1ae5", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476663, "uuid": "6eaea196-74d8-4126-a1f7-02477339deff", "comment": "Malware payload (DCRat)", "value": "8f64dddd4c6879e3340766c9c833a57e72ac3077", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476663, "uuid": "dd69e788-2e4a-47b4-b34b-8af7824e6bec", "comment": "Malware payload (DCRat)", "value": "a1446059399054751264fb3d080e201656160c1e68b24f5f91f0891b1c050c006393151535388e2492142a4052fcdf02", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476663, "uuid": "2714d8aa-67a6-47f7-bc40-e1b536a629a8", "value": "T10654CF02B7D28472D57319366D39A721A97C7C204F39CA9FA7D40D2E9E311D0A626FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476663, "uuid": "7a9df082-ae77-4419-b639-57416bfe5ef2", "value": "027ea80e8125c6dda271246922d4c3b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476663, "uuid": "31c462be-b855-432c-8e80-1197bb1f2e22", "value": "6144:fc0h522p3l04ZMSmIp3Uy28uhyqe/I3k1ajSDAY61Np4T:nhxp3lZnT9bDuaI3uQSDHwX4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665476663, "uuid": "ba812804-b61c-4a98-8c9e-62b4488d3101", "value": 302482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665476663, "uuid": "f1f4d3cd-d321-4257-9970-60a46698a11b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476663, "uuid": "db1497e3-d307-4d2e-8a57-3a8841d2cf03", "value": "2f6491b72dd5da951d5bc1605377c42a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d9a83f-492e-11ed-9266-42010a9c0072", "comment": "Malware payload (Guesswho)", "timestamp": 1665469994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469994, "uuid": "433b9f3d-5d5b-4d5e-928f-d962779868d6", "comment": "Malware payload (Guesswho)", "value": "7f7d201a0611f99c5719d33615d6ad74", "object_relation": "md5", "Tag": [ { "name": "Guesswho", "colour": "#43EABD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469994, "uuid": "66d0819d-2845-48ca-bc91-4045c9754104", "comment": "Malware payload (Guesswho)", "value": "022c33465774d287d13a7b10f9bedb0f9f530486c7f7aec443f922da6de8af01", "object_relation": "sha256", "Tag": [ { "name": "Guesswho", "colour": "#43EABD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469994, "uuid": "2295ca68-f6a0-4b58-9cbd-365288636052", "comment": "Malware payload (Guesswho)", "value": "6d0f39be34e7095f4a61889369b56aff7b578792", "object_relation": "sha1", "Tag": [ { "name": "Guesswho", "colour": "#43EABD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469994, "uuid": "e55bbad3-df0d-4786-9c9f-437375174f1b", "comment": "Malware payload (Guesswho)", "value": "f1f39a3a389ebb110c9dc4330ac662e0127fb50053664bdb9e0a7e7e772486ca42ed9b1259634018623532085ba923c3", "object_relation": "sha3-384", "Tag": [ { "name": "Guesswho", "colour": "#43EABD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469994, "uuid": "0fa04ef0-9aba-43fa-82d8-f67cd6a1b7a5", "value": "T1CDB4C001F38BD431D1B219303A79E3624D7BB9214B278AEF67D85A2D5E342C17A33766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469994, "uuid": "bcc807a7-5cfb-4305-ab35-b43c38736773", "value": "78d98747e18e2f07ee880983a4715b72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469994, "uuid": "1cd31713-9383-48a2-9ced-223d0ac22e42", "value": "12288:jYC6RswBAC5X+yqxtxfR69ACvA1DEP3EgqJ0Bb:sD/BY7CvA1DcEgqJIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665469994, "uuid": "1c224da4-127e-484d-911e-f3668e8ea395", "value": 542432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665469994, "uuid": "cd73fffa-f491-4428-8d44-9fc6bfc9ac66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469994, "uuid": "e1447361-d3fa-4173-9f8e-2c964883f10c", "value": "022c33465774d287d13a7b10f9bedb0f9f530486c7f7aec443f922da6de8af01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a4a86c-493c-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665475812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475812, "uuid": "a0d1aac4-b31a-4de6-903f-e29f2aef5a84", "comment": "Malware payload", "value": "67a2a70a2f76ce508e8fd2d74ecfe645", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475812, "uuid": "7aefe70c-1cc0-45eb-bef2-57840e85c4ec", "comment": "Malware payload", "value": "02335caf4f53c34a67199081bf4f8692ea1c163531f46077af42eebad2513535", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475812, "uuid": "6c896004-cfdf-47a3-ad68-e4965a77cb89", "comment": "Malware payload", "value": "f625b160136384365fafa14d9815b24253be4600", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475812, "uuid": "62b9da18-46c8-489e-9d2e-6c30d958138a", "comment": "Malware payload", "value": "e0622847b182c573018c68c1454851e38e8ec7defaca865eb77bd930988f27f7a5df65a0fdcaa37e22540e524bcf0985", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475812, "uuid": "dcf76cee-5558-427a-bcc7-2e8846ecfc58", "value": "T12725F7E1D7BBCE05F05D527CA8200B1886A9E636767BC76D0F4CB86C5D0AB50AC64B73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475812, "uuid": "384f962f-571e-410d-8001-9a4d77783761", "value": "24576:t9/8vHMbs2vPKxnU3B9x+C/JKbm9+cbw:y8FKxnU3B9x+C/JK4+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665475812, "uuid": "d92f344a-01a3-4b46-802c-0e35ea1991c9", "value": 1049115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665475812, "uuid": "c4053846-74f4-49c6-b808-5f5f10a25827", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475812, "uuid": "f6cf3f95-296a-442b-8923-caf218f21cc5", "value": "02335caf4f53c34a67199081bf4f8692ea1c163531f46077af42eebad2513535", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a99ef68-4974-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1665499906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665499906, "uuid": "d9d1f95d-5e5e-490e-8c67-3c51e87e6bd1", "comment": "Malware payload (ArkeiStealer)", "value": "3241a0a8474740585f1b94542e5bc11c", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665499906, "uuid": "988261b0-7555-4709-92a9-c9b4f0247ad4", "comment": "Malware payload (ArkeiStealer)", "value": "023a40eef791f4a545b8f2afba47e34999d33aa692d5b2918da973790236e8ff", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665499906, "uuid": "c09f0ffa-a378-4e33-960c-7fa48f22a295", "comment": "Malware payload (ArkeiStealer)", "value": "61aadefcaab2030e1ccf1eef26f205b21ef93806", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665499906, "uuid": "78eff495-cb35-4c4b-a359-5994157f33dd", "comment": "Malware payload (ArkeiStealer)", "value": "e0e457c0e3f9bf2bf116c13fa00baccb0ae9dd158a1bbfeba5fb093c293777fda6b575fbf477a921e6b65abacdb67f26", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665499906, "uuid": "b1c2e83a-23fc-4f08-819b-85918481dd4b", "value": "T18026F1F490AB04E6F80B6DE0697C7DD2467176F38DD80E20137EF6048FA79696A0895F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665499906, "uuid": "09c01bc2-7c78-410e-95e7-54b1cf8aad61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665499906, "uuid": "1b63fbd5-e053-426b-bf80-98e7f071058b", "value": "98304:Enoglt0vUjSOvO7uSgtXgauvcjq9aCTMFWbQC:MogXjSuO7uDgnMFWbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665499906, "uuid": "dbf3cb8e-b5e2-40dc-a4e0-bbb4871714f4", "value": 4784128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665499906, "uuid": "b1b7c354-3619-4863-93c4-14991aef53d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665499906, "uuid": "2cbe3725-d508-4704-afdd-52d42ff0e016", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c4c40a-4960-11ed-9266-42010a9c0072", "comment": "Malware payload (WannaCry)", "timestamp": 1665491362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491362, "uuid": "dad5717c-e4e0-43fc-9105-074d79cafbdf", "comment": "Malware payload (WannaCry)", "value": "5c6b98475b9c14da9f64c0c3f7bd88f8", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491362, "uuid": "ca7a23fe-7ca8-445d-9537-f9e761aff678", "comment": "Malware payload (WannaCry)", "value": "0356be7cf465e56da370730e2d8707dab9dfb5c446f0eeb9605d2a05d8bca3ba", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491362, "uuid": "8b9246e8-6ecb-4838-9975-2f278367bfcf", "comment": "Malware payload (WannaCry)", "value": "917b925bd03cb35994d9ff0db50e81748d27b420", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491362, "uuid": "85893f95-d883-4ebf-af07-4dfa6e139a47", "comment": "Malware payload (WannaCry)", "value": "64251a8aceba5434ca6c35bad97a401191e97d6f055f38702f0ec31e8715f8906acc6692c36b774227e3dbd2472f6297", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491362, "uuid": "a366606d-749a-48bb-9c0d-503b360b0457", "value": "T1EEB5339971BC92FCD20529B444AB8A23B2B27C6D21FE6E0FDB4049761D43F56B790B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491362, "uuid": "c43f6cf5-4879-4cb9-a0d7-3f9f78834ebd", "value": "9ecee117164e0b870a53dd187cdd7174", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491362, "uuid": "885db3ff-b9b1-4081-92f0-7e8b622cd27b", "value": "49152:+n9MSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvn:q9PoBhz1aRxcSUDk36SAEdhvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665491362, "uuid": "bf4c7aac-1a67-4cd8-8a70-8eb2d80cfa0c", "value": 2281472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665491362, "uuid": "56ed7225-62a9-4f1f-be8f-37a062053263", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491362, "uuid": "cd67facc-8313-4d2f-a948-61e4eff8d966", "value": "0356be7cf465e56da370730e2d8707dab9dfb5c446f0eeb9605d2a05d8bca3ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67699e6f-4918-11ed-9266-42010a9c0072", "comment": "Malware payload (NominatusStorm)", "timestamp": 1665460468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460468, "uuid": "a92f4eb0-1fb5-4e10-9ced-7058e0f85f61", "comment": "Malware payload (NominatusStorm)", "value": "106448c37cacde8bb398d7bf47c35b1b", "object_relation": "md5", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460468, "uuid": "760842aa-b78b-4070-8458-00b9adfc515b", "comment": "Malware payload (NominatusStorm)", "value": "042588e2998a18cce5398093783ae6750a12a30c32bd459b65326af56c2513e5", "object_relation": "sha256", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460468, "uuid": "3f650480-3132-4571-90ea-b4f531a62c9c", "comment": "Malware payload (NominatusStorm)", "value": "eb7e622eebd55e0e529ef79eb0190c9217363e84", "object_relation": "sha1", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460468, "uuid": "28783b62-e8dd-42a2-9e88-5bd4b45fb172", "comment": "Malware payload (NominatusStorm)", "value": "925a1e75da521a454205d09464a4129fe4baddb8fef42750968a6aa7682e632aadb2179a6b6132c34aa9d6cda3827f57", "object_relation": "sha3-384", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460468, "uuid": "02306808-880b-43bf-8f4c-ff6ac317466d", "value": "T1C1640805B7D4D532D57F47364E63D3881671F9A3DC63422B30E4ABAE7D302904DA2BAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460468, "uuid": "bb5a07ee-4707-4ae9-9b26-d8c5b811a620", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460468, "uuid": "de2ce5db-2883-4383-be60-600fb9755562", "value": "6144:e98L598L598L598L598L598L598L598L598L598L598L598L598L598BEbS89TB9:lKKKKKKKKKKKKut89TsmYFZ2qrO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665460468, "uuid": "dec21434-63fd-445a-b875-1895959df698", "value": 334864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665460468, "uuid": "5b32235a-6728-4577-8223-857dab409833", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460468, "uuid": "1d8f6b2a-c502-4e80-9be8-0dde50f397e3", "value": "042588e2998a18cce5398093783ae6750a12a30c32bd459b65326af56c2513e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9aaf61d-4977-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665501462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665501462, "uuid": "eda20728-83e5-4568-a2d8-c5c0b7e4d722", "comment": "Malware payload", "value": "518334bb1360234dc84583647ebc28db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665501462, "uuid": "b2ceaf2c-4be4-4371-9bf4-f2daa8de2984", "comment": "Malware payload", "value": "047496be5a07169490211f7fca1b96717c702a48a43ae7de27770920a342ef43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665501462, "uuid": "69356a6e-b3cc-45d0-b575-6bb217733e71", "comment": "Malware payload", "value": "1cdeed11c6306f444a114a9ff7caefbf03a4b93e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665501462, "uuid": "4f312563-084b-4e8d-86fa-bf379e6cec42", "comment": "Malware payload", "value": "90902f3fa3605c0e1cde471b745b199dd7d78164a3d28e61c2c4bc270e38d0a99a2696cdf19b6c4bbe5b88a34295a6df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665501462, "uuid": "de313027-95f0-44ab-a793-63ce2bd16f23", "value": "T15C76332939E846FED2E20336EA9C3DF8B9D6C250CB178A7712C98D5B5F68504C637907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665501462, "uuid": "61af4728-d108-4aeb-a907-bee49938bf40", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665501462, "uuid": "f0ab3551-7cf5-4d7e-a78a-1943993220a5", "value": "196608:91OypQjPd5b1srGzrEGsp9q+5GDEo99yaynhChaDH6k5bDDcAkZO+3Q:3OyujPjpLdXDP9FynhChORzklA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665501462, "uuid": "00aa590a-80c9-4f8a-b7b2-314f211e9454", "value": 7612700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665501462, "uuid": "47319601-49c0-4fa0-89f1-b72377b613d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665501462, "uuid": "c2618919-0ca9-44b8-8fca-20f553d40bd6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d42539c-495a-11ed-9266-42010a9c0072", "comment": "Malware payload (NominatusStorm)", "timestamp": 1665488905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665488905, "uuid": "6522457c-fc5c-4094-8a19-f48afc0fd6e4", "comment": "Malware payload (NominatusStorm)", "value": "8e9fed45aae82eac888c2cc1aaa6080d", "object_relation": "md5", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665488905, "uuid": "2f93117d-0b50-4335-a25d-54ff0b2a49ad", "comment": "Malware payload (NominatusStorm)", "value": "049e72484e8383225c284924a488494b76378cd66c0d8342a3da905a4f11919f", "object_relation": "sha256", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665488905, "uuid": "f282aa3f-d320-48a2-be9d-cca52ac87b01", "comment": "Malware payload (NominatusStorm)", "value": "85fa768a7b712579fbeb0b8500812eb9197c3347", "object_relation": "sha1", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665488905, "uuid": "5d8a2370-c052-4b95-968f-41fa7bc15ee0", "comment": "Malware payload (NominatusStorm)", "value": "54b7354d0cf72014ab12096926940663b546fb9fc2558c4f36a6030cc9513ebdd0388e94f87319f2d8b700713123f4d8", "object_relation": "sha3-384", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665488905, "uuid": "8bf1cc36-2c13-48c7-978a-47b0f99d16e5", "value": "T1C176BF4277D1C076C0AF03314876D35A2272F9668F2283D77694AB2E6D76BC08E72B75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665488905, "uuid": "baf65ee1-6a7a-44ee-9edc-7715664be481", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665488905, "uuid": "d43fe837-fdb9-420c-a906-1cad128f9310", "value": "98304:NLu1g9ZGlWrfTZmHqXE9ssD/QjI+1ozfLu1TIRtUOVC:Nd9JTZksaJ+1orTRty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665488905, "uuid": "c30339b9-3250-49d4-8f4c-b4efc60a2383", "value": 7685120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665488905, "uuid": "8fb730cc-3abd-4505-ac8c-90e4caa5fa7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665488905, "uuid": "71a17d9d-7d53-430a-b1c2-bacc91744592", "value": "049e72484e8383225c284924a488494b76378cd66c0d8342a3da905a4f11919f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd7b7cb-49ad-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665524688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524688, "uuid": "250628d8-0e64-479f-a9f3-b82f3b248a8a", "comment": "Malware payload", "value": "47a4be9f3efb164ba1e5d2ff2eabb74b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524688, "uuid": "39705e83-ac59-476a-9227-65256b0550f8", "comment": "Malware payload", "value": "05c6c5db00b59cff8a2eb8f1de695734d17de02f271cc52719ae107ea618bf03", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524688, "uuid": "658b9130-34c1-4a05-8791-0c990062db16", "comment": "Malware payload", "value": "a85ce91292ab43b7e683f95cc2028f35d1cc86e1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524688, "uuid": "17ca68a7-558b-477a-8bc3-e69f353a576d", "comment": "Malware payload", "value": "572e3bfc395d2c09c0e8038a6d90c071a4935e69b41ab6f89dcd40125e08e8680ade329277969b94e7dcc3d68eb7f09b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524688, "uuid": "ce579654-c501-4ac6-a847-402167c71ee1", "value": "T11786BE4277D1C075D0AF03350876A34A2276F8668F3283DB7690AB6E6D76BC08D71B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524688, "uuid": "90418c13-4d3a-4e03-8dd4-bfb188e7b728", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524688, "uuid": "07ebc91e-c4b2-454c-9144-b51f4722f069", "value": "98304:5Lu1g9ZGlWrfTZmHqXE9ssD/QjI+1ozfLu1TIRtUOV5ZO5Z:5d9JTZksaJ+1orTRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665524688, "uuid": "6b63f30a-8838-455a-a886-034c9e2d3263", "value": 8345408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665524688, "uuid": "59ab3f8c-8dd2-494f-8c4b-9a293a88f59b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524688, "uuid": "a9094854-0164-434e-a1c3-a1cc11a63884", "value": "05c6c5db00b59cff8a2eb8f1de695734d17de02f271cc52719ae107ea618bf03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a0c07f-4929-11ed-9266-42010a9c0072", "comment": "Malware payload (Vjw0rm)", "timestamp": 1665467791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665467791, "uuid": "2fd92b58-939e-446d-af4b-d8c0f72fc805", "comment": "Malware payload (Vjw0rm)", "value": "2a363818122bb35973577b94dbe99358", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665467791, "uuid": "4b9ce60a-bad4-4a8d-8ed9-2a15051cc648", "comment": "Malware payload (Vjw0rm)", "value": "05dbfc72c94d620aa26443ae6b2e343e8458c4343400386f4bc406871f6443a1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665467791, "uuid": "5832e966-7ebb-4394-8eb5-c7bc034facc9", "comment": "Malware payload (Vjw0rm)", "value": "f02d0dd3f89bbee01ef5c7f5a59d3cbc8034a177", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665467791, "uuid": "c6dda829-386f-46b4-aeac-4dbc727c81bd", "comment": "Malware payload (Vjw0rm)", "value": "ef46529f02bbaeeb56d0802562d39ef9f97b5773d47313c8e5e5b6c74314f9bf1d0159298368832fcc1cadab717d524c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665467791, "uuid": "92e08606-a14d-4acb-b030-44f730be2467", "value": "T15B44DF008FDA9F60CF28260160F9991E9FB08B8F42E16C5E773BAC0E5B57544D85B2BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665467791, "uuid": "73766d09-c93e-4f99-a896-983591f87add", "value": "6144:GJOW9Kb52rBQuxNjX3lhUY3tt3pBcy2YeQ2r/mP:kOqNjX1J3cyC5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665467791, "uuid": "15372ce6-742b-4cc4-ac62-ad2f348fe95b", "value": 263945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665467791, "uuid": "7c775e46-bc4b-4161-9666-bc4b802e863d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665467791, "uuid": "61718fbf-6c66-441a-909f-6f259a89e2a7", "value": "Confirmation transfer Mt103AGS22-0035PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "383aa5a4-499b-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665516653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665516653, "uuid": "64736953-4018-4964-bbe9-49647e5cde53", "comment": "Malware payload", "value": "5607017cb2e83f9b13d96401ee4d9c46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665516653, "uuid": "03f2b18c-adb3-4efe-badd-8df0639c80f1", "comment": "Malware payload", "value": "05f240d4d0423beb6b858e15fe390882e7e1a9b495aed9b41cfbaf2216064798", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665516653, "uuid": "50475c7d-4add-46be-92fd-b0df8ba847a4", "comment": "Malware payload", "value": "ac5ce1d52a2280b3f72c2e506920ccebcf4ac2ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665516653, "uuid": "e12e1ce0-c103-4605-bc77-b3c165ffa5b3", "comment": "Malware payload", "value": "142b4a4e037a4a0c9725bbf17cb8a276edcfed93b69889d52274fff26d0857fb45f7d4c05840e3232ec18365f724401a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665516653, "uuid": "8294db50-6fae-4a7d-acee-0ccc3d3cbbf3", "value": "T1EB24BF2136D0C072E26266758C65C6B46BBBFC715A3457CB7BC81B6D8F312D2AE26703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665516653, "uuid": "dbf9e62f-f303-4a9e-a734-28a059369d21", "value": "e680a2b40b54e6ebf1523763588728dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665516653, "uuid": "2b6e9885-7554-4f7f-84a0-1822985b8ab7", "value": "3072:i0lv2Zm7gAafdlLlTR+wEvGsd/f1hqX0LCLifMYDh4oFmXewB3Pzp5O:7xu7vLlTkwW1hnPL4o/+//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665516653, "uuid": "34ce1cd1-8174-4772-80a7-d2c6412ad4c1", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665516653, "uuid": "3e2ec327-1b11-46a6-a620-ce90d70d08e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665516653, "uuid": "08a4d735-9f70-4929-b62d-f926c603f5af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac50c42-49ad-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665524683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524683, "uuid": "b2fdac0d-ba10-4ca0-916b-1ba19ae733f7", "comment": "Malware payload", "value": "c4b63267c2950014aca36330aa0154f1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524683, "uuid": "065d8d84-ac75-4fd2-92c9-c669c70a9992", "comment": "Malware payload", "value": "06501a902d0823967b4d04608ba8c1750ce8cfa55edf1eed664bcdb28c1a8f2b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524683, "uuid": "7b161fbb-6844-41a3-86ae-70dc5dca4f29", "comment": "Malware payload", "value": "fe5db2e685a096386c42cfc94a4a29a62dc5e763", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524683, "uuid": "1bf297e0-7e8d-4000-8433-f33c8272caf0", "comment": "Malware payload", "value": "51ade9d0c67fcd5834e09cd3bee2fd280a9c1418f6e8eebc421032c0b56764df383939a32802cbe3cdb2e931e9ddd7ff", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524683, "uuid": "9c645698-bc5e-4d0c-b2ad-041a187674cd", "value": "T19476BF4277D1C075C0AF03310876D35A6272F9668F2283D77694AB2E6D7ABC08E72B75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524683, "uuid": "3bde689f-0b28-4d60-875c-237272907249", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524683, "uuid": "a9b2acad-4ef8-4242-859a-c144e13da4d5", "value": "98304:dLu1g9ZGlWrfTZmHqXE9ssD/QjI+1ozfLu1TIRtUOVC:dd9JTZksaJ+1orTRty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665524683, "uuid": "05a251b4-5612-4e61-afca-ecc7acd0800b", "value": 7427072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665524683, "uuid": "5ee9ee2c-00fb-4175-afdf-fd7de4a9c8d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524683, "uuid": "974237c9-5ca1-401a-b5c5-b3772a6de528", "value": "06501a902d0823967b4d04608ba8c1750ce8cfa55edf1eed664bcdb28c1a8f2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27377cb8-497f-11ed-9266-42010a9c0072", "comment": "Malware payload (Quakbot)", "timestamp": 1665504598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665504598, "uuid": "d24d3af8-7a52-4616-a4e0-a67878b62cc1", "comment": "Malware payload (Quakbot)", "value": "fd9011ff1ea9bad1820e4483765b0bc1", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665504598, "uuid": "7b6809cb-a643-45ad-99b4-b872a1f9c7bb", "comment": "Malware payload (Quakbot)", "value": "07b790667222856fc6e1dab6e539b35120f4a021f1833ee03b9dc23fa9298a6f", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665504598, "uuid": "bc2ed605-6cef-4f81-b0a2-a6d642976d3f", "comment": "Malware payload (Quakbot)", "value": "809c250dd806f6aabea2acc6947e82bb28d135cc", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665504598, "uuid": "6df7294a-6f29-41a0-9560-6a9621f4acb9", "comment": "Malware payload (Quakbot)", "value": "6bff5f6a4274d9736489150be3c8b842c3ae30283351589ebcd39ca39fa01ba4d30cbc6c4332cca9154e207bbda7123d", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665504598, "uuid": "568692b0-7597-42fd-a644-46a6234379e0", "value": "T112259F23F3D00377D1261A357C3FA2E89A167D303B749A1A29ED0D0D1B359916E7A2E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665504598, "uuid": "9951063f-5496-427c-aa69-2cf87c6a3ea3", "value": "24576:ILQIpMlzMh/DXjmtjVD3cygICZwSJs6q6yZXJM5T//7Y:ILQIpMlzMh/DjMBsGb55M6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665504598, "uuid": "6e2783e1-3b1c-4599-a6a2-6a47a7254043", "value": 1030144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665504598, "uuid": "425df450-7727-4b8b-b045-c26a2e9c8c2c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665504598, "uuid": "6105620d-4d89-4a81-b45a-2f82708df2fc", "value": "RFSL#8831.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a57bbeee-4947-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1665480758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665480758, "uuid": "df3ff35c-17e0-4f10-a60a-7e2999aa08f8", "comment": "Malware payload (Smoke Loader)", "value": "6511b375a17bb33a10214f07690cfa8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665480758, "uuid": "d62a8acb-306f-4fed-bf3e-2ed6fb5593d7", "comment": "Malware payload (Smoke Loader)", "value": "07dee1cf798e82050ee27565d3e53b201ed062eb4b2addff6afcfd0b08b26cb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665480758, "uuid": "aea4f1b4-1978-44f8-991a-3759d6444cb4", "comment": "Malware payload (Smoke Loader)", "value": "0b78c3c7bf65198fe19db7f98b69a34cdc5ffd80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665480758, "uuid": "4e56dc36-5120-49fd-bbf8-2e845b2365cf", "comment": "Malware payload (Smoke Loader)", "value": "256d937d485954616e70169f00108c71e09ab53d0de3eda88550aa169f1312c9d038a50479de53c51516c8dc439d1dca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665480758, "uuid": "4a1a1d21-052a-4869-a142-a14bfc3b3d9c", "value": "T14524CE2131C1E473E66616748D65D6B47FBBBC314A799B8B3BC8032D4F316E2AE25342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665480758, "uuid": "23a50050-eee1-4e5c-b4ad-fb56b4882f99", "value": "59de72f24710a4ab3ca7e4fa2f0a3bf4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665480758, "uuid": "5c0da4ed-8ad1-461d-86ff-2ccefb05b874", "value": "3072:GMrQeBAog/s2Qy+obLjg3BfwMOpWm04lCHRFKGr3Buq0LgAMIjO:XSe2QBwLjg3BsWYlCxlBudLgDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665480758, "uuid": "a0e5bc4e-ad24-40a7-b325-1f46e8d39db1", "value": 215040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665480758, "uuid": "c1b9c440-2764-4303-be61-edd0c68a7f60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665480758, "uuid": "d06054d8-ebe8-4cc6-b7cb-6db7321eb7c2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3248f675-4901-11ed-9266-42010a9c0072", "comment": "Malware payload (PurpleFox)", "timestamp": 1665450500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665450500, "uuid": "b384cf04-044f-4f18-94cc-9b7b04088f04", "comment": "Malware payload (PurpleFox)", "value": "cdafa15de279b15558d134bc0c9aee01", "object_relation": "md5", "Tag": [ { "name": "k0kz-ru", "colour": "#964702", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665450500, "uuid": "83de2a5d-8ea2-4dd6-9886-d0b67a11f72e", "comment": "Malware payload (PurpleFox)", "value": "08537cb3114c47c65d190d12f922af4be1f7f29c9c2f2af364ac8c1d813df86c", "object_relation": "sha256", "Tag": [ { "name": "k0kz-ru", "colour": "#964702", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665450500, "uuid": "740f4b47-cd5d-43d8-90b7-12827bb12648", "comment": "Malware payload (PurpleFox)", "value": "cf97dcf2756fa93ef24035e327c0021672e90ce6", "object_relation": "sha1", "Tag": [ { "name": "k0kz-ru", "colour": "#964702", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665450500, "uuid": "dabfb5ea-19e3-4965-b3c7-224e80f0476d", "comment": "Malware payload (PurpleFox)", "value": "b532ac993b3746393490035823d4701d3e23d332d9c19bccca1880ee6e81854aa450da44880c912fb6b2dc6019dfc9ea", "object_relation": "sha3-384", "Tag": [ { "name": "k0kz-ru", "colour": "#964702", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665450500, "uuid": "493e2b38-91ab-4d1b-850f-361351d2c484", "value": "T1D9258D2076DAC536E57E05B02A2CD75E406D7EB00BB998EB63C85E6F09F09C24635F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665450500, "uuid": "97eb6ae6-0aa6-4092-9eb9-a9004b11b38e", "value": "24576:djaBqnGIQ5M6DLrVVdWG859GCHrSoUzLyaVtFUl:dj8lrXVVdWX59GUrSLzeaVtFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665450500, "uuid": "1f756e0e-632d-4b92-92a7-d8bca5e7acce", "value": 1020416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665450500, "uuid": "b16b6b35-8b1e-41b8-89aa-f607bed38871", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665450500, "uuid": "3167db47-f46c-4434-9e8d-6e553d33150f", "value": "i(5).php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4b5e709-49b8-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665529370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665529370, "uuid": "26c1b32c-aeea-4e94-8933-6626fe8cd117", "comment": "Malware payload", "value": "c0e1cbfcf0aed675725d68523b756aac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665529370, "uuid": "5b1a993d-610a-4b5b-9136-d01b66cb0815", "comment": "Malware payload", "value": "0b0b1aad8f7905b45d5bd3c0c8d3fcc6f953613464b153a197595c6da894cf78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665529370, "uuid": "975d0f0a-c105-48fd-aeca-75c66691dbce", "comment": "Malware payload", "value": "ee044c303aabf5daf25e075e0d8186020b263170", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665529370, "uuid": "00399c12-1fcc-4ef2-b555-4a2dd7f4d246", "comment": "Malware payload", "value": "d56124d754217fafba7ce81c6d9fa807d101da914b6be828078d4282f86f919357cc13668feed77f5b119c88a1389efb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665529370, "uuid": "ca0da284-76a8-4db9-8dbd-39dca465d2a3", "value": "T1D124CF2235C0C872D26266758D64CBB52BBBFC715A7546CB3BC8176D8F326D2AE24343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665529370, "uuid": "d8f8a75e-8865-4aac-b773-4c7c95e718c8", "value": "e680a2b40b54e6ebf1523763588728dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665529370, "uuid": "62f9c814-b0a3-42ab-b14b-c216431d814d", "value": "3072:h47m2/07g1W3pLTIE6DfvGsRgn2tYPB5M+HXT4sdPXNwO:m6ENULTKDzbt+6+HXksdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665529370, "uuid": "cc0ff7b5-9a7e-4991-94e5-8023d0f2809b", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665529370, "uuid": "5577e72c-4eb9-47c4-8972-6bd2674607c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665529370, "uuid": "a72752b7-1b30-4436-9e93-84f87f3a7b5e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9475cfd-49ad-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665524681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524681, "uuid": "6a5a3cd6-cf5e-410f-aa8e-8a2ec23c9157", "comment": "Malware payload", "value": "1990481f19bcd2e1f4d4421741fb2f0c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524681, "uuid": "78d65294-875c-41ec-a8e3-50c71d313eb1", "comment": "Malware payload", "value": "0b0f4c3ca809064d3c3d1ff7d0d4687d90ad07c257f532d4fe1d062356e4955e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524681, "uuid": "7b8747c5-bf81-4d86-8326-8b054c75f936", "comment": "Malware payload", "value": "975c185318c462a74a77847ad29819cc96a44ad1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524681, "uuid": "07ebbe7f-67c3-4bf1-ba63-2df1350c767f", "comment": "Malware payload", "value": "92cc3625b073f0cc69277ea9eb99bf467e8692a3723bce132d01b17fe320e14142fe606f05c576fb24dedbdd592fb061", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524681, "uuid": "ee1c9d3a-de02-4b95-9547-26902ac05daf", "value": "T1B4157C1576F0C131C4AF46340DAEB35822BAE4A2DF3246D731DC97AD6F703D04E696AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524681, "uuid": "0d425a48-c5f7-4115-90b9-0745ba2a3b56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524681, "uuid": "898fef50-da98-4273-8fe5-8b1e494e5a81", "value": "24576:lKKKKKKKKsxr4cQFTj0OZeVJxCa2Udkc9FnA:eqcQFTIOZeMaHXFnA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665524681, "uuid": "3a326090-7043-432b-86c7-727a6bd61e12", "value": 932080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665524681, "uuid": "c8c5e475-fd6c-4b13-ac58-32eb5e85a4ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524681, "uuid": "55c4015f-720f-424c-a605-2967ac2be64f", "value": "0b0f4c3ca809064d3c3d1ff7d0d4687d90ad07c257f532d4fe1d062356e4955e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4bbfeda-4926-11ed-9266-42010a9c0072", "comment": "Malware payload (Quakbot)", "timestamp": 1665466718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665466718, "uuid": "818b6e4f-42b7-4169-88e3-977502a2baab", "comment": "Malware payload (Quakbot)", "value": "af462c705a34866576206abb184c9f1b", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665466718, "uuid": "8ebd26f8-5238-41de-b30f-f4f9f07a852b", "comment": "Malware payload (Quakbot)", "value": "0b5cf1eb1d96117c55354583b5b9f03705554bfcd4ca4433a9809004ed8e7439", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665466718, "uuid": "3bf068fb-4dfd-450b-a0f1-76b9a3c523c9", "comment": "Malware payload (Quakbot)", "value": "cf68c362967b4f51957856e449cbf28e503bbc8a", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665466718, "uuid": "c726c048-e64a-45ef-9449-882b41491781", "comment": "Malware payload (Quakbot)", "value": "165da6d3a892a03a0a80031be5b3fd293314120938154831f8c7e272dce1f74a0afa4780d531ae16a5b28e2cff60d1f9", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665466718, "uuid": "52e1af23-4277-4743-b2ee-1f18b2ac491f", "value": "T111656D22AE9E8872C57B1A38AC3B5258543A7D203B34585B7BF90D0CCF36B817D5539B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665466718, "uuid": "5c5558a0-2514-43c8-b77d-a4b8d30bb1c8", "value": "12288:CYKepSeIUqeXPwyITtxGvvVeHTe7ezGNTTYmRs867u0iROkDQSpu8ahK+UfxEeEK:TLo2ftMzeaKYKu7u0i9wofxEaz32w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665466718, "uuid": "5b3e7ae2-7c46-4310-b004-92a8024bc8bd", "value": 1525760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665466718, "uuid": "70bac329-7aee-4bb3-877f-9c39830a29b4", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665466718, "uuid": "5aa8ba59-bfbb-4b83-a624-7dc5af280e79", "value": "New_documents#3949.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25fb774b-496b-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1665496006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665496006, "uuid": "1c635756-9912-46bb-9c51-d1005995b919", "comment": "Malware payload (GuLoader)", "value": "15bd7ba990de7dee70a8a935cf587951", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665496006, "uuid": "ba261a8a-4a0d-47e8-9177-ffae8aadfdea", "comment": "Malware payload (GuLoader)", "value": "0c3bffacf3e541cfdd0b5552e048c57d313252709926031f1d4672717f9beae3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665496006, "uuid": "8d7b1ea3-f691-4a70-a2dd-bf71e7769935", "comment": "Malware payload (GuLoader)", "value": "76a8fb1019b23332ccbc063bd728161a8526b77c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665496006, "uuid": "7950c01b-5d5d-420c-be30-62786c19a697", "comment": "Malware payload (GuLoader)", "value": "9588bd66f829667e5892989405924dd8a803652cfbe848c2a768382164dc87220c34c0d4efe8cc26a7f87026902ee87f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665496006, "uuid": "498aaf27-fa29-4cb1-982c-c08ea37db6ca", "value": "T1E42523B473E1C122D652D630D43A7439CEF9DE610461A49737EC7635B838AEC8E8F25A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665496006, "uuid": "d6f49dd6-bd23-4fed-abd1-77a91abccefe", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665496006, "uuid": "0d6aceff-245b-4610-9d44-4444da33869f", "value": "24576:9ib7FQchlraowtRLdNS4Z8gI3omKwep0xkMSW3+Wt6CTr:G7Fn5aT7S4ydCukMeY6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665496006, "uuid": "ae3ab05c-74a5-49a0-814a-b8f56f6d111c", "value": 991960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665496006, "uuid": "933bccca-9c34-4192-87b5-4db8df630d82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665496006, "uuid": "31a31f75-f028-4e19-9675-fb220d1af2a5", "value": "SecuriteInfo.com.HEUR.Trojan.Win32.GuLoader.gen.1736.28639", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1088e37-49ad-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665524694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524694, "uuid": "d6fbaf46-fdcb-49a8-9c56-8d0a2fa2217f", "comment": "Malware payload", "value": "580967464f817cbc58c3509c5df320e0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524694, "uuid": "f9440357-116c-4acf-a085-f5004462fe80", "comment": "Malware payload", "value": "0c79ddaaaecd5e741f0f72506035866489c0083546ec70b55d2f474cf30c946f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524694, "uuid": "d83e5f7c-1d57-4ebd-a6e5-aa8e3392ce30", "comment": "Malware payload", "value": "245cc7171d3adc098dea588f8f64a57ad6c72ebf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524694, "uuid": "aca149a6-e790-468e-9479-83a0bed3373f", "comment": "Malware payload", "value": "e6957319d69555376d9302090a642c13e68a99338e25eb04b537b6519597c8d5f3e4cb967b0fd6d0e50ce767fa36c19e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524694, "uuid": "f7bdf48a-f7a0-4c05-9e53-9080b02d26f9", "value": "T19B86BF4277D1C075C0AF03350876A35A2272F9568F2287E77690BB2E6D76BC08D72B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524694, "uuid": "aa89e29a-8ea5-4217-a8ec-594ea8a23c04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524694, "uuid": "59276ac8-cf65-41d3-942d-d56abd2935d0", "value": "98304:5Lu169ZGlWrfTZmHqXE9ssD/QjI+1ozfLu1TIRtUOV5Z:5b9JTZksaJ+1orTRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665524694, "uuid": "ec94f8df-1f98-4c45-baa4-b30f7e486047", "value": 8345408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665524694, "uuid": "82e0a279-677f-425f-9c6e-c40d0db79e68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524694, "uuid": "0f6222e8-995c-46f5-83c6-1c3a3f64f5c1", "value": "0c79ddaaaecd5e741f0f72506035866489c0083546ec70b55d2f474cf30c946f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f25f01-493c-11ed-9266-42010a9c0072", "comment": "Malware payload (NominatusStorm)", "timestamp": 1665475791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475791, "uuid": "aed02b52-74d8-4d9c-9ffe-713b153a7d1c", "comment": "Malware payload (NominatusStorm)", "value": "165237074b4a761c11c103f31b1b23e2", "object_relation": "md5", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475791, "uuid": "430f6a51-241b-47c0-b24c-790e51863086", "comment": "Malware payload (NominatusStorm)", "value": "0d31b1e37ab077227f900689cfe4265a744fb795832bedf8c9a3220427a75d4f", "object_relation": "sha256", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475791, "uuid": "57aca493-3274-4afd-9f62-3a107944be5d", "comment": "Malware payload (NominatusStorm)", "value": "754416c530dfbcbfd60228a522685aa8f5fb1ff9", "object_relation": "sha1", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475791, "uuid": "97ea4c43-8fab-4fc5-b309-a21fdedd6521", "comment": "Malware payload (NominatusStorm)", "value": "054c357a9b6a33c3202d95fc3184670a01e26cafdfd14f83d6849ba8d24eb14cd5d9e5bb2249a898b1def9461d3ec4b8", "object_relation": "sha3-384", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475791, "uuid": "970fcd37-011c-4a09-8a79-7e86fa719a24", "value": "T1948616BDE6A7DE15F42CE378040037452354F596B277C2AE324FB48DAD4EA38599A2F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475791, "uuid": "636d00f5-ad42-4a75-af0d-499c2e0d7767", "value": "98304:08wbIkZAZKq3hRyJuI/G3WMlK+vDVmgeB2Qf6bVB20LDvvD9L6LMhOEE/wDh+lG7:0f7ZlWhRyJj/kfK4VmgfQfCBHv4LMR+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665475791, "uuid": "af7c4721-54f5-49e1-a0e8-7a5aacc9ffe6", "value": 8341245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665475791, "uuid": "3b73bfc3-f125-4aad-b93c-571cad5b1763", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475791, "uuid": "c4aa0d39-9cf8-4821-a90e-fc11b1e6ce8a", "value": "0d31b1e37ab077227f900689cfe4265a744fb795832bedf8c9a3220427a75d4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b1a5358-4989-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1665509007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665509007, "uuid": "ddb5cc97-d252-453e-b96a-9fa22002d076", "comment": "Malware payload (Smoke Loader)", "value": "a048add8d5b5556abafea91d5bd1f28e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665509007, "uuid": "e070e2c4-dc4c-4e5c-b77b-4e79532ab4a2", "comment": "Malware payload (Smoke Loader)", "value": "0d667e530d241fdd59d5bc2d75f0583797a79859dd86bddd8045e578acd4ea73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665509007, "uuid": "f1bf9e43-76de-4a47-a3ca-9644a510f82d", "comment": "Malware payload (Smoke Loader)", "value": "4d7a5da2ff554f69a02c1c7aae3e59e9aef1b7b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665509007, "uuid": "88f64d05-b9eb-4c04-91f9-184c4eec3396", "comment": "Malware payload (Smoke Loader)", "value": "04efe6914be844d12f9570e355132f3f181fd963363b2d51085ad29d59447a26e0fd4524096bd38ecc2d10a688cca6c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665509007, "uuid": "e01a7631-d309-4d6b-bd32-422495172550", "value": "T1D124BF213580C072E2566A398C25D6B42BBBBCB5993583CB7FC82B5D8F352D29E34747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665509007, "uuid": "45b7ca2b-9401-41ee-a594-7d1772a87615", "value": "47f3841b8380a704a9ff258e0444ec1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665509007, "uuid": "6adfeb79-03ab-4fa2-8919-1c5ea0b36651", "value": "3072:O9dPQOZEw3+1tZLycmiWMfdt8d9zcVvbOKX2mUL83qs+Ts5Sxesr+SO:OY+3+1bLpdWMfI9AOMUL6qW5S/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665509007, "uuid": "ee9cc0b6-c66c-4970-8703-e6a81fbc4468", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665509007, "uuid": "da2e3c98-a8c6-4559-a760-09598a6045e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665509007, "uuid": "6ffbb765-bec7-4a71-ba5b-79beb4f0af05", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d5eadc-4973-11ed-9266-42010a9c0072", "comment": "Malware payload (WannaCry)", "timestamp": 1665499678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665499678, "uuid": "7d405f7e-4825-408b-878d-37b3aa7ebc6b", "comment": "Malware payload (WannaCry)", "value": "f9cbb55579d9a4ef956c6ac1b97d7dfa", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665499678, "uuid": "c47dcddb-a6c3-4aa4-b11d-833ce6bc7820", "comment": "Malware payload (WannaCry)", "value": "0e4f55561e0df3fd46e64888989da098d6b4cf0dcfad50890d4e4592c960723a", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665499678, "uuid": "28cadfa8-36a4-4edf-b70c-1c01fd9f9b46", "comment": "Malware payload (WannaCry)", "value": "0e7b8f9e3bdcbc4c2368055fa517b1d7d8514be0", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665499678, "uuid": "b9d871d8-6f61-463e-a1e5-716cd000eb0e", "comment": "Malware payload (WannaCry)", "value": "72c4894f46fcfd14e1ea073f402409d4d9558b18025147388afe31b08d75133c13ed170bb71caedd720c618f1212df0b", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665499678, "uuid": "6bc3cc25-2321-4020-8ea9-572adad97edb", "value": "T18D95BE4672E4D214F3375AB12DF9C9E95A32BDA3ED05854F35A1730F0832F61AE42B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665499678, "uuid": "bf6b6929-d933-43b3-b562-8084b5e5709b", "value": "24576:tihdmMSirYbcMNgef02GdX8kIqRYoAdNLKz662IQg6eX6SASk+RdhAdmvm:9MSPbcBVBrINR2Qo6SAARdhnvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665499678, "uuid": "ef14dc9e-655f-41e4-973a-e083f21d23a0", "value": 2061938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665499678, "uuid": "3f4efa12-f911-4001-83a0-e815c72d210b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665499678, "uuid": "4f9271f2-2044-4605-a92d-8810b9a032ae", "value": "0e4f55561e0df3fd46e64888989da098d6b4cf0dcfad50890d4e4592c960723a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91e10b8-492d-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1665469624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469624, "uuid": "2cdbca0e-8337-469d-b7aa-cddf4b718780", "comment": "Malware payload (Mirai)", "value": "3865d0f3cdd596971f8074664c3ec6c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469624, "uuid": "e6904727-a9dc-4d0f-83a9-5344e98cb6be", "comment": "Malware payload (Mirai)", "value": "0ea14f88f2488aba9bb9c92cffbd64d040fc10909d9cc1c86e2a00a031c27e4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469624, "uuid": "db395131-d0ed-42e6-a3a7-26ccab6b908a", "comment": "Malware payload (Mirai)", "value": "8023cd7fde3ea821a7ca821251505cf14d4cde7f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469624, "uuid": "2420207d-21ed-474d-b7fb-aad3d0a39d4a", "comment": "Malware payload (Mirai)", "value": "8ce94505e17c0a0063dcca564f49900826b524fe69c5679115422bf33e2246931af223d884a983fd888cab57f86be443", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469624, "uuid": "ab24b408-9d32-4d00-96cc-31ef80e8db8b", "value": "T13ED2E17012A2ADA3DFA18EB26CB7C285739716B4E3E1A714A9284178F7610854377FD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469624, "uuid": "1abb762f-acd7-41fa-a86c-59459b6d80fe", "value": "768:fzN/9IPs+XsAb8qBfAtKefb2PNgp1zYpVcpTs3UozB:fx/JssAdBfA4e6PNgmc8zB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665469624, "uuid": "cb559ef8-27fd-4498-9287-6add6a455cf2", "value": 29952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665469624, "uuid": "282dc66f-25cf-41c9-b829-858ff0018019", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469624, "uuid": "8b27b4b2-713d-4a69-bbb8-62e9c65cdc2d", "value": "3865d0f3cdd596971f8074664c3ec6c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0c25cd-4913-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665458460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665458460, "uuid": "220ca498-55b9-4895-87b7-7900055a46d1", "comment": "Malware payload", "value": "9d785abe727df947844937126cfd5631", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665458460, "uuid": "e8e930b2-79d7-41f2-85a5-171e62a40420", "comment": "Malware payload", "value": "0f3f34d13ed37510d5a032383bd5a07521248918fb4d97403bf1c51bb5c996f9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665458460, "uuid": "70f99800-6320-4521-a90a-e2dffb9ac36b", "comment": "Malware payload", "value": "6d9909c95db86e4255b57247caff0398398d38c9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665458460, "uuid": "d0a3467b-1065-4ff6-bb95-2c5e76bb16b2", "comment": "Malware payload", "value": "ad5f65b499ea28cd8f5ef30e1ea9cafd81858e0211f2a224430fb96d120b1a84fd42b98c1ac92621d8a60d0826fdc36b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665458460, "uuid": "64a8884d-d455-4aa3-9006-20f6eb21feaf", "value": "T1F387338C62529B9CC21450117E9F0D94ABD7274FD8530D7DA9B0FA26DE070C6B72BCEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665458460, "uuid": "119bbb97-fe80-4726-acbe-1e810bac2dd4", "value": "786432:ZPsu/s2c3y2ouIKMhTA/O5JsUt/bzvVMPMcwByUKmw0qVm1DV:Zkgn/8Mhd5mUBzvV/Byuwxor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665458460, "uuid": "4006c4d9-2bdc-4f84-9da6-a34387d06fe7", "value": 36393565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665458460, "uuid": "6e53884d-9a26-47ee-a126-87cea7a35e25", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665458460, "uuid": "d8066e97-12c0-47e9-bb10-fed23bd6cc02", "value": "EveInstaller.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb299d91-4944-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665479613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665479613, "uuid": "073cfc4e-149a-4db8-9788-70c506bb9aa4", "comment": "Malware payload (SnakeKeylogger)", "value": "01f57fe3e3d3c5e8bdbd1969c0122a9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665479613, "uuid": "8374dea7-2f91-4303-94f9-72dc26fd3d60", "comment": "Malware payload (SnakeKeylogger)", "value": "0f59a49a96bb1e93a00093b5b6a39f7a7df748e1c439b7cdd6d62e4c9b5f30d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665479613, "uuid": "fba226e2-9457-4e53-a80a-ec470d60d0a8", "comment": "Malware payload (SnakeKeylogger)", "value": "d4d6b5c237bcb3ba370d2c73530574a5c40d653b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665479613, "uuid": "2e4f4972-4b8a-4d34-b4d4-8b55baf9db72", "comment": "Malware payload (SnakeKeylogger)", "value": "b2566074b979a970b45a7e2756c910ba1bcc1f313ee98dbcb64c87b6a8a022508e1b2c0684796aca094657df5986ddc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665479613, "uuid": "7913646d-190e-498b-9f43-bcb171fe6ae2", "value": "T16F255B7E26964907D8153235C483D1F32AFBAD506062D2CB6AD72F2FBC512FF951238A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665479613, "uuid": "af743df1-957d-4517-aa3f-19546b641818", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665479613, "uuid": "31900b9f-b4b6-4439-bc79-83eec423a3a1", "value": "12288:gosUsDfYLqC3arE4fUXq1QYuyrTmpRtVdfrItNmTQajJ1P9RAQSQy4AJ:goZeC3arEYYrsiVdfUKQ27AtQy4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665479613, "uuid": "c38bf2c9-5c6c-4850-8a24-ebfeaee409f2", "value": 1009152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665479613, "uuid": "f7fd74b8-e9c3-4c87-8402-22fae133e0ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665479613, "uuid": "78d74cdf-5484-4b14-8114-c3e94475f906", "value": "swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15bfb25d-4907-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1665453029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665453029, "uuid": "783ddabc-af93-4142-b4ae-241f995e7ebc", "comment": "Malware payload (Mirai)", "value": "9e0bc43717f823e5d68202cb19d754d4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665453029, "uuid": "77240c64-8923-4a9a-ab92-598ccf82b4a0", "comment": "Malware payload (Mirai)", "value": "0f909c04132d09eaeb3f36329537136bc6aabf9c22fe95fc61069d7588d6de72", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665453029, "uuid": "2994f73e-6da7-424a-8ac4-6b2799512160", "comment": "Malware payload (Mirai)", "value": "4a65a75d7f7b231730ec73ab9515a1bcb78213be", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665453029, "uuid": "547e357d-199f-45e5-86c6-1aee8d8c0672", "comment": "Malware payload (Mirai)", "value": "4ecb71842155523f3e2d38841c0ceb5dfc6f15bb2c923e543907a97a775b4dac93811ac38c92d4cb883244357c2ffe3f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665453029, "uuid": "fff6eaf6-57b5-426b-955c-0de11de60fe4", "value": "T1E783A51E7E228FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665453029, "uuid": "080ce567-759d-4568-8cbb-187ae28cfd22", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/de2YIwHKRH0I84EH6UTPR7ZDYovZ73x/nL8y8d:Rakdn2Eo3ePu5GTPRRYo99Be037Wb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665453029, "uuid": "00bcd89b-1ea8-454d-b6ac-5311a76afffc", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665453029, "uuid": "855a6a54-3ef7-498f-b75f-c191a86a2a53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665453029, "uuid": "dc6c6152-a4ee-45ff-81d7-0c4d4cfc4e8a", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a0f14f-49a9-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665522765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665522765, "uuid": "30a84f9f-5b4f-4971-b9b5-54d4b9e8b78e", "comment": "Malware payload", "value": "715191229a9e3ed9b15f07bc1daa4a24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665522765, "uuid": "15c6dc1b-cede-4342-a457-0e1ecd21d141", "comment": "Malware payload", "value": "10643232c8cf963e62ad966659c9e049955f7bab9d63d42f58c7b6bb961b2826", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665522765, "uuid": "b63712b1-b717-4bbf-b7f1-786d94135526", "comment": "Malware payload", "value": "29c9c0dcdee28c0a022e70485d47990530468c26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665522765, "uuid": "b84792a5-0f2e-4559-bd96-35cc5b697adc", "comment": "Malware payload", "value": "d40652aa06c2aa3808e9d1118f370029dd481f03376684842dc9a712ce700edb9d15efff721ae9717853800608167ace", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665522765, "uuid": "fb0fa132-7b9c-4749-ba0d-242e59a91525", "value": "T1A624CE1235D0C432E2122A358C64D6B56BBBBC755A7557CB7BC82B6D8F322E29E31343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665522765, "uuid": "bf254c32-c83e-4d2d-bc60-e38913a3a880", "value": "e680a2b40b54e6ebf1523763588728dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665522765, "uuid": "4e211685-220b-4754-8cca-0dae0f3811ac", "value": "3072:Z+vZO2yA7gr9ngLtDjKL9hvGsM/+7A4E38lgK/qAPb6qD4KodO:AxORNgLtDeL9UB8lgK/qjld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665522765, "uuid": "5a4cfdf5-f63b-4e68-a139-1869da9c098d", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665522765, "uuid": "d4568794-55d8-4951-9777-d0674e695d7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665522765, "uuid": "23b95fc4-0e1c-484b-8101-07f98294d4dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c394b62e-4918-11ed-9266-42010a9c0072", "comment": "Malware payload (NominatusStorm)", "timestamp": 1665460622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460622, "uuid": "4f6837e4-6d6f-4539-be61-de2a9dc6f220", "comment": "Malware payload (NominatusStorm)", "value": "e4e2193b052e62d43c9d8a86cede4b13", "object_relation": "md5", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460622, "uuid": "402c0f67-3991-4257-8002-0576e1cff7ef", "comment": "Malware payload (NominatusStorm)", "value": "10703ca7a24cb5a8a9bab2d287415e09a6cfb0e95ad667b163b1bfab47323205", "object_relation": "sha256", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460622, "uuid": "02bc099c-6e4c-404d-acb0-77e67a33e47b", "comment": "Malware payload (NominatusStorm)", "value": "714daa1518d883d028a279876979c1f9f7805a69", "object_relation": "sha1", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460622, "uuid": "8722e7f2-74f1-475a-b1e0-321cafa3a0c5", "comment": "Malware payload (NominatusStorm)", "value": "cab412c63bbd064da499942740dc0feb1708faa4b35c806127eec53ab9456c68f7819eed543f2dd70713da7cb12ffd9a", "object_relation": "sha3-384", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460622, "uuid": "1c88f5b0-0e95-4f5f-b569-d7f4430d7c8f", "value": "T1C984F704B7D4D532D5BF473A4E63D3881671F993DC63462B30E4AB6E7E302904D92BAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460622, "uuid": "68836a86-7278-4e44-b90f-ced4beba3715", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460622, "uuid": "64575153-5762-4829-94cc-e1da5befec82", "value": "6144:e98L598L598L598L598L598L598L598L598L598L598L598L598L598L598L598o:lKKKKKKKKKKKKKKKKut89TsmYFZ2qrO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665460622, "uuid": "28d0b540-691d-4df3-81a3-8fd489f038ca", "value": 377872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665460622, "uuid": "b2b3272b-af4b-49a6-82ef-21eb4d61f415", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460622, "uuid": "6688811d-208b-49a8-b3ac-4ccb5730816e", "value": "10703ca7a24cb5a8a9bab2d287415e09a6cfb0e95ad667b163b1bfab47323205", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "969271a5-4937-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1665473861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473861, "uuid": "c345a870-4819-4a81-a91d-2f099f96dc53", "comment": "Malware payload (AgentTesla)", "value": "881e1b7757907d446868078f5849018b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473861, "uuid": "1cad1b20-b1d6-4329-8e7e-5d398cb0c842", "comment": "Malware payload (AgentTesla)", "value": "10feb25768b9e2e6d506b75dcf7ddb9df41cfb45a59c688717e3877f88138a86", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473861, "uuid": "9e929eae-06bd-46dd-ab75-eb813b3b35e1", "comment": "Malware payload (AgentTesla)", "value": "807e409c23916ed053514888c2d0a55d7749fce8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473861, "uuid": "9a36339e-ead3-4c73-8647-1c31d18f37ca", "comment": "Malware payload (AgentTesla)", "value": "ee8ba0e82576641bab65657386b5df8d948f8bd275de548d7a6586c3b6027f57fc4d9d44696467b7d82df07ffd756a1a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473861, "uuid": "23d67356-fca8-4566-ade7-1b36621485b1", "value": "T1F515191835E6719DF477CAB59FD8BCFA995AF672131F61B7206303898B2AD42CE80071", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473861, "uuid": "c1f9d759-0de5-4b0b-ade6-a63d0cb1501f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473861, "uuid": "7ea7ec18-0b1d-4b34-a707-1d413f2b426d", "value": "12288:V2iNcv3a+jlGq3swJtPfPYiSCNFmj2mZADqjJ5n51lhvxYyKcdFB1iXEQum6Mj3N:V1mv3aWlHs8nYvCN8j2mpjrb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665473861, "uuid": "f2858dfe-294a-4a6d-b1c0-91b5a4c00746", "value": 939008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665473861, "uuid": "46aaa76d-30c6-4283-86e6-d21b59fe5169", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473861, "uuid": "5fc209e5-3f7f-43bc-a794-8c36f46a9b63", "value": "10feb25768b9e2e6d506b75dcf7ddb9df41cfb45a59c688717e3877f88138a86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcacb7c5-498e-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665511291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665511291, "uuid": "b7833a66-cb9a-4f16-ab48-07d5ff62404c", "comment": "Malware payload", "value": "96379f43dc1c7c37d69ac31fd1d79b2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665511291, "uuid": "4932ea29-0b77-45f1-9c98-671277b3a6d9", "comment": "Malware payload", "value": "11426ae99aad60b290b390cbb4bf029653ed2daebc565ee3f60f048cf9109065", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665511291, "uuid": "9b398d79-370f-45c5-8884-cd0aa265fbeb", "comment": "Malware payload", "value": "2b0c120a5fc97aa90e22695644d907c3e2883b39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665511291, "uuid": "b08e9acc-0f44-4c5a-83b9-0e1bf58e19c8", "comment": "Malware payload", "value": "7b2cc4234b99c5b341a447b4ba33a8318c2bd3dcadb62c3b8556998c31cad050627863e17d386647725a692155e652e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665511291, "uuid": "3383c248-b4bb-4c72-9de5-1198efe11a7f", "value": "T18E76332E3AD6CFF9C3D010F39A7D1FD6A2A1C74A0935285B3A83492C5C3F4467266D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665511291, "uuid": "32f789b4-ac56-4d58-858a-5fdb135f6e6a", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665511291, "uuid": "2e3cfaad-3cbf-4eaa-a864-bd8e0877b13f", "value": "196608:91Or9m0Z1uRIfAjjb2xpsPM3vGnQLvTEOmlv0wry:3Or9mAuRCAjf2xpGMYl3ry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665511291, "uuid": "329fe929-be5f-42d0-9d26-b37751e7ded9", "value": 7591253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665511291, "uuid": "5f72ac7a-659b-469e-95bd-42f18fc578d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665511291, "uuid": "46830689-e1bc-463b-a68f-e8555150f5d5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35823abb-4936-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1665473269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473269, "uuid": "af50a352-cd55-4ad3-8a83-b8dd278ccb9f", "comment": "Malware payload (AgentTesla)", "value": "847bb89b015522ae5155db08d71b5820", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473269, "uuid": "e7de9209-904d-4b78-a0e6-ba4e766c72e8", "comment": "Malware payload (AgentTesla)", "value": "119883273d91bda01dd5c97c39ad030ea797af5362e2602df3faff1f177011ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473269, "uuid": "bb64a4c4-e235-4eeb-aa6a-2b0df0b08a32", "comment": "Malware payload (AgentTesla)", "value": "c722f702d38533aee93442347c45040ffa66bdfc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473269, "uuid": "5cb30ffc-b240-435b-875d-25f7a86fb9e7", "comment": "Malware payload (AgentTesla)", "value": "a2ee238a0c9a995bea074b4d54c597cf30cb87bcb3e2f50a56dffe3ca7c4b81e97ae139790b268961b8b8733861a0548", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473269, "uuid": "8f703661-b4eb-44bd-9d0d-6916de710332", "value": "T11E15191835E6719DF4B7CAB58FD8BCFA995AF672132F61B7106303898B1AD46CE80071", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473269, "uuid": "f26fe352-0e76-4634-b690-aa7bc12ed42c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473269, "uuid": "b17d0947-7d97-4023-b992-a273b4ab9870", "value": "12288:X2iNDAA/09Xc0wBTOMqBa34q5Kzxp6qjJ5nQ9EYhDqGBsg92R+DWlWkFwJx:X1sWBTNqgBKd3jr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665473269, "uuid": "714f6dec-37ad-41e5-9cad-3c2a3683458f", "value": 911872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665473269, "uuid": "ab486591-404a-4a34-9134-e45a652503b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473269, "uuid": "b6251624-6496-4f5f-9b5b-3c6383ac568c", "value": "119883273d91bda01dd5c97c39ad030ea797af5362e2602df3faff1f177011ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f07e4f8-4928-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1665467379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665467379, "uuid": "9bfa6841-efc3-47f4-83ea-53523ab36abb", "comment": "Malware payload (ArkeiStealer)", "value": "65098ca099cf2871ace5c4439c14e86d", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665467379, "uuid": "2d19489d-f8a2-4de8-b9d4-a5952211a0ae", "comment": "Malware payload (ArkeiStealer)", "value": "11f9829d6e35d28cdd44e66a30bf6db39d5cbcae88a3743ba4555b89c805b4a4", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665467379, "uuid": "f5e002d5-0100-434d-b7fc-d4fff765ad69", "comment": "Malware payload (ArkeiStealer)", "value": "409dd3cf84a2b799c9a2ef90ce8b1daa25bf8fbf", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665467379, "uuid": "7e8383bc-92c9-483a-838e-25b6bd91b7a7", "comment": "Malware payload (ArkeiStealer)", "value": "2993d33c217c1ae39a112fc5db8b6b5ae6831150dfc59914ac3ce897cbc6fd5fd31cd6a16c78ce48b3364402dc0aacf6", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665467379, "uuid": "5ce87270-8d1a-4917-b7b5-9bee3787a360", "value": "T17D55B09D99E6426FC3D25CF46E8EC336EC9A931E77852B29C153B339307814E530962E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665467379, "uuid": "618e90d2-fa7f-4032-9278-e5c89cd2d7c6", "value": "c2222fe6c657d2654ea89abb77378b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665467379, "uuid": "60c969b5-6e95-4f5a-857c-753d8e715769", "value": "24576:JUBwmwMTA+Ya1NuDOvpPkdbBB4bJD4OL3LVocDzO5WxjuaqhKong9uYoaEvW8J+y:JUBwmwMTA+YGuDOhkdNBG94OLpocXZvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665467379, "uuid": "9995bf9e-e8a9-471b-a3da-2e1af234a7ea", "value": 1314816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665467379, "uuid": "db88db18-158c-4082-adb2-0d8f1cf54781", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665467379, "uuid": "fabcd139-4604-4fa2-9b32-10e346622d5f", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.23224.19144.23245", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2bce176-49ad-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665524696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524696, "uuid": "361db56c-1d31-49d8-8335-91accbb8248f", "comment": "Malware payload", "value": "91934d3ca7a2392c77d206935276ecf4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524696, "uuid": "d5e103f4-66b7-4cc1-9e0b-9f67dfa84c92", "comment": "Malware payload", "value": "12177c66a130317d9332a51dc59d1c2a51704b21933892e08f5dfe781778a879", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524696, "uuid": "d939bae8-817a-44a0-824c-2182869987b6", "comment": "Malware payload", "value": "a44bf9884e0e6f34bcddd2e2c8698fb82ab6b607", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524696, "uuid": "7fb17257-fd00-4fc8-9022-0bb0eb01abe0", "comment": "Malware payload", "value": "a38e526554e2c56d918623c4f8ec6fdec04c422874a795a62f3300e62f788934ac8fb71406ae43cb4ee53122a7cf2fac", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524696, "uuid": "ca76f6b5-7961-446c-84df-d2fa325a18ec", "value": "T1E386BE4277D1C076D0AF03350876A34A2276F8658F3283DB7690AB6E6D76BC08D71B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524696, "uuid": "f4bf4eb2-93f1-459c-8d32-ab423ef1e204", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524696, "uuid": "eeb48fee-b6ac-42f7-9e49-8a52f2320ead", "value": "98304:OLu1g9ZGlWrfTZmHqXE9ssD/QjI+1ozfLu1TIRtUOV5ZbOV5Z:Od9JTZksaJ+1orTRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665524696, "uuid": "1babbba5-7d80-4d49-bea1-de3704755213", "value": 8345408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665524696, "uuid": "5f32d6fc-a9fd-4283-b403-1b36e73dba12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524696, "uuid": "98536926-0eb6-49f9-9305-a564877d68b7", "value": "12177c66a130317d9332a51dc59d1c2a51704b21933892e08f5dfe781778a879", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca7f0f5a-4929-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1665467935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665467935, "uuid": "01215c53-01f4-4581-a83f-8d41b4fe358c", "comment": "Malware payload (Loki)", "value": "8d38fee148302e1c12a61d4001dcf35d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665467935, "uuid": "8a028375-8a22-4fe5-9c85-ab99cddfe057", "comment": "Malware payload (Loki)", "value": "12d01aa7ac682b14782ab93ee39e2428836daede1af4da366d3df542a3ede027", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665467935, "uuid": "65ee8dd2-8624-4c94-aa33-18c1d11ef666", "comment": "Malware payload (Loki)", "value": "5e52130e3606d57e860172f70b6cd5455c434e9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665467935, "uuid": "21aa50f6-998a-44bd-90e0-289cbfbad25e", "comment": "Malware payload (Loki)", "value": "5d6bdd5976710c2861bddae9e6750c1649898c88a8ba929148c5ed33cdc7d918b825c9baa83b5dfd0ddfc5c7d6b6d58d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665467935, "uuid": "7aaa9082-20f0-4a12-8262-b7fa8a6418bb", "value": "T16F157A7E16994607E8143271C893D2F32AFBAD606021D1CB5AD72F6FBC552BF960334A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665467935, "uuid": "81fdca73-e62e-46fc-ad40-fc617704ff2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665467935, "uuid": "f3ee4fda-2629-4310-91a2-ac2fcaa9409c", "value": "12288:ifwgCuBYMf16SOsGx1aLKizzCFZp0gh6KAQSQy4AI:Ru+A60GxgOiz2p0IAtQy4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665467935, "uuid": "91e04b6f-b94a-4556-9e71-9b34b0a5f434", "value": 920576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665467935, "uuid": "ef6c5e16-ce71-47f6-8c2a-37340608f9b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665467935, "uuid": "b7c6b36f-98f3-4027-b388-71464b892f07", "value": "Urgent Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d279e929-49bb-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665530655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665530655, "uuid": "fc480f9d-4e69-4ac9-a56f-c82ff5075b1b", "comment": "Malware payload", "value": "f344c4176bdac34689f8bb72779e4a38", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665530655, "uuid": "8ac0c689-e167-45d9-93cb-3ad8420d7a29", "comment": "Malware payload", "value": "13522cad7c629cc86acfa32563cda6e29ecb459f1e89f0d9d8c6d837d6287f64", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665530655, "uuid": "8d03cda0-0d18-4cb5-91ae-b310162495ed", "comment": "Malware payload", "value": "2bf5282e8caff58f2e65cdaf8fb47c3ec50abe1b", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665530655, "uuid": "d08386f3-55ea-4e3b-bb05-52f0b1cf7b18", "comment": "Malware payload", "value": "327150c805278d592545ba2f73650ae62efbf2761088d64703a85d916f863a81ec5ee433206e23548a73d92aa5ba2d78", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665530655, "uuid": "4c7fa6b9-1f4a-41ae-81b7-cf84b9fbf7d4", "value": "T1BA25025F4D63E4A44EAC967DBEBF09783207A4E8A19C10D99F85F0E2B7C182E451F58C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665530655, "uuid": "910e9c22-9f0d-4e05-981f-0c2bc7a4bec8", "value": "24576:x4lo+EuubVQW8oNHg7Td4i3FLQpyGcBljSiD8:ChWrAqi3Jb3bw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665530655, "uuid": "60e3b27b-2342-40bd-b2ef-6558942d5c1c", "value": 974891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665530655, "uuid": "d81b9a84-e007-4078-8f4f-828708ef6d99", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665530655, "uuid": "239df24a-77c7-4420-ba39-a53ef6243c87", "value": "RFSL_2892.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7483a4b-497c-11ed-9266-42010a9c0072", "comment": "Malware payload (NominatusStorm)", "timestamp": 1665503524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665503524, "uuid": "4974d8d8-225d-472c-a49d-ead3ca6187c3", "comment": "Malware payload (NominatusStorm)", "value": "802ba5f6817ec4339a24a669be403805", "object_relation": "md5", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665503524, "uuid": "1182967a-48af-4e37-a32c-f99b16a21500", "comment": "Malware payload (NominatusStorm)", "value": "13747a902076f55d5e6ca8ad6130fe1de9cafb9546e52e8a0779b169e88e5226", "object_relation": "sha256", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665503524, "uuid": "d4b9f92f-8f42-476f-94fa-d48325c88f34", "comment": "Malware payload (NominatusStorm)", "value": "a3bc146d4ebb1a04e489870c5b2e55f3a5c8462d", "object_relation": "sha1", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665503524, "uuid": "c94001c2-cb4a-4095-93fa-fe29d7d4e2a8", "comment": "Malware payload (NominatusStorm)", "value": "2689e45e68b60fc2b0f338f226df7542d894a1232ea1d4eab24a26a65830b99d9c1f2c7305fa875bc9dd9009a237d2ca", "object_relation": "sha3-384", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665503524, "uuid": "22ef423b-4bc5-4042-b6be-bdcba279a4c2", "value": "T19796AE913BDBC129C85FD330406B468F7270B7616E24937B619067AE6E7AF88843D7E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665503524, "uuid": "5d98e301-7168-40fd-b83f-3b2d8fdd0e92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665503524, "uuid": "a9702649-a38d-40e2-9885-98fc7fb4bc91", "value": "49152:hjLuSh3i+FtvkMzT+TIRl6ftjnWbLrxU0Wq83hgKoaXkrYXU3+D2:pLu1TIRlClurxUTkCOS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665503524, "uuid": "3c25d953-21c0-4ed7-9e18-bc31328ee498", "value": 8972800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665503524, "uuid": "97d023cf-a3a6-41c4-a667-4610040753fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665503524, "uuid": "e0dc366c-d969-467e-beb9-ba9082b13021", "value": "13747a902076f55d5e6ca8ad6130fe1de9cafb9546e52e8a0779b169e88e5226", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd02c86-498a-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1665509468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665509468, "uuid": "8dd4760d-d19a-4e56-ae46-6f69b019a9eb", "comment": "Malware payload (ArkeiStealer)", "value": "9a619b78715b784ed801ee162514cd30", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665509468, "uuid": "0cf1d705-1599-436f-8ce2-0d2b9b71f42a", "comment": "Malware payload (ArkeiStealer)", "value": "137f888429094a1dece66c656564cde7d4f60f7b132c8105c6eaaecd95f3f9d9", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665509468, "uuid": "31a7e0c5-323d-4c92-80f1-f765ff1fa37a", "comment": "Malware payload (ArkeiStealer)", "value": "523f138c7b0847ec3668ebeb63d7ac89f1505692", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665509468, "uuid": "1a62b4ec-c86e-465a-a690-89d4699ee4c9", "comment": "Malware payload (ArkeiStealer)", "value": "6eb40bb7dab973b26b5067e6f84eb7d9439b9056b1d8b84552c43b80938f036c170daf3791bacf874f834f4ab43e538e", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665509468, "uuid": "f43c9c08-d7c0-448b-867f-e48478003589", "value": "T199662357EB080494F8278A39A437BEA567B77D2FC678A67874DD35C20E3326140279CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665509468, "uuid": "500e972a-8192-4cf4-8865-c62664bf5845", "value": "dafdbbc6109353a89cfda1e51dd5d507", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665509468, "uuid": "491d4238-aa54-4d07-9cf4-faf774e9b900", "value": "98304:79EhXldOyxZapIzPj2EtsQHOPgrs772BB4TmRaXv/1os7tVX946DeFm5I:70xgqbjPTHYyWmRaX+s7tM6Um2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665509468, "uuid": "ccb74228-5e53-44b7-bd67-7769a757debc", "value": 6921728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665509468, "uuid": "44b758c2-7db3-46e6-ab17-d908d25f4cae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665509468, "uuid": "d7aa8e4d-3aa0-4de6-acdf-e442e0c1ca70", "value": "9a619b78715b784ed801ee162514cd30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a058f42b-495f-11ed-9266-42010a9c0072", "comment": "Malware payload (AZORult)", "timestamp": 1665491057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491057, "uuid": "766ef69d-adb3-4cae-af87-e8242d7abbaa", "comment": "Malware payload (AZORult)", "value": "bad0a635362212165c4a2bb3b5dbada7", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491057, "uuid": "6ae65db1-b546-4da0-b914-558e102914fd", "comment": "Malware payload (AZORult)", "value": "13a99aead7aa0095e3c38b173a284df6fb1fd5960268954373eb3e7b474a96cb", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491057, "uuid": "6c0ce087-3934-4009-8fbd-3285ecb907d2", "comment": "Malware payload (AZORult)", "value": "15c7ccf8d93bfa05e3d84423b9b0c95861e7cc1e", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491057, "uuid": "543a427b-fe1f-4f4e-b8c1-5d13734ce46f", "comment": "Malware payload (AZORult)", "value": "26469d796766824e61f0cb839d37dffbb5d3e50a4b24c17dad739ce517b2dec9f6ef6ebe41ae00d33f71cf34deadc6d0", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491057, "uuid": "92aa8f05-6b78-4579-96f4-4d02844cf218", "value": "T176637E42C6D10417D9669AB3B0D38AC31BB0B20E5DD04AE794DCB11A0FCF39A759BADD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491057, "uuid": "a6cbbe85-380c-414a-a216-f2dae860b747", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491057, "uuid": "b044bfce-1a88-4a34-8104-6bb91b96567b", "value": "1536:BgiEnjdYpga/eHUTQQQQQQQBdBgN6b5/2kWSC6WLrnjDvas:BgiQdYpga/eHUTQQQQQQkdBft/2YWLrz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665491057, "uuid": "9affa23c-91e9-415d-9e08-d5f89b8dd5d7", "value": 66912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665491057, "uuid": "3982cce9-cb9c-4c5d-bd4b-2b5e19bb9d51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491057, "uuid": "0523e730-8fca-4f3f-97aa-3c740d9731ae", "value": "SecuriteInfo.com.Trojan.DownloaderNET.346.9855.18588", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81657a57-492a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665468242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665468242, "uuid": "a91ac01d-ed40-4c27-a32c-67b600715040", "comment": "Malware payload", "value": "77af06ba1897cf58b6ac1f4ce74353ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665468242, "uuid": "d57781fc-0136-443f-a801-23255394c583", "comment": "Malware payload", "value": "14255ecb85795e25718fd20d4e2ce7bc9d3f8182f87cc88345619775e706b33b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665468242, "uuid": "d4158b6b-3c05-4fa7-8f2a-0c3f8475ecd0", "comment": "Malware payload", "value": "067f80eb7ab67c1b87ae33526bdb210d37cb5464", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665468242, "uuid": "4fbafe8f-4563-48b0-95f1-85d1421e4724", "comment": "Malware payload", "value": "cf24a9dfb08fe4798e3c4df033a6066fd80fa7a5c8fc6f57b92a43cb3a922e067324d8f485298579bf232548b018f5c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665468242, "uuid": "95c270a6-17a5-434b-82bb-1c56549248ee", "value": "T1917633103DFCCCB9DB1A057255317F8EB0E9CA641C62549BABC40A3C1F9E266513BAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665468242, "uuid": "f15d76b4-1e36-4c02-b463-9ceb6fa20bf5", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665468242, "uuid": "7dfffc9e-497a-4d5e-a9a3-11b7c938937f", "value": "98304:91O9sh3vahnabNw8uNLoOJVHufqENK9RsNqT7ej9394e/JOpeTz3viui07:91O9rJwNw0OzdUh3WYJ+arri07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665468242, "uuid": "c6b30886-30b9-4c7b-bc4d-4794d55be538", "value": 7599037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665468242, "uuid": "61e71ed8-8450-4d17-ab3c-9ebed139a068", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665468242, "uuid": "782022a7-bf3a-4601-8d21-2aba65b5e3d5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aefcc0bf-494d-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1665483351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483351, "uuid": "a872c2d5-6faf-44c6-854c-7ec0231ec26f", "comment": "Malware payload (RedLineStealer)", "value": "0521ea0a349a027801b8bf826040bf1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483351, "uuid": "b8da9907-764c-4ffa-9998-f76d8ca6a112", "comment": "Malware payload (RedLineStealer)", "value": "150679b749b0d282ba59f713c660d0c72d4a46014dca4d52c892b98bd95ccc60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483351, "uuid": "d264485a-5b90-4445-908e-9cf30c680e53", "comment": "Malware payload (RedLineStealer)", "value": "ee1da52ced62b04fa3f8a3b5e78f92273c5bd954", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483351, "uuid": "77ecce5a-ef71-40a0-b489-e462507781eb", "comment": "Malware payload (RedLineStealer)", "value": "310e18bfad0d8a87c686edddbc310d2e212c0335558a1ffc21eace9669324e89835a6f58d910ec2dc78285d45ec55dc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483351, "uuid": "fbc017e4-7820-47ff-97d2-63de352ac222", "value": "T1D2932A2563DD4A78EEBD4B756CB341684BB0A54E2402EB8F4EC4B4D91E62FC067076E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483351, "uuid": "dd0e9cf1-5da4-4e0b-afaf-2bb736150475", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483351, "uuid": "2738fd92-1504-4a6d-bcde-4db93810152a", "value": "1536:8pJwVjENWKRhpEsTRbv9MZVmjQ+wwSbr+bfXK/32beXMQR5vGlJ:oJCGpEstbVqPavK/32beXPR5vG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665483351, "uuid": "0e6a1844-b3bb-4cc4-9242-0fcb28afc768", "value": 91648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665483351, "uuid": "de39f7f9-1b89-4ea8-a2fd-eba32c1b8785", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483351, "uuid": "3b9a176c-d018-4b73-a126-2512c7c9faa0", "value": "0521ea0a349a027801b8bf826040bf1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "393dc502-493c-11ed-9266-42010a9c0072", "comment": "Malware payload (Chaos)", "timestamp": 1665475852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475852, "uuid": "d4173a49-4416-4ba6-91fb-4799d11c4505", "comment": "Malware payload (Chaos)", "value": "6b81c17ac28e78c893d59ab45027963d", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475852, "uuid": "cb84508a-9925-4b2f-8829-a721fd688f9d", "comment": "Malware payload (Chaos)", "value": "1555f7b2c8d4b88bca54e80a00cd53e5667da14fee000d01d3b883a93cb2f3e6", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475852, "uuid": "00ee2a8b-75b3-4e08-95a1-203f74252744", "comment": "Malware payload (Chaos)", "value": "e0c90a5aaf896ee390249f1b4ecf696d0d8c589d", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475852, "uuid": "d8dc6b12-bcff-45bc-b379-3488e5ad80dc", "comment": "Malware payload (Chaos)", "value": "74707856856b640863187dc89a161e51f367720667c47cd38f8b18b862826a9f0d02b321f53066a44202ab01f3e2a82d", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475852, "uuid": "8f5149eb-b254-4174-8078-43a9db70c580", "value": "T1F7B2629A67BB4D35F2FE2E3C587061507779FE22DC3AC62C198C0849082DF589990BF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475852, "uuid": "17302eb1-22c9-4242-af66-dccdc8d42b26", "value": "384:W+i38irRcC4nUFqLIYWOfV6Djj4EhhJJr91ClqbJwtv:W+08irWNW4wjjbhPJr9Yqbgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665475852, "uuid": "bbe2dd7d-7f70-46c2-b8ad-175a09c0ddf4", "value": 23549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665475852, "uuid": "1ceac516-bff1-441f-926e-6607af256440", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475852, "uuid": "7bfda54f-1762-4e4f-9a5f-93c574b28c8e", "value": "1555f7b2c8d4b88bca54e80a00cd53e5667da14fee000d01d3b883a93cb2f3e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cae45bf-4901-11ed-9266-42010a9c0072", "comment": "Malware payload (PurpleFox)", "timestamp": 1665450491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665450491, "uuid": "d740828a-c31a-45d1-a62d-8a845befede9", "comment": "Malware payload (PurpleFox)", "value": "83a4c070668c9c930b44ae68e48dacfd", "object_relation": "md5", "Tag": [ { "name": "k0kz-ru", "colour": "#964702", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665450491, "uuid": "37fe23ad-051e-4ff7-806f-39eb28b40f7e", "comment": "Malware payload (PurpleFox)", "value": "1585c4c34a86b13dacc3fbadb95c5c2065ccfa4084b66f10b3da6b5fb11e9ce0", "object_relation": "sha256", "Tag": [ { "name": "k0kz-ru", "colour": "#964702", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665450491, "uuid": "ac396945-4125-4309-8a71-0546fa7c9d5c", "comment": "Malware payload (PurpleFox)", "value": "3abd0adf79ab01de5febd25dbcd515e13548025d", "object_relation": "sha1", "Tag": [ { "name": "k0kz-ru", "colour": "#964702", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665450491, "uuid": "b32463f2-3b27-4ea0-950c-3c6d3a70583e", "comment": "Malware payload (PurpleFox)", "value": "42ace1e1485e4793155ca74a09164c21f8441ee46506acfd0a32253d1677ffab0a9f25469ee527de0aa1efa3766fb1c2", "object_relation": "sha3-384", "Tag": [ { "name": "k0kz-ru", "colour": "#964702", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665450491, "uuid": "c2afec0e-b857-4e70-96a3-57bdefc74bef", "value": "T198A2E1A65E4A83FCD75FCC41004A2D56CFCFC10A292E68B3BAD64E4D5595C2ABCE60F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665450491, "uuid": "3d9592d8-500d-4038-b8d8-30d8043f7d8c", "value": "384:ah9l0+WqQMAI1g2K9XUwr0rxJXZUy6YUC9TUXcC5MStfQiJ8cB1tJxKF:ah99WqQjI1gF9XUI0rxJXZx6YUETUXc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665450491, "uuid": "65a5bdf5-3280-4633-b4a2-09f255a43765", "value": 21355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665450491, "uuid": "82d6cf65-38f1-410e-98eb-13ca174ae197", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665450491, "uuid": "8949502a-0d87-4215-a62e-0280898a6ef9", "value": "i(10).php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e6c38f-4958-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1665488164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665488164, "uuid": "ff0e18f6-bf95-4567-9e82-55795816dfbe", "comment": "Malware payload (RecordBreaker)", "value": "11167ab89f66c7378d64d89ae211a37f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665488164, "uuid": "70a947c5-afcd-4b62-b405-aaa2d5baa17e", "comment": "Malware payload (RecordBreaker)", "value": "15d40718c6759ba40a9655454a4a360ad91771bfc61de06d88b1df66187c5737", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665488164, "uuid": "a489f986-83f4-4513-be2e-591afc83689a", "comment": "Malware payload (RecordBreaker)", "value": "b9af346c910534eaaeec846207d7c410e5601d91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665488164, "uuid": "296aa280-c971-4a12-b91a-711804b12e1b", "comment": "Malware payload (RecordBreaker)", "value": "32c8b78f56b6212ac34654105856c57230aa3e7bbaf5a665c800f5a3646bd7c4167bb3b295f297adf50fae4d1323bdb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665488164, "uuid": "d87a8106-e134-466d-823f-0afd2becae93", "value": "T1DCC50A135A8B0D75DDD23BB461CB633AA734FD30CA3A9F7BBA08C42959532C56C1A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665488164, "uuid": "2e0b8bf5-b881-4309-9968-100cf9a539d3", "value": "aa69aa26982c04df6d44383c5ed7f778", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665488164, "uuid": "20c3682c-0261-4125-92f7-aeddf4f7563b", "value": "24576:TaTzCNbz3t8/WV70mY6YW1opFS4ModdKO5aZ6gg8W4fSKLIrl3RuQ55313u:GPebz3t8/WV7kLu6gg8W4fSKErl3I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665488164, "uuid": "c59b8514-5dd8-46e4-8a35-281bedf5a266", "value": 2628258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665488164, "uuid": "e3f3d338-af8a-4040-a4a0-45d39686bce3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665488164, "uuid": "85c15a7f-fca5-478b-96f3-bd99f4638f39", "value": "11167ab89f66c7378d64d89ae211a37f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b9470a6-4969-11ed-9266-42010a9c0072", "comment": "Malware payload (NominatusStorm)", "timestamp": 1665495210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665495210, "uuid": "0b4cbe60-033d-41d4-93fe-0e569499044a", "comment": "Malware payload (NominatusStorm)", "value": "1382fb395567057fb496d1bce466fada", "object_relation": "md5", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665495210, "uuid": "e441db34-7cd3-4355-8d28-b81365341a73", "comment": "Malware payload (NominatusStorm)", "value": "15dcdb820f0983f361f9b79bfcaf9501e40f4f1d70b622dc83fbf0129587aa34", "object_relation": "sha256", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665495210, "uuid": "d6551e9f-061b-473b-abac-3c5907526df8", "comment": "Malware payload (NominatusStorm)", "value": "5adf27154154505fb5ec0cef30c8c6e1f2d11b2a", "object_relation": "sha1", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665495210, "uuid": "665af08f-9f7b-4a70-83a4-19638aea8ed8", "comment": "Malware payload (NominatusStorm)", "value": "b306a040298a9fc34975777e5db62b12ed1b65d372cec965aa2f49fe1ebbdb6bd4fc015e5749b2dd651cea71e187a8fc", "object_relation": "sha3-384", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665495210, "uuid": "58e5d9d7-f462-4e0a-9c22-1399ccc73972", "value": "T1CA56F6B3B5A29259CD1E2AF2C97A0D0892343C67AF055FA771C8751B1DB35903AD382F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665495210, "uuid": "a8c2b0e6-e102-418a-b409-1074f64e9c31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665495210, "uuid": "a8843572-3429-4a41-856f-365dc90cd22a", "value": "49152:JjLuSh3i+FtvkMzT+3HfOGlk2Ph0fh4loTpcAqOdxnG:hLu13/Jk2Ph054eTp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665495210, "uuid": "68edfc17-b3f9-49e2-97bc-47bdac6f59f6", "value": 6235936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665495210, "uuid": "2b046c7e-fa55-43c6-bc19-afdb875d30b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665495210, "uuid": "65fc0d18-e132-4abf-b148-8bfbdca9b903", "value": "15dcdb820f0983f361f9b79bfcaf9501e40f4f1d70b622dc83fbf0129587aa34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb5dc885-495d-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665490324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665490324, "uuid": "0c368609-4658-44c0-99e8-798c051c6460", "comment": "Malware payload", "value": "4c4aa2b6006cee6ea712e3c068f6b7b1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665490324, "uuid": "ffa98430-9a06-48d0-a327-8e7b24b553e7", "comment": "Malware payload", "value": "15f3234a778137a9e22a8bf215ea5a0f37d8839657239da029513fdd92e5f87f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665490324, "uuid": "26fb312e-e46b-43c4-8070-9cb2b6840674", "comment": "Malware payload", "value": "9923af1ea6de8f0c05ec534300b3359350eda03c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665490324, "uuid": "f339e18a-9087-4841-aafb-e8835f8b208f", "comment": "Malware payload", "value": "cec8e6184712cbea1ac894ecfddbc07d72519007a4cc26b088b320c67c37efbfdc6c037b097a86a9cb88b3d427737ae4", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665490324, "uuid": "b28aa50c-7db3-433e-ab4f-71a6af5cfa6d", "value": "T1DF352A53BD085E67C57DA2B5B07BC300671069C69B0B9707054E5AFEBEB72C06ED228E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665490324, "uuid": "55ce79b6-2e59-48eb-925a-bbf35f287b35", "value": "12288:exVkKvcuuCvGQmVA5ZB5kqdEyAXkDYgETFwfn8BDG4b0f:ex+lCfb5ZwqdWu8F68Xg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665490324, "uuid": "2f673264-9086-403b-88d4-eb8a1903f2e5", "value": 1137982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665490324, "uuid": "8f9c4864-042b-4657-836e-851cb5c53911", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665490324, "uuid": "dd81215f-f930-4c9d-b1b5-f1e830bafa75", "value": "org.codeaurora.ims_ims.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e78cb431-493d-11ed-9266-42010a9c0072", "comment": "Malware payload (Icarus)", "timestamp": 1665476574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476574, "uuid": "3905212b-8100-4618-9a01-ce84ccb91168", "comment": "Malware payload (Icarus)", "value": "f88a92f8ec6576ee9375108e6d455212", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Icarus", "colour": "#24DF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476574, "uuid": "aaca9d61-1afc-453f-b6b3-b4216062de15", "comment": "Malware payload (Icarus)", "value": "16d37c2fbbb4ff4fce666b7ed61c10d693a36a87f588571bfbae62e1578290ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Icarus", "colour": "#24DF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476574, "uuid": "496573cf-4ef3-4978-8f97-20a3d524d99b", "comment": "Malware payload (Icarus)", "value": "7ada92b65fe98af00ea16546dcd0adcaa0c56979", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Icarus", "colour": "#24DF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476574, "uuid": "16ef529e-fc9b-4e82-843b-d127ceddc541", "comment": "Malware payload (Icarus)", "value": "38ab7212b748e2285c7df2708c80f4de404c7e2f1fdd23264213047de9f53f94c969de144b6347193c71e7fc4accae94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Icarus", "colour": "#24DF59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476574, "uuid": "c2ae62aa-2705-4316-a3b6-c1a1f886440c", "value": "T130E1C522E7E88776E9770E316CE363504E31F6158D269B1D68C4920F9E6230546B2FF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476574, "uuid": "ec911f01-7226-40b4-b6e1-7c849a908a1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476574, "uuid": "739a58a4-58a6-481d-8fb0-c81f2132f377", "value": "96:j72ZwyrCIDjYyuLgifLf2TG8LKLnrpD2v6uQpJiSep1sjnDxzNt:mZwy2LLg8LfcG8LKLB2v6xpJiSYsjDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665476574, "uuid": "eda8bb91-ce5f-405c-89bd-4fd7a0d021ba", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665476574, "uuid": "6883ec0a-7ff4-4417-8ebe-31a34df5a8a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476574, "uuid": "23273fa0-75dc-43e4-be48-c8f5b348d46f", "value": "16d37c2fbbb4ff4fce666b7ed61c10d693a36a87f588571bfbae62e1578290ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e32811c-493e-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665476827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476827, "uuid": "7efcf677-da46-4f77-8f25-a2d500ea97f3", "comment": "Malware payload (SnakeKeylogger)", "value": "b98d5df959addb0371391321151b0cbb", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476827, "uuid": "b32e4feb-ff3d-479b-8f0d-3bef8ebf69b2", "comment": "Malware payload (SnakeKeylogger)", "value": "173f220af061a443c24e3849f71a1538a42c853fe5a67479a62726c6db27383d", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476827, "uuid": "5ed316f2-baaa-4efc-bd0b-85d704cebef5", "comment": "Malware payload (SnakeKeylogger)", "value": "906bb80520f0ddf5e131a8c826ecdae11fec9818", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476827, "uuid": "460e4878-f11f-4377-a843-baa028c77e8c", "comment": "Malware payload (SnakeKeylogger)", "value": "96e1d3c9115d17839f7691fb278b4df6bd9c9d3641fc43d1ca1769cd77b463273d8db0cdc761c053c07b10c38365ee89", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476827, "uuid": "94b88cb2-71a6-4f56-94ae-b439d30d52d5", "value": "T1ABC3F181BF489C9EF47A0E7E7100D2095BA0FD319D59A63860B673089F7E2CD92DB325", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476827, "uuid": "0bf8a843-ac78-47eb-967f-5e1f58b83c00", "value": "3072:ftUppNhbTo2I1CmFydYPRjyPbLFJYG7oK+A4Vu:eppNhbTvdY4jLFJZoK+Aku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665476827, "uuid": "fd0a5611-41be-4720-84d8-87fad45eb07a", "value": 120104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665476827, "uuid": "03c180ae-6d34-46d1-8591-24756615d649", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476827, "uuid": "118fae0c-1eaf-44fc-aa28-56dfc3c9b0cc", "value": "Purchase Order No.012-1922 Middle East Crane Equipment Trading LLC.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bfccaaf-4930-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665470703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470703, "uuid": "3da0d4f2-ad58-4742-aa60-86cb52af0e05", "comment": "Malware payload (SnakeKeylogger)", "value": "055e06b886b9960d2fd3e602a4c0efc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470703, "uuid": "30f6bbc0-1206-4d19-b650-497e4c749bdd", "comment": "Malware payload (SnakeKeylogger)", "value": "17ef292b00ceafa264b877390e375c9adacc5c8a3e150844668ca8f694db4690", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470703, "uuid": "1ed9ff9f-bb51-47b3-8262-ff72832eea9c", "comment": "Malware payload (SnakeKeylogger)", "value": "2126efd92f2453c162b4dbfaf225c19f8515b00e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470703, "uuid": "1dd96c7f-0ece-4106-88a1-514a217a7743", "comment": "Malware payload (SnakeKeylogger)", "value": "4c285f5376084805bf61137c9c16778b48fc91df3be5f2971f3f79a955e0eb7006ab48d2ed61f5863217735134bdf407", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470703, "uuid": "350b101f-0d30-4b12-846b-e43ed5c10706", "value": "T1B034F58AE50099A4EE66A3356B33CD340717BE7DA870A82D24DD3D233FBF5934036856", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470703, "uuid": "399ace03-50ae-4074-818c-2192d1a33ccc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470703, "uuid": "2e29a877-e4a5-4eef-90cf-7f9bb5a6051c", "value": "6144:AV0ca+yqW5tMUgv9/pppppppppppppppppppppppppppppppppwD3d:An7v5vxpppppppppppppppppppppppp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665470703, "uuid": "06002a3e-1687-44e5-a7c3-09cff01dba37", "value": 248320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665470703, "uuid": "192a2b95-7c38-4bd9-8ebb-bb33e50c91a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470703, "uuid": "6b9ed2ee-7751-4e48-a1d2-785adfea6205", "value": "Pedido PO-40930212.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f0fcd0-4934-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1665472684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472684, "uuid": "16f83ccd-427e-4614-9f43-aa0fe178f397", "comment": "Malware payload (Formbook)", "value": "405e63f19b7ae251242e670958f838d1", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472684, "uuid": "44bec9cd-df2c-414b-bceb-53c674d28751", "comment": "Malware payload (Formbook)", "value": "184ea1a681aefc4bbe4c5461b8050b0a034ee745aecf0c48d680e2ed0f999176", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472684, "uuid": "da8a2f94-b739-43b4-8a7e-04a87cd2d18f", "comment": "Malware payload (Formbook)", "value": "570fabf59b6ab6f90e8470e9b9551a88dbd38893", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472684, "uuid": "cd2c59aa-bcd8-4832-a0ab-196f565e569c", "comment": "Malware payload (Formbook)", "value": "011aba3d7726db96b6baee6532a0479140cf5015f45bdccfeb30e879091c900d9a794eb7d40234194755b94d0bafbd8e", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472684, "uuid": "fe20ebe9-cda9-4ea3-b4a9-e4f455d9d0aa", "value": "T15A54230D17CB65CCBC75BB48AC927648F7020FCA5B5C62FAC7AA81E755AF4012A1243E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472684, "uuid": "4552a760-7a1e-461c-8aef-a0630a6e25bc", "value": "6144:LfdjpSCrnLNWgRJrlPcJBuWMVzTt0z84KzPPynM+6i1xjKOjX43+no:zdBNfRJRP/bN26+MRi1gkIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665472684, "uuid": "3d9ffd8e-2581-4297-beb7-87bc3ca4cc3c", "value": 278913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665472684, "uuid": "1e4c194d-e975-4545-95f2-2a82d19f0d25", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472684, "uuid": "131a5d65-bad6-4dd4-b5d1-8eac45f8a6b4", "value": "Roominglistss.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c911f8-494b-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665482505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665482505, "uuid": "6dfef069-7399-4d71-950c-f10496d75d85", "comment": "Malware payload", "value": "3921d93ff0ac8c8025c759a811d76695", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665482505, "uuid": "9143e587-0975-41d5-854f-c57a2d01a016", "comment": "Malware payload", "value": "18b8de802c7d2accddc4769d5aac4686cec0ea84806b9eb9dd2dac84557b0895", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665482505, "uuid": "81f9beef-c4dc-41fa-8f71-0be454cb33e0", "comment": "Malware payload", "value": "a73cc278488f3015457d5474562492b6c0d183b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665482505, "uuid": "5fad25ec-fde8-4b53-9a0b-3e316a0cdbf5", "comment": "Malware payload", "value": "2317614ec5716226f085f1107678f76e5e3c309ea2be9cef05bf7b30ab459b51207fc9086669cc2a3addf32b2dca2654", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665482505, "uuid": "254e27d4-8fb8-4ab1-9e26-6f1293b8d3ab", "value": "T18E76339332D388F7C66C14B1353D2B25F492EB5808769C5B6B4B0E777AF8760A03B994", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665482505, "uuid": "ffa178b4-a552-4e0a-b5cb-8f2e6f252145", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665482505, "uuid": "e8cbeee6-1c27-46e3-94ec-efddf4769911", "value": "196608:91OgRmFz1pcaq4uxJgBFI9Lhr1y0u1DHZfe1kOB:3OgRgZOggBhIbDxe1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665482505, "uuid": "5d9d0547-45db-4348-a393-e249d00c2679", "value": 7617954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665482505, "uuid": "e6d9ffd2-5cf6-409e-9327-e83c06c25f10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665482505, "uuid": "eb0e3981-7bc7-4146-b59e-0c7fee5ed23c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c96839-4927-11ed-9266-42010a9c0072", "comment": "Malware payload (WannaCry)", "timestamp": 1665467147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665467147, "uuid": "1ed7e714-d485-4f84-8460-74daa822ea08", "comment": "Malware payload (WannaCry)", "value": "c6358f3d3eb696eda48e61da3afbc820", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665467147, "uuid": "2ab11379-e2ca-45aa-80c8-6364130768a8", "comment": "Malware payload (WannaCry)", "value": "18dc0d2038535319162088772793d3dee8454569065f8f6e89aa313e5c5aae93", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665467147, "uuid": "530843d1-976e-4bac-bebd-098755503a84", "comment": "Malware payload (WannaCry)", "value": "412dfc06e0788b2ee9b5ef5579af6307edd7ff22", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665467147, "uuid": "b2a5b8c4-7471-4ad3-8670-98e5ab224599", "comment": "Malware payload (WannaCry)", "value": "12b9b3c246db421cbf5b6d6c8fd6d655b14461ee49890881af1a27c40d70704d108cf91fd17360755150c252a8d3ea0f", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665467147, "uuid": "37c9d0fc-8e85-4346-a414-02087f2e73b3", "value": "T12545239A75AC50F8C11A3270E4778B26A2B77C7D21BE9B0F9B908B611C03751BB64F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665467147, "uuid": "249ac406-dcb6-4d40-94a9-531e8af12cdf", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665467147, "uuid": "57d6a845-0021-48b5-bf32-77c6fa254ba0", "value": "12288:yvbLgmluCti62ybaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+D5YSUjEXF9:SbLgurihdmMSirYbcMNgef0ujG/D8r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665467147, "uuid": "24eb0267-b45a-4856-9f23-43ced9e46458", "value": 1187840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665467147, "uuid": "8a8e2cb9-938e-4198-8310-2817f587e1c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665467147, "uuid": "4a89b1c1-770f-4a87-8f4a-92c3b07ed587", "value": "18dc0d2038535319162088772793d3dee8454569065f8f6e89aa313e5c5aae93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc33e2d2-49a8-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665522457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665522457, "uuid": "38d9db27-8048-41ff-8f3c-1df78669f998", "comment": "Malware payload", "value": "3aa473d7ce55eb5e5c0da9e81ccfc051", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665522457, "uuid": "b4acefa4-0816-4b46-9078-c3928d7a4d76", "comment": "Malware payload", "value": "18e57acc198a3afad96f6fff17a0cc538da02afcba38036dda6cf1b8902efd2b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665522457, "uuid": "9a1dcc3e-7226-4c47-a5fa-3c95e2feb299", "comment": "Malware payload", "value": "c1efd25f69b6784596bae1d4b51154a91f887834", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665522457, "uuid": "d94ae250-fb10-4e87-a988-33ce9eb157d3", "comment": "Malware payload", "value": "6bd96cb8e284ae6e69e20a2e29a0823e4725f255315a0b9aacbc7eb6c884bc208df6ca309cf4b36028146b3e077648d0", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665522457, "uuid": "cf775254-b130-46f3-bbfb-3f1f6c6d074c", "value": "T162561223B2D74112C1AD057BE91AFE8E25B97E63472150F7BAF539CF14B08D0B276A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665522457, "uuid": "ab340e3b-0711-4dfc-800f-b399a0a513ba", "value": "196608:uJaZD+w6603bX9Q+tBq8K7MY3sW+kycKb:uMn66gbNQX3lcW+knKb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665522457, "uuid": "87de025a-9f9f-45bd-b998-5dba84d62251", "value": 6368768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665522457, "uuid": "e5e84282-3af2-46eb-b6c4-68936a021ee2", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665522457, "uuid": "1d18742d-8d1e-4d5f-a857-fdad5bafadc2", "value": "COMPROBANTE-ELECTRONICO-PAGO-CEP-41136d968a589ee7f4bf39cd15d31bd8e9fc.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "827a156a-4932-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665471680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665471680, "uuid": "d9770b34-4e04-4874-8c8a-efb1d49c7f8f", "comment": "Malware payload", "value": "f32bd55be600c8be9555e98dfa9fba47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665471680, "uuid": "ea842381-1117-4892-91d5-d267a8b3f510", "comment": "Malware payload", "value": "191f21bfa425549e9161dfdaac505ad287e11835a724bf2e58bd9ca8bc0b3156", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665471680, "uuid": "85c3fb77-9efd-4876-9af5-0c64b13f99f5", "comment": "Malware payload", "value": "1d4fe71c1d6e7ad6e6ff5358746c4d7b1e07dcf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665471680, "uuid": "6d183998-4b32-4f1a-bea1-7002031c1c58", "comment": "Malware payload", "value": "8fe3c8c268e1be5d5511fa622ee014127f12d173e2a9801117db8e42683416607a97ca5f38f57b3102e8bcb3c271b750", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665471680, "uuid": "8fecc665-c160-47db-b0d2-57c069e2ec97", "value": "T1117633613AD889B1FB27EEB49D0D6BC1E272E7895F0320772749881F187DDD26630978", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665471680, "uuid": "209b53cb-eee8-4bf5-beda-bef8cce68dfe", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665471680, "uuid": "592e3243-18f3-4905-8a23-3d489c8b903f", "value": "196608:91OpUcti9ofgjlcXdGIUaXrpK37FWlSLB2RUGhnd:3OpUyaWTtGIUiOuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665471680, "uuid": "24f05916-a676-4f95-9316-1c1efb4f47ad", "value": 7651078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665471680, "uuid": "18a860c2-54e9-4512-aac1-cef1c698edf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665471680, "uuid": "ad6cb94f-9a58-4d16-acfe-bd899ed26706", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e986bc19-49a1-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1665519527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665519527, "uuid": "b57373ca-298c-48cb-8978-2ccea2b136e4", "comment": "Malware payload (Formbook)", "value": "bca0941e4c0442f99fbeb467b9b09c01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665519527, "uuid": "4fbf9980-b083-42e6-b00e-6847c13224b5", "comment": "Malware payload (Formbook)", "value": "19ae401dae448c5a46e97a527f41c210fbd8e3c60d05fab04b475bbc39a997e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665519527, "uuid": "152ae11d-218b-4b98-b9a6-dd9de90dcb97", "comment": "Malware payload (Formbook)", "value": "169508fdd4119fc20657b40c2834501c9ab7c842", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665519527, "uuid": "0c0a3abc-89c9-4651-9e58-f83947a4c18f", "comment": "Malware payload (Formbook)", "value": "6629b7f1039ed5891d57245be257ccb2c5caf2f9f38ca26f44ae83d71f3ea3f63fdd4ec15931984c454c04bf6c41feef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665519527, "uuid": "68d59bdb-eca3-45d9-bde3-3f10a022aff1", "value": "T17A157A7A25D14617E4197275C893E2F32AFBAD606020D2CB5AD72F6FBC411BF921334A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665519527, "uuid": "8e06bb0e-1e3f-4261-b303-c865d3949d14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665519527, "uuid": "34cbe366-293a-4e28-8981-c8e30366ada6", "value": "12288:b7KQWNGGlvq5aBteDUkLjYfi6z+Ud1NnbM4iaw52QD8oOI:rch/XeDnMi6yG1QJzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665519527, "uuid": "7d3c4509-7e90-4c42-8e09-438e9a7b4abe", "value": 921600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665519527, "uuid": "a7eb7270-2054-4f6b-baf9-fb89f8b45612", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665519527, "uuid": "9e5b0513-45c4-4462-8cd2-497da203ec6c", "value": "SecuriteInfo.com.Win32.PWSX-gen.18983.2750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4685f781-493d-11ed-9266-42010a9c0072", "comment": "Malware payload (CobaltStrike)", "timestamp": 1665476304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476304, "uuid": "68a98ec7-096f-4e7d-850f-f1c574d0e420", "comment": "Malware payload (CobaltStrike)", "value": "07b2f48335b6eb2d0adaa232d195a7a8", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "gootloader_payload", "colour": "#2AC679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476304, "uuid": "344e47a5-98ad-482b-bca4-a5206a1165b8", "comment": "Malware payload (CobaltStrike)", "value": "1a07c494815f45857000a8ed79292ac61941e000e62b6d0b13cf005ab23e3093", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "gootloader_payload", "colour": "#2AC679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476304, "uuid": "24eff9e2-d279-4a61-8dd3-396dd6e444df", "comment": "Malware payload (CobaltStrike)", "value": "d45c5a367750516cf9865d5da02ac387d533f975", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "gootloader_payload", "colour": "#2AC679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476304, "uuid": "91dc7ea5-44c8-44e8-969d-ef9d03456292", "comment": "Malware payload (CobaltStrike)", "value": "5de033a4c441490695040c7841f74ae5d09ce352900039bf3eb2d11d557a902ff718841fc4e49730d5f9f8ad05626733", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "gootloader_payload", "colour": "#2AC679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476304, "uuid": "0febe853-36c2-4c08-82bd-fbe41432ebd3", "value": "T10154DF3911350F55EF25643928757531AA68F7AC9ECA2DE04CF7A3834BFA84789EC04B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476304, "uuid": "c8c27f4d-287a-4426-ad71-663abfafd734", "value": "e1dcffde169ed8b947dc63acdb78aeca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476304, "uuid": "889a0174-fbc0-4bde-8db9-269d6ff1aa54", "value": "6144:NrphPKo8TeGkZf38/vVpNGdO00ICu+XqJ:cOGmf38/9nn00rZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665476304, "uuid": "8a7c601c-b9f2-4f69-9280-90d1a33306cb", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665476304, "uuid": "58d59263-7cc2-449f-92f3-81e80281cf37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476304, "uuid": "cf3d6dfa-b19d-45ec-8473-0236ee228d4e", "value": "6bac0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74d8d3e-48f7-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665446509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665446509, "uuid": "1876d812-1460-43cf-850a-20420317b230", "comment": "Malware payload", "value": "456b4f2a9e2a4e29c3fb3011e8ddffbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665446509, "uuid": "6bdc3dc6-16e8-4d40-ba0d-31f080c208fe", "comment": "Malware payload", "value": "1a1ef20be5738730b925c984b4424a271ab27f6f3ae3b0e089c6cde04d38b5b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665446509, "uuid": "ebd19516-3cb6-424b-9358-1e799fe47c22", "comment": "Malware payload", "value": "8b8501150c8f6d8bc9b4c8eb3be188e3dd844d3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665446509, "uuid": "a909d20d-6413-4206-a01a-b9572be288af", "comment": "Malware payload", "value": "175b0860ca9b7586cd154801a5ba8c65e6047189092bb927c08aae143294ae8e1d12da79021bcdc0d5d87203dcaa88dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665446509, "uuid": "074d06a5-245a-4e7b-bda7-f4944d915c15", "value": "T13176338132F1D9F7C34214B25C96FFA076A9EF280E374A93134126AD6FAE8C48475B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665446509, "uuid": "62329a02-a4a4-4aee-a990-a881dc50ecbd", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665446509, "uuid": "57676395-59dd-4468-b8d2-719fd1930625", "value": "196608:91OzSnpFyPzGcG5Slkbj/uyOQ46U1QHMmVNDZ6bqJ1dL:3OguQAkmyONWVb6bqjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665446509, "uuid": "6ddf3051-3a90-47b0-aac9-b15232930125", "value": 7584578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665446509, "uuid": "2c1230ca-37aa-414a-9ff6-0c224c101887", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665446509, "uuid": "8e0a6fc8-84b2-483b-ac93-74c3c795cfe4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50d65409-4919-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665460859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460859, "uuid": "9794d108-6dcd-45e3-a415-9449617c5412", "comment": "Malware payload", "value": "67c2d03d59ef2caf223148fdce8bef56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460859, "uuid": "64a2b52e-d8f4-4d84-a814-e723f06429ed", "comment": "Malware payload", "value": "1b75af16291d662454bf6b2007c174c092dea42a5c80ab191f5362d308b16ec6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460859, "uuid": "06a4bd25-27ff-4a00-ba5a-f5962cf8146c", "comment": "Malware payload", "value": "739a6df6f4a5aa0ec5e001fcba149ebe2e721d5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460859, "uuid": "91b27194-fb5f-4627-9582-a99c6c17a192", "comment": "Malware payload", "value": "3141a6195c1c63fea00bbab075441c54bf1e2ad93c6bd5e5a3f3245d7b90093cb76af09eb2707f983cf5ceb0bf1f5a76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460859, "uuid": "5c13d633-e46e-4b3a-ae9e-d08fa2e0fda6", "value": "T1EF7633103EE499FED2520E71847D7F41D1B1A3B80F3228D3ABD9661ABEDE254E03D625", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460859, "uuid": "bc3002a8-ab96-417d-b7d0-9bb74cec2e1c", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460859, "uuid": "d3294198-baaf-4474-81b8-a8a21502bd16", "value": "196608:91OSX0JR8ZugCH08wxYXYG1siUF+reNKiDFCNte:3OSEJR8ZhQVv5UFbNKu8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665460859, "uuid": "65df39fe-46f2-4ac9-8570-f02ff440fc18", "value": 7598676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665460859, "uuid": "fafcc48a-7c84-430c-a86a-0bbd9bfdf44d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460859, "uuid": "5ef82e67-7cdc-4868-beb6-911be3fb005d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3e31b76-4921-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665464569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665464569, "uuid": "29234ba6-b804-4783-80c8-7d9cb2f1e16d", "comment": "Malware payload", "value": "b15c92ac96019a8ded44452bfe4fe0ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665464569, "uuid": "231a27f6-d721-4cf2-ac5e-c7726299b95b", "comment": "Malware payload", "value": "1c6189a6577f287b0e0b4a55e707b191d25bba6d72f773cb5461560afc741f57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665464569, "uuid": "fdde4282-a892-40c2-8c78-0825e238a94b", "comment": "Malware payload", "value": "d2ef1fd116803053850b56532aaeb9bbd00e0ef9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665464569, "uuid": "7837b8bc-5d94-4c3d-859b-639f0b8d1a55", "comment": "Malware payload", "value": "2fd19352fe7520bd180f2a05d4d241098f71ee39363216867e7ac8e3af155abbb0f3116c66e4ae4f6e142606c528613a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665464569, "uuid": "74f7e57a-b0d7-4453-8328-80e2e65f25e2", "value": "T14376336774E18D7FDA512E320D6C9FA4D8F48F657F16AC2317AA026E3B380F5C405AA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665464569, "uuid": "4ba89de5-1848-44b8-950c-8134215dfcc0", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665464569, "uuid": "3bd76e3e-582b-4cba-b8f0-f31bd11e3e61", "value": "196608:91OZT9VrV5QH4cO7oL8f1Cfjhc5CBy+o6RnlrS4PaOpw:3OB9VBCjO7d8LhY0S4Bw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665464569, "uuid": "40db26e9-46e5-44ea-b940-5d9c1288e3bc", "value": 7636472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665464569, "uuid": "49329446-86bf-4462-a211-72703d2a2040", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665464569, "uuid": "c4cd7f7b-bf2b-4218-b63d-052ec2ca9d93", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a47e8b-4936-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1665473346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473346, "uuid": "9f84d3b1-5425-4c12-99dd-ba2b8f6b5f2f", "comment": "Malware payload (Formbook)", "value": "6189b80341ca51828414beb53c97431b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473346, "uuid": "fa44846c-be80-47a0-a49e-9341f8b9009a", "comment": "Malware payload (Formbook)", "value": "1d2541a6fdac8e1f716e4004df05c2658453b90cc19883816d9ff890e8e09ff6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473346, "uuid": "02cc4bd1-d533-4a3e-832d-a8894b47cd8a", "comment": "Malware payload (Formbook)", "value": "7ed4585810b3691343ecf6893463d25f4c61c6ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473346, "uuid": "8c75a6a5-ac7a-4507-bbb1-15826d2c055d", "comment": "Malware payload (Formbook)", "value": "969b2965caa72d2d1cd213fc4dddb440f40f94edcf5879fb3d2c8233831a30c5aacb227af6a78f096a75ca1804c12277", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473346, "uuid": "228f6a02-dbcf-48f6-a8f4-a5f0c1a1d18f", "value": "T19105D0371BEA8B0BD124B6B881D1C2F6A3ADDC01E467C3976BCA5C1FF08A665D760351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473346, "uuid": "df162e68-9fa0-4ee7-bb1e-f39299f6ff9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473346, "uuid": "2ee444d5-0245-4bbc-9abe-e1aebe67efe5", "value": "12288:/AB2iNQP2hF0VsLOjvUrFq42NREcN463Xh6v+yPSFtQ+SJDufKS:c1i2hF026jsrFqnTrpXgmyaFOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665473346, "uuid": "3b30463e-8e66-47e1-b226-0d7e7de01c36", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665473346, "uuid": "7b1f4806-f778-4285-849e-de68b8c6e50e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473346, "uuid": "14921448-a760-497f-a652-8e32ee86de09", "value": "1d2541a6fdac8e1f716e4004df05c2658453b90cc19883816d9ff890e8e09ff6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c006b3-4937-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665474014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665474014, "uuid": "2253fd6f-1039-431d-bc99-ba69b5eb3e6e", "comment": "Malware payload", "value": "08e6b6acc62fa1b48b79fdb5f6c741a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665474014, "uuid": "7f0fafde-2f23-4ec4-a34d-d38adf64b5ee", "comment": "Malware payload", "value": "1dacb7eeb34fff605ba9d6b2c69797839fbf39dc4b675a12bb608a4d04135ae8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665474014, "uuid": "b5cd23c1-a8be-47ff-ae46-87b3aa5084d7", "comment": "Malware payload", "value": "14d0ee24fa377cab81cde64295aa2dfe099a8fd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665474014, "uuid": "05c53623-f443-43ef-ab3a-61c16aa39f6a", "comment": "Malware payload", "value": "b45a7607c3b2f7b9f237244c328df54f1ebc735f0bb9996664eeaadbb1520afa557314e3b5142d67e746e7ff784ef83d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665474014, "uuid": "6635d358-2a6c-4761-8355-c051f2b70335", "value": "T1E145AE1263DD8364C3B272F3BA5563016E7B7C2506A4F45B2FB4393CA930123DA5E66B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665474014, "uuid": "311d9562-b379-495c-b1d4-972c79b0be4d", "value": "c1d258acab237961164a925272293413", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665474014, "uuid": "4f48be26-6039-416b-a95e-8efb4f786b3b", "value": "24576:+tb20pkaCqT5TBWgNjVYHHBT+v3LeMFo6:rVg5tjVYHHBT+vF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665474014, "uuid": "7fd23f8a-c426-4eec-a672-3c9b1ddc1133", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665474014, "uuid": "672f9bd1-bc14-45b9-aaca-86fcdf63f11d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665474014, "uuid": "7c495ddb-24e6-4e62-9f76-9ab659ac3661", "value": "1dacb7eeb34fff605ba9d6b2c69797839fbf39dc4b675a12bb608a4d04135ae8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd41e1d-498d-11ed-9266-42010a9c0072", "comment": "Malware payload (ErbiumStealer)", "timestamp": 1665510652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665510652, "uuid": "38123e86-7b99-4d6d-87d5-e0c0c1f8b618", "comment": "Malware payload (ErbiumStealer)", "value": "2360f157b3a648812b9abd132093e117", "object_relation": "md5", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665510652, "uuid": "d91ea273-3a27-4bfc-a09c-067730eb9587", "comment": "Malware payload (ErbiumStealer)", "value": "1f26ea6b5d9277173f02da194d72089de9b5cc86619c49e43c6f48631eb192ea", "object_relation": "sha256", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665510652, "uuid": "dcf5cbfc-23fd-4974-9889-eb8f8f968f77", "comment": "Malware payload (ErbiumStealer)", "value": "f642a4a9923c3f0b321bf0affad010f98823f823", "object_relation": "sha1", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665510652, "uuid": "09778ea5-161f-429f-85ca-3690e53c0455", "comment": "Malware payload (ErbiumStealer)", "value": "54407d614a8c6b138527193a3ad14048f59a28dfc13a00ac620fea6fef86926a610c9ff47853aee261fa482647b4c202", "object_relation": "sha3-384", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665510652, "uuid": "a0a414b3-52ac-4100-885c-02a95e617673", "value": "T17AE3D0E5F890C0B2D429A87444759E507BB7B03656BE0A4E276C166A5F702C3847FF4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665510652, "uuid": "7400e51d-b7cd-4e65-b93f-6362f3bb336a", "value": "ad19c37ee9593d68bae81c0ffb31ca85", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665510652, "uuid": "9995806c-e58e-466c-8d5c-fa5221423c34", "value": "3072:xdJ2Pxrgj4sHW/RvKWl3uSlVZUMf8G0iA6jq1BSKN+cAe+WXy2y:LIxrgj4sHoKWVumVZnf8Gs6GnNHIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665510652, "uuid": "b7c061fc-5810-4067-9695-ac6fc4971552", "value": 152011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665510652, "uuid": "60818e22-10a5-460f-81c0-a89cba502aa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665510652, "uuid": "84189438-0701-432f-9c17-4c1078b87c93", "value": "2360f157b3a648812b9abd132093e117.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ef1fa19-492e-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1665469768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469768, "uuid": "9ee84854-fc97-4991-a745-7aa948492139", "comment": "Malware payload (GCleaner)", "value": "54e6f61f8b65ca87ce72a5a8e9b2a998", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469768, "uuid": "35b70546-efc0-4ebc-922d-18c25cc2969c", "comment": "Malware payload (GCleaner)", "value": "1fb998c5bd768cddd4b48eef261039e074fbaac2a459fb76742e7d3cf8e6eb31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469768, "uuid": "ffd0f7bb-4f05-4f2b-9fd6-e70b3d10e7b5", "comment": "Malware payload (GCleaner)", "value": "dace3507a9f4e04132667d1338e0acc2a9ffcb06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469768, "uuid": "6b253b8f-c93a-4128-91ca-b7ac51400de4", "comment": "Malware payload (GCleaner)", "value": "f059febd4ae14218a97326432c19ac38acc732322a67770123dae6b2a9e352954d630825ddac89cda1d536e6d12eb351", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469768, "uuid": "b5618044-37d6-4be4-aea8-786803bb6378", "value": "T15B74E11238C1C472E9267135CDA5DBB12EFEB8B509726A4777E8027D8F266D19E203C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469768, "uuid": "03ecde39-989b-4b04-bca2-75f5217140c2", "value": "f07757163332cdbf737bafdb4614222c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469768, "uuid": "aaca5eb7-6d1e-4f04-af2b-134f266cb720", "value": "6144:wTBoCLd2FN/loT6jEIP2KxsGKCu3o4MVVNb7aXzL+O6Wj:wTBoC8FTocEIOKOGO3oFTN7/ON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665469768, "uuid": "9292445c-af6f-4239-8f9b-f6bb6b8f36d7", "value": 348672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665469768, "uuid": "0cffca6a-b24e-4253-b229-b2fd63e5af94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469768, "uuid": "f18cedbc-d22f-4174-8957-fc19aaa5df5c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "852d5e1d-4916-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1665459659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459659, "uuid": "695eafaa-b71b-4aa7-9ecd-3ac71399692f", "comment": "Malware payload (Formbook)", "value": "3e26dd2ef6dc0be5838e1eac6b668846", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459659, "uuid": "3d62bc9d-db7a-4f22-95da-b3bb2acea0b1", "comment": "Malware payload (Formbook)", "value": "221207a0c2f44d04a8c605e5ab6f4585d683daf11671dc6b9fb6a12e3214769a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459659, "uuid": "b6bdaf4a-5ef6-4c02-816d-839d27bab590", "comment": "Malware payload (Formbook)", "value": "85581b892756aeb1c453f34464b1f40fa92ff91e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459659, "uuid": "f3435872-66aa-4964-bbfd-80b6917412dd", "comment": "Malware payload (Formbook)", "value": "42f24a1087b13711785b1a5d92ae81490f08ed3be125005609c663a739af5db6cb3f86a6d969ea7f4dc158b94ae194fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459659, "uuid": "3831c7da-ca0c-4a7f-aebe-8d4f7778ad1c", "value": "T14F737D46C7D10423D96A8A72B0D396C72BB0B20D5DD14AA795CCB01A0ECF38A759BBDD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459659, "uuid": "d76788b1-2aaa-46ba-b902-a3d429c110dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459659, "uuid": "877d6513-abec-4867-94a5-4ad4b34f5ae4", "value": "1536:sTey149ULHmpga/eHUTQQQQQQQBdBgN6b5/2kWSC6WLrxtDvas:Ye4tLGpga/eHUTQQQQQQkdBft/2YWLrD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665459659, "uuid": "e0399967-1e1a-4760-980e-cefd60bd318a", "value": 74592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665459659, "uuid": "0b7fb15c-0623-48d2-8e9c-4de7fcf89d22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459659, "uuid": "ee694dd3-20e2-47de-b1aa-5948bdcaccae", "value": "SecuriteInfo.com.Trojan.DownloaderNET.346.3836.25977", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e1f0c25-494c-11ed-9266-42010a9c0072", "comment": "Malware payload (Vjw0rm)", "timestamp": 1665482759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665482759, "uuid": "988e5fe4-ebb9-4e2b-afa1-d3f075ded0be", "comment": "Malware payload (Vjw0rm)", "value": "1d7e2346c393a498d60d3a43095d3b8e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665482759, "uuid": "a73570a4-1cd4-4926-a504-1dc02e3acd69", "comment": "Malware payload (Vjw0rm)", "value": "22125214857ca13a8cb91e5c920d2018db792d57356537234487ad47e66ae0e0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665482759, "uuid": "663f6acb-450f-4af7-867d-608bbe63440b", "comment": "Malware payload (Vjw0rm)", "value": "729fe8f9886c020c6a1d61fcf68a6acd02c43515", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665482759, "uuid": "4ed96576-4dc3-4710-92bc-fbe452f07763", "comment": "Malware payload (Vjw0rm)", "value": "11bfa5c0b3a8221650fbf6b64e0a05583d2c64bf7bcbfd5cb85ae8317d73bb35daf99d5ad459a2079399313564ab0650", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665482759, "uuid": "28ca8912-3cb0-4f15-a2ec-ee70fe7e317d", "value": "T101728EC25E35FF1AEF8C268602FCCD4D1FDE87499A42F95E3523A30084A16C9964E35E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665482759, "uuid": "b149e49f-673c-4161-8ffd-047ff0f4faeb", "value": "384:12zXBxnmXyv1X1QuJRVKJbyfMZU8Hyi939s3:16RAyXZRVfMse9s3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665482759, "uuid": "26a1ec21-4929-4490-bdbe-4d075783ebd1", "value": 16156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665482759, "uuid": "317dd0ee-29bd-4346-b7f7-b7e7b337d00f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665482759, "uuid": "a9f6cbc7-bfa7-4f1b-affc-02164517b117", "value": "Payment Swift-MT103101122.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fab08ae-493c-11ed-9266-42010a9c0072", "comment": "Malware payload (NominatusStorm)", "timestamp": 1665475836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475836, "uuid": "b5b120b1-7721-47bf-bff0-ab11987ab1a0", "comment": "Malware payload (NominatusStorm)", "value": "3d4b513e63da4fe377be1aa628777df5", "object_relation": "md5", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475836, "uuid": "dc5cb551-3669-4667-9a07-679419706058", "comment": "Malware payload (NominatusStorm)", "value": "2220a6cedf0b48c1cafbf82780fd1a57f4443ba81e6c8e79d91305fd2d718860", "object_relation": "sha256", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475836, "uuid": "2f248dd7-cc52-416a-860a-84f77782fddd", "comment": "Malware payload (NominatusStorm)", "value": "45ee89126479a7f28158d8e257c0723f8062e479", "object_relation": "sha1", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475836, "uuid": "3a701542-7c03-4b27-aa86-9c2d184ce10d", "comment": "Malware payload (NominatusStorm)", "value": "05c7c79f3fb49c4836024116df2ea372536f72b48b11c1d92a20ca3d3466b2f4d23fe8a5f5d43d087b8a3766f6c5ef97", "object_relation": "sha3-384", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475836, "uuid": "eeace56a-f287-4698-acac-b16e94cb7ef7", "value": "T1D915D552D3FE0A28F0FB0B75AA395241AA36FDEA6C23D52D025E700D1531F40DEA577A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475836, "uuid": "731d1810-ae5c-4dfe-b320-1514e6453409", "value": "24576:aWWWWWWWWWWWWWWWWWWWWW23i13QqG/HvO6/A5jnJK+M7UHJ3:w3i2qG/HvO6/A5jnJK+MYHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665475836, "uuid": "8e2f7962-331e-49d4-a762-e49f76b32ad7", "value": 955476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665475836, "uuid": "a7823b84-db02-4f17-865f-13929550946c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475836, "uuid": "0b8606b3-383d-471f-9956-3099d55a3890", "value": "2220a6cedf0b48c1cafbf82780fd1a57f4443ba81e6c8e79d91305fd2d718860", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c70990-49bb-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665530609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665530609, "uuid": "3a60887d-92ff-4e11-b8c9-60954f016e86", "comment": "Malware payload", "value": "4531eeeb9bd712a6b2a4743988ba26a0", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665530609, "uuid": "e06e9304-d2d3-4a32-9e11-95619b87f070", "comment": "Malware payload", "value": "22b08ef04ac226c248c42e1f7623211db4280cbed25868df4a2078d51e20f8d4", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665530609, "uuid": "7fbfeec7-8ebc-4850-8f01-2469170d092e", "comment": "Malware payload", "value": "780823c03bb1c32168058dc679a365dd90168b76", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665530609, "uuid": "419fd75d-4d0a-4786-8502-8f5f843336b8", "comment": "Malware payload", "value": "b091527cfcbbe793efd40217672270194be35d300f49332802b732bd0fb764432b92e0768e1e022cbcf2e4e9df88000a", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665530609, "uuid": "36c42fa5-b748-40b4-88d0-e2c1e9ac4790", "value": "T14325025F4D53D8601FBC97BC7E7B05A83716A5E8A1AC20DADF85B0A162C083E805F9DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665530609, "uuid": "f001f85e-3539-4b99-81b2-7f783ad15366", "value": "12288:Yva4lvoWFkXhjeiYOJrhqEFP0Nftz4RKi3CXwQ7IPFjxAtwHLz5Ec6AH:x4lojZecdj8NfufelIFtAt0Lz5d6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665530609, "uuid": "b54b19c4-87eb-4829-90b7-5a80eb67c221", "value": 975841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665530609, "uuid": "666ed0a8-2786-479f-9ff5-7f93e135a5bc", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665530609, "uuid": "38bc5f71-2dc7-47fc-bde6-1f3cccfa26ba", "value": "RFSL_1573.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c607ff-4933-11ed-9266-42010a9c0072", "comment": "Malware payload (CryptOne)", "timestamp": 1665472301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472301, "uuid": "45844a9a-bdc6-46e0-bc8e-c87579d13073", "comment": "Malware payload (CryptOne)", "value": "74b775941bf4e5c5da8e98d35c9a88d2", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake outbyte drive rupdater", "colour": "#AD1756", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472301, "uuid": "53dcce5e-5f28-475f-a0a0-2376af0f4b70", "comment": "Malware payload (CryptOne)", "value": "22e6cacc4b61b0a95c6d0f85ee569e005824a07bbb409009332bfd66641e2051", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake outbyte drive rupdater", "colour": "#AD1756", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472301, "uuid": "ec1e0c4b-5871-4c79-971d-262e83561eb0", "comment": "Malware payload (CryptOne)", "value": "b7c0fe95486dc54d22db26754a0673eea7886e51", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake outbyte drive rupdater", "colour": "#AD1756", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472301, "uuid": "39d7a521-4ec6-4cea-bab8-73c5df0723ae", "comment": "Malware payload (CryptOne)", "value": "272a61e1d7967115c764e968dc2f8128e994a3391bcd1d11667ba3a2f0560b41f82fab451f7e01826aef6ab6bbd5881f", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake outbyte drive rupdater", "colour": "#AD1756", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472301, "uuid": "1c898eb7-2c41-4843-b38c-a3f68db2b328", "value": "T1430733026950402AC9420B710CEDBC18A46F7F1C3676B8E665E3B3F8D7326167E65E6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472301, "uuid": "16052d01-73a5-4826-8c65-195542469601", "value": "8c16c795b57934183422be5f6df7d891", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472301, "uuid": "e507863c-919c-4234-9df7-36c9e66a7432", "value": "393216:L+GdyNmTfJDdcKZs46HxaNDudh3H7Hkj9CsnRbh1uQ7oiTlni6X3p+uci:L+GdyNMtSKZsvx8DuL3jCEsnRlBni6XD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665472301, "uuid": "ac5503d0-1be6-4915-ad0f-22f72be96fd0", "value": 18390312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665472301, "uuid": "22664b71-9d33-46fe-9383-79a8bb315f62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472301, "uuid": "50f8d277-7239-4350-9e70-f994b26f7ca8", "value": "22e6cacc4b61b0a95c6d0f85ee569e005824a07bbb409009332bfd66641e2051", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f2b74c0-4971-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1665498652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498652, "uuid": "56b02426-8675-4312-b3a9-fa8c98da90c3", "comment": "Malware payload (RedLineStealer)", "value": "e5663047e91eb6e71f8867932935bbe1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498652, "uuid": "70fcf904-667e-472c-989b-f9ee79a9596d", "comment": "Malware payload (RedLineStealer)", "value": "2428bbefee40b2bf9ab3d26a9c7293b35b023b0f2797aeba880b7d04feed6940", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498652, "uuid": "54a7d541-047d-4283-87c4-36be40c5263e", "comment": "Malware payload (RedLineStealer)", "value": "3062c30c3e67a7bec4a73e477127d01708114f86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498652, "uuid": "bb23d57e-0272-4ab4-b145-fda96ed3a56e", "comment": "Malware payload (RedLineStealer)", "value": "277bed517065aa1f4adc3d30a98210562b195070f7612e04fc0ac8b44c12657cbd3ea998ee0cee5a1bb216f4b4e76e81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498652, "uuid": "0c1c59cf-630c-4040-a93c-569b3b3a03d9", "value": "T1D424CF123AC4C072E26615398C64D6B16BBBFCB16A3557CB7BC8162D8F367D29E24343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498652, "uuid": "8c74ffce-173d-42e7-9696-11a2189fe112", "value": "2466deca3b013302337885751cf37be4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498652, "uuid": "a7fff4e1-b79e-499d-9baa-ff1136e830f2", "value": "3072:nUJ1oeGYL81sxL2vHl4bOt8fauGIXbg4w5nZ2IeIe1rV8O:nUIO6WL2vl4bPa8bg4w2Ie1rW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665498652, "uuid": "130b4f24-a954-4a1d-9b27-84d914445979", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665498652, "uuid": "229a0a6d-1d00-4efe-9349-0d8621b99f5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498652, "uuid": "5b6a6575-6a3d-4d8e-9560-6beca5448fe7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11bd55ea-492e-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1665469773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469773, "uuid": "782cbcdc-4e55-4ad6-98eb-563c0c212e43", "comment": "Malware payload (Mirai)", "value": "809cc5c81bcc63dd66f5ae8a343e660c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469773, "uuid": "1e465221-5987-4002-aee2-913dfb30d55f", "comment": "Malware payload (Mirai)", "value": "242f3036541660091b34f4ca51bfa1a24666dc33fcb36e15e0c9840de462dfa9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469773, "uuid": "38558f33-a519-4a71-8ac2-7494a74e1050", "comment": "Malware payload (Mirai)", "value": "1bf839b9425a471a54370f10df0185acec1fa70d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469773, "uuid": "b58a1c86-df4c-4d7f-acb5-0de5d83c8efa", "comment": "Malware payload (Mirai)", "value": "d998cb6d97fc684b02ccec59a170425d139c116070cf92770936566bcb7f0411b69a18e6210ee3ea09d8c88b8446f2fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469773, "uuid": "a303230f-9880-4df0-a3f1-28fc9417ddc1", "value": "T1F6D2E018E5468DE9EFD75FBA4C65B6C303B08B4E17464EC020ABF7E098526336B09DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469773, "uuid": "aafdbe8e-31db-4d2d-a52f-bee099e8bb40", "value": "768:wkTTmLG0xMTwhA/iXp4TvBKiw+C07jVjnDlbP4uVcqgw09R:wknB0qwhlXp4TvEiwt8r4u+qgw09R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665469773, "uuid": "2261b60e-772c-4efd-add0-d22b1893f316", "value": 28328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665469773, "uuid": "8e524c25-9e2a-486f-8274-d7647ac73767", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469773, "uuid": "29c09680-2892-4843-9665-42b829d0a48a", "value": "809cc5c81bcc63dd66f5ae8a343e660c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3a704c-495f-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1665491074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491074, "uuid": "da7a0d35-f32e-45f3-930c-1c5902fcc923", "comment": "Malware payload (GuLoader)", "value": "b614887db89d19f5de3170ecb25b78c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491074, "uuid": "5fc83bf5-b4f3-40ae-a758-e227e790351c", "comment": "Malware payload (GuLoader)", "value": "2489ed4ad13317146172de6a5c704cc6897ed228f10107c9ec90a7eb142cf84a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491074, "uuid": "e78502fe-6558-4071-9ddf-3c7b23b7e9c6", "comment": "Malware payload (GuLoader)", "value": "78a8c569f8cb39458ac2aef14273cc2a694297be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491074, "uuid": "ae922b6e-4c5a-4101-8cf2-10aadfc74f7f", "comment": "Malware payload (GuLoader)", "value": "7cb26aa3e4e1c6cbd54480721376741950a29c8f13ccdb6dccd7adec513dbf684f0654da6b3a5434f75606d422d7f839", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491074, "uuid": "8953e5fb-d781-4399-b89a-e18d2e570d87", "value": "T1A2052381EB40F6E6D86A22B0550F269AF75D962721A6D74BC3883F1B7C114B1C32B3D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491074, "uuid": "9dfc4abb-fda8-4501-8b3f-97f76df057bb", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491074, "uuid": "dcbed371-4fdf-4d21-840e-1cadea97466c", "value": "24576:QluaXxRwmh8BUlmLf2G0sdAPQjjNcMG96:AuQxRkBUQQGmEjGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665491074, "uuid": "ea78eee0-4c7b-42fe-b740-d096557d838a", "value": 837350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665491074, "uuid": "97101123-7d54-419f-bb69-e38fe73d0e08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491074, "uuid": "d30e7cae-6263-41c2-9e02-8d40d4d028b0", "value": "SecuriteInfo.com.NSIS.InjectorX-gen.25087.6320", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3691e6db-4955-11ed-9266-42010a9c0072", "comment": "Malware payload (DarkCloud)", "timestamp": 1665486585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665486585, "uuid": "321534a7-1bca-4f83-ae26-be57ebfbd860", "comment": "Malware payload (DarkCloud)", "value": "f0bad208504202c9e4bec79342d7e723", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665486585, "uuid": "cdf68eac-3fc6-4227-a58b-339cf66df16b", "comment": "Malware payload (DarkCloud)", "value": "2506f6b3fd9f7289c9cf4587b682c3f49c6365be7c8fc56559337e015cb7bca6", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665486585, "uuid": "52c49578-8815-4cef-8d98-5af72a36f577", "comment": "Malware payload (DarkCloud)", "value": "9a0b7d22e01ea051a3333d91e35ca28e6e244e7f", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665486585, "uuid": "206c3af4-6f48-4e37-a476-878d0daaee02", "comment": "Malware payload (DarkCloud)", "value": "456abb9fa12d8a72aba68ce3516262c3c413f4e563cdb15673ca2df4d1d37dbe423355e83de8f222d98193e1fd64fc53", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665486585, "uuid": "413a19dd-7851-40ce-99b4-e2946f95cec4", "value": "T11A65E27B2D964907D8143177D483D1B2E6EA7D5060E1D18B2EDF3E6FB8312BB950228A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665486585, "uuid": "9fc83df6-e152-4da8-a455-b8c511a0bb69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665486585, "uuid": "626507a6-5d2d-4633-87d2-4e744063a7ee", "value": "12288:oYg3UswP6tr1SlyHEJTb9cvfaSdE5k6k+zWKRAQSQy4AT7oRh:atxSSS0pMvk+zXAtQy4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665486585, "uuid": "097cbaec-c3ec-42fb-936b-c52fab72e1a6", "value": 1478656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665486585, "uuid": "5f644124-1d65-4c28-9dac-4f5cc95841a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665486585, "uuid": "d46b1715-f519-48c5-8642-0901b47f2406", "value": "TEKL\u0130F TALEP T\u00dcB\u0130TAK SAGE RFQ_xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9b81ba-4909-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665454218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665454218, "uuid": "772168b5-d1f2-4e95-bdab-8580dbe71407", "comment": "Malware payload (SnakeKeylogger)", "value": "cd449d581e3b7b4ec779160e7a1f9dd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665454218, "uuid": "9b685088-4fb7-4b42-a512-0d52bfc24c5c", "comment": "Malware payload (SnakeKeylogger)", "value": "25b5ccc7a10d92c004fab41bea29a9fd4842abb02b56a76b5dc5a1cdc7d25730", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665454218, "uuid": "83247ac8-ead8-4521-9e4f-1baca8868c1c", "comment": "Malware payload (SnakeKeylogger)", "value": "7c36cc759ade700f70a5dd698e32b0c3ced06b87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665454218, "uuid": "3ebfe1d6-42a1-4862-a3b0-1ce5e24c0b2d", "comment": "Malware payload (SnakeKeylogger)", "value": "aebfe53a50cd265fa92ed44a491ba064545f4f3ba40e821120bdfd318680da6737ee4ad97cc66090d938945361133ae0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665454218, "uuid": "e7e3e04e-e1f2-4f60-ad07-061d2fe50134", "value": "T1ECD47CAD762072DFC85BD4768EA81C74EAA274BB431F5213D02725AD9E1D897CF240F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665454218, "uuid": "0a5fe446-2b3b-4957-85c7-5b1080c190a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665454218, "uuid": "b8559566-f325-4351-8af2-5f503b2bf35a", "value": "12288:aBauu2iNaLTADqjJ5ni3GroKYbCiKezdoIar/nZD8UqQgdHtEBTZYIqd90lIvOZ+:aouu1QXjriWrbjiJdoIynZod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665454218, "uuid": "49eedafa-4a88-4a8b-8c41-ac25632cb7d1", "value": 629248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665454218, "uuid": "75f6be97-ac7f-41f4-b75d-4e4a6b3bfde4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665454218, "uuid": "b9980157-9abf-4b49-9013-863547c8ca41", "value": "PO-20210292.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db1291f8-4908-11ed-9266-42010a9c0072", "comment": "Malware payload (Nymaim)", "timestamp": 1665453790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665453790, "uuid": "6e3a0661-222f-49dd-b335-823d8c749919", "comment": "Malware payload (Nymaim)", "value": "7f7217a3f16da48f4b652588027b11ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665453790, "uuid": "f4325c0b-7144-40a4-b9b0-7bf1081feb1c", "comment": "Malware payload (Nymaim)", "value": "263ba408f31fea50114cf2564e43fa5149f5d2da732012830a3f05b3c5c64d37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665453790, "uuid": "58240f6b-de8c-4660-8715-88965e36810e", "comment": "Malware payload (Nymaim)", "value": "e83e85aed2e556a07414efacc4246d66d9cb304b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665453790, "uuid": "300b836f-605a-4590-a9b8-bdd52f8fde85", "comment": "Malware payload (Nymaim)", "value": "0e4eb5f4ceab5341c3d0239f59bc878591242964a50afa5731528edc4fa4893100c251a64139c0e5d75c1b2c779135fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665453790, "uuid": "1e8929f0-ddaf-401f-a229-a9ccee1bdee4", "value": "T14574E1223991C831E6263134CD75D6712BBFB8750536AB4B7BE807598F32791AE243C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665453790, "uuid": "20ab45bb-f68e-4b18-90fa-2ccdd5c60061", "value": "78ee95c35be8f9cbb7d14afcce7e80bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665453790, "uuid": "e0998cd6-e28c-4981-9cdf-49c6829b2728", "value": "6144:CseoqPXlLeGwybxxFGuITsVct5ghr7/7NTfu0BlYrqWsXgBJv1:tTqPXlzwGIl5e7/7NT/BS+Wsk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665453790, "uuid": "b19beda4-ec2e-4f8d-a25b-95c31389514c", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665453790, "uuid": "ff3b49d3-43a1-4976-a33a-bdf4bd90c318", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665453790, "uuid": "477006d6-73e1-44ee-9aaa-db92d753cc99", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78628ee4-4953-11ed-9266-42010a9c0072", "comment": "Malware payload (CryptOne)", "timestamp": 1665485836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665485836, "uuid": "aae5c40d-ab7e-439a-8200-971630ebe708", "comment": "Malware payload (CryptOne)", "value": "7af373f612f06bcd4a66251c89b50a6b", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665485836, "uuid": "d569a2ea-eb7f-4e42-923f-b613d98adbac", "comment": "Malware payload (CryptOne)", "value": "2709f083327060b896501645e3263462cf0e329645e41f6d4556276904c51856", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665485836, "uuid": "fcc75f65-bee6-4d94-86f1-e2df2079aef6", "comment": "Malware payload (CryptOne)", "value": "451f3abb1337686c210d047ca84f917b3e9b5490", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665485836, "uuid": "6f4a9b83-135f-434b-93b4-18ad8eb75ee7", "comment": "Malware payload (CryptOne)", "value": "101b51bbf28bdec5f5a8ccf61a8245170e3735a25e6e9a455e502ed4a547c969356be804f4b093d033a4548eb65bae4b", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665485836, "uuid": "0e905c86-4573-4d65-b694-c019c1007b75", "value": "T1D6A523027AD5D9F2D41519331A24EE11663DBD206F398ECF73897A9DDA319C08B307A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665485836, "uuid": "2be619c9-2243-4dba-8d0a-542203c65c6a", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665485836, "uuid": "bb63a5b6-4c89-4990-9082-18fe6596d298", "value": "49152:IBJJJugQ/RwSVbVRLbOA2gPUhLMz4qSJV:yxu/wSFVRXYEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665485836, "uuid": "a4fad851-3a56-4eb6-a37d-36c95dfb9597", "value": 2149502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665485836, "uuid": "664dbfa8-db43-4d16-baa5-0bad57e3f3ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665485836, "uuid": "85474b2c-57d0-47d4-9d45-c78a9aa7569a", "value": "2709f083327060b896501645e3263462cf0e329645e41f6d4556276904c51856", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79fcc750-4950-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1665484551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665484551, "uuid": "e7a715cd-32ab-4724-ad4f-66915ea538c2", "comment": "Malware payload (RedLineStealer)", "value": "817a98d559b90313ce8d0b2cf59cf741", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665484551, "uuid": "84805d67-3b0d-4bd2-87c7-9518836e508c", "comment": "Malware payload (RedLineStealer)", "value": "28ec33bde4c8bf9f90ea36ee63cf102bbf358ad97534de872af9f0e0f9d82913", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665484551, "uuid": "d01ec294-4106-4bc4-8367-2ecebe1273ca", "comment": "Malware payload (RedLineStealer)", "value": "a72401d072e5217bc9cf61b34e05565099cdc891", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665484551, "uuid": "149470da-8eb6-48df-b485-e1dede52f311", "comment": "Malware payload (RedLineStealer)", "value": "35db291596de812da5fae0d373e200329b9e1e6e0fab2bf7a27ead24b61e2a12984b837c9dfb7705e128058423e12712", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665484551, "uuid": "9d7acc1e-59cb-4c0d-bcb3-62aef8d40a09", "value": "T17994F01236E1C472D1A60E705425CBE16B7FB8726AB0545BF750675F2EB33C1AAB230B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665484551, "uuid": "98efed72-3916-4670-a8e0-571cea0807e2", "value": "c4c7b1618d255225412ba726d1a13551", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665484551, "uuid": "34840b27-106c-4107-a11f-7ad8924c06f3", "value": "6144:VmLFamMur+hnhysM/rxXB4BhgP3kg0bLw1g7gui6XveY7T0a7zb2igavwVfId:VmP6hnhysMt8sCLwK7+Kvoa7z/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665484551, "uuid": "978e83ea-a5da-4830-acfc-0e644b797404", "value": 442792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665484551, "uuid": "2db26063-b0bb-4953-ace0-ba65492e8e35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665484551, "uuid": "2339ccc4-d499-40f3-9153-cb1dfc720045", "value": "28ec33bde4c8bf9f90ea36ee63cf102bbf358ad97534de872af9f0e0f9d82913", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9881a5ff-495a-11ed-9266-42010a9c0072", "comment": "Malware payload (NominatusStorm)", "timestamp": 1665488897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665488897, "uuid": "a6a07b25-0e01-41c4-9a6d-e7a44f090427", "comment": "Malware payload (NominatusStorm)", "value": "cdcd4d589b1c396400c30649f7af1bce", "object_relation": "md5", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665488897, "uuid": "ac3a73c4-49c2-477c-90ad-28a372040c61", "comment": "Malware payload (NominatusStorm)", "value": "2922c3919c2f149354e2196dfabdea81c1dbb21cfa89931ae9c435e565cb6e8d", "object_relation": "sha256", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665488897, "uuid": "115d607d-386f-4f20-81eb-8c33fd47c1bb", "comment": "Malware payload (NominatusStorm)", "value": "9f1aab2e8133e71883c83fc1c30ef187a2f191cc", "object_relation": "sha1", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665488897, "uuid": "b48e151a-0e1e-4d57-be8e-ee32e760bdba", "comment": "Malware payload (NominatusStorm)", "value": "4579ac1f3ea61b595791349de3c21bc5e801eeb9f0946905e1c3d6f8de3f169ebe1ada0bdbb377742f2483057993116b", "object_relation": "sha3-384", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665488897, "uuid": "5e850051-764f-46fe-99c3-eab9f609ea5a", "value": "T10456C64DA382C669ED9D0D7087A5B6E42E39BC92FFD327DB15463A0F2C3B260801D957", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665488897, "uuid": "1ab1bf0f-40fd-484f-b4ab-92384b110aea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665488897, "uuid": "5c5f64a2-b0e3-4f8d-a922-b74c1191bee7", "value": "49152:tjLuSh3i+FtvkMzT+3HfOGlk2Ph0fhe+D6U6338WOqWOJhNtD93oHwcwEgZ3FFQD:tLu13/Jk2Ph05e+g3FU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665488897, "uuid": "a9bf8a6f-5e6d-400b-9ed4-5e0127652e93", "value": 6398776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665488897, "uuid": "0c791543-880d-401b-8493-bd4fbc87dc04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665488897, "uuid": "ca32631b-ba19-4426-91ab-6260139a6e9a", "value": "2922c3919c2f149354e2196dfabdea81c1dbb21cfa89931ae9c435e565cb6e8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e644664-494e-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1665483672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483672, "uuid": "c7146f8c-e533-4e80-a7f5-e4e774f0a176", "comment": "Malware payload (RedLineStealer)", "value": "ef15fb5c6efe17814d15546267f338a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483672, "uuid": "f4cb86cd-cf98-4253-8879-a5f18412f043", "comment": "Malware payload (RedLineStealer)", "value": "2993e96e6e46fff1d16f1e9a775693f0366a42c03c6ce43f0ca46d444caf2416", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483672, "uuid": "dc0303cb-521a-42b2-8861-0ae5f41bfa92", "comment": "Malware payload (RedLineStealer)", "value": "7fff101ead810f08b7a2c3b03052a0808d5c4e25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483672, "uuid": "c8c3db1c-1353-4746-a592-9a3a4627843f", "comment": "Malware payload (RedLineStealer)", "value": "d5bec2a7094880709c574b8375cf5e2cc9415288bf46bbf8a6986c2139c1c8211a1aba58e112093e5e0c5ebc5cdbc965", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483672, "uuid": "b98f2585-b8d0-4f0f-ac7b-afe6a7bb07a6", "value": "T1F394F11535A2D471D1A20E308869DBB16B7BBC32A474944FB764975F2EB33D09EB230B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483672, "uuid": "e582fec1-e438-411f-9fe8-dbe7f8d88616", "value": "2a1dd2daf6fcaa8405a3968231f4dd38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483672, "uuid": "a0ea5db7-99d0-4e04-aabf-d685c9ad4ec2", "value": "12288:0GL6Et02LFuYdi5GEuhD1IUF2yFGxTRf:0E6E5uYMoEkD1IUUyATR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665483672, "uuid": "a28c6d4a-dfd4-438a-9fff-71573b201e97", "value": 444592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665483672, "uuid": "fa8ed07f-a198-4ee3-9080-67606dfe1df1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483672, "uuid": "d2cfde07-09e9-49e0-8703-301d60267cda", "value": "2993e96e6e46fff1d16f1e9a775693f0366a42c03c6ce43f0ca46d444caf2416", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee9fcf8-4971-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1665498652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498652, "uuid": "f494efdc-2502-4e5c-bccc-c4963633c129", "comment": "Malware payload (ArkeiStealer)", "value": "5fd8c38657bb9393bb4736c880675223", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498652, "uuid": "ec3e42bb-ff8b-4f53-8d73-a9b3f5154727", "comment": "Malware payload (ArkeiStealer)", "value": "2a5101345def285c8f52ad39f00261ba9e0375d3de73206d0b8c72ce3b6259c6", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498652, "uuid": "1e90080c-79bb-4c43-9f23-47ea6880f9a9", "comment": "Malware payload (ArkeiStealer)", "value": "f3a03b2e75cef22262f6677e3832b6ad9327905c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498652, "uuid": "339dd679-3b43-4b38-b38f-686c1f4b2454", "comment": "Malware payload (ArkeiStealer)", "value": "2829eb90661e5fe7d3e703fda138bc560640a6ca6abfd00939e45e19be4158867301cb2e67cad27af51840612f3f7cbc", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498652, "uuid": "9b89ce14-4a24-41f0-8ff9-3a63f8e4aa76", "value": "T13564F11231C0C871E25225358EA5D7F9AFBBB8301A3996CB7FD9426C8F35692DE24347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498652, "uuid": "5b4da0c8-0c91-4ec1-8d7e-03daa5445599", "value": "59de72f24710a4ab3ca7e4fa2f0a3bf4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498652, "uuid": "26ff67e4-23f8-4a21-b712-1055d490b6c2", "value": "6144:NC2lhHLjmWe5JU6B8l1I2pXNOOQ6ALktxN5BMFBl:NLlVWWxZXI2pdZ2ex9GP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665498652, "uuid": "70ab84ad-698c-421d-b944-b834e070a54a", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665498652, "uuid": "b1024d12-9c76-45b6-a793-1c0d7013b577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498652, "uuid": "7537b9ef-8cc5-4cc4-a3f5-34d93360f28f", "value": "5fd8c38657bb9393bb4736c880675223.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff228f56-490d-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1665455998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665455998, "uuid": "37dfbc36-b46b-43ed-bce6-8f720ab271c9", "comment": "Malware payload (GCleaner)", "value": "725e97f0680f7a6f7c2af200c8846075", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665455998, "uuid": "48c0f6fb-fe9f-4698-bc87-60a77c568c1e", "comment": "Malware payload (GCleaner)", "value": "2a976d8cf92d113e8c56dd9a3db304d0b3c193373139de3f05627f6e0bb100a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665455998, "uuid": "affebc9f-4da2-4b62-869a-8da7f2cfcc13", "comment": "Malware payload (GCleaner)", "value": "7b75880bec8aae3a4e8cd34747f2d21fe6806298", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665455998, "uuid": "b5e4a1e5-9124-4ac7-9bb8-cef18c8412bf", "comment": "Malware payload (GCleaner)", "value": "f625f3e316204418e2683a5c06498399448ff218bc9684fccdf8263509d3c2bd13d7cdfef0952928db6b54759d91f8fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665455998, "uuid": "a168bd0a-69d1-4ac3-9cd9-9189c31b15d0", "value": "T1DF74F1223980C431DA666534CD75DB706F7BF87416205A8B7BE806AD8F356D29F31387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665455998, "uuid": "1e32e417-85a4-4bb0-8983-181662c106a2", "value": "78ee95c35be8f9cbb7d14afcce7e80bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665455998, "uuid": "b4d90300-1367-4352-8564-d3687bace474", "value": "6144:8JVdzLMEsecRYFE4BxNp8kQ3srVTnuNxm0buB5P:8JVdzTs3eE4Dbu+1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665455998, "uuid": "29b76bee-2dad-454f-ae55-79e803ad725f", "value": 348672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665455998, "uuid": "0dee24f0-6d2f-4ea1-9743-06aebb7a3d76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665455998, "uuid": "1081fbce-aa4d-458f-b4cd-246fda6ac2bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc424100-49a1-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665519478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665519478, "uuid": "7d417de1-3994-4fc2-bc50-8627c33e7e67", "comment": "Malware payload (SnakeKeylogger)", "value": "f71798b749f7b43d4674317d8f6121aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665519478, "uuid": "27afd823-c22e-4c3f-8f1a-b9a7c1c1f46c", "comment": "Malware payload (SnakeKeylogger)", "value": "2c1f0f9c197a419ea458a06bc1edd3bab8c80baa4f8bdadcfe8dbff6edb14fe8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665519478, "uuid": "9ccb3259-ed50-4c33-9734-2c40f8227fd6", "comment": "Malware payload (SnakeKeylogger)", "value": "0a29877b3e39e6c296f736d0404238b8e9d50bdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665519478, "uuid": "773c107f-f5a3-4156-9ea1-3324a21a8159", "comment": "Malware payload (SnakeKeylogger)", "value": "e40964642fa8f7d8e019d9a4c521c0ff662e0d76aa5b8e0465393fef02c79e6bc13ef348877dbeee50d8ba7c74fcfda2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665519478, "uuid": "0f512a93-4d9e-4485-9d20-a2e2c456e957", "value": "T114256B7E2A9A4907D8157131C487D1F32AFBAE506061D2CB6AD72F1FBC512BF950338A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665519478, "uuid": "8ee32ebf-68f5-45f9-87c1-3c8b1e93f4f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665519478, "uuid": "6dd4afa7-26ca-48c5-a37d-b96c3aa6a869", "value": "24576:MBHtJyTpMgeaUYm8JcF94ae9BXcud6AtQy4A:knyNMRaUle9PbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665519478, "uuid": "49ef3e46-da6e-4b90-b3a7-d8a509c6d547", "value": 1006592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665519478, "uuid": "20cd1bf7-684a-4c0a-82b6-c6ba0490b799", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665519478, "uuid": "2365bba6-d774-4306-a766-42fb314b4c06", "value": "Halkbank_Ekstre_20221011_08.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f12d7c-4933-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1665472065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472065, "uuid": "eaae01dc-0f17-4db9-96e0-115e76e40b5a", "comment": "Malware payload (Smoke Loader)", "value": "993a725b7bfebdf6ef321594358a766c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472065, "uuid": "5a1abe3c-89d8-4827-be36-4f7dba71b1fa", "comment": "Malware payload (Smoke Loader)", "value": "2c6be58c5b91dba2a4528cfbc9364a497128f2102ed062251be0153e3a3a10ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472065, "uuid": "c24224c8-fafa-4ead-aae6-5d480bd32aaf", "comment": "Malware payload (Smoke Loader)", "value": "0782d2dcbc4313ae7e38565068cc3af19a183506", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472065, "uuid": "f137cdbb-9e4e-4608-b6b0-10bc09c69783", "comment": "Malware payload (Smoke Loader)", "value": "6e96268f85acfd947ded2b01a728eacd32bab6218d2b4bd6e2d6f04d4d7f7e252e75a4b0219a3fa590091e408a28e03a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472065, "uuid": "666421f9-d869-41b9-999b-52d7daffebdc", "value": "T11F54CF25F682C8B1C4062170CD56DFA06BBEEC31197489873B6D3A6E6EB7280567731F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472065, "uuid": "6afe8663-86f7-461d-82d5-6acb7bcf72b3", "value": "335f6a3bc923ae5bc86b0cc6c8226b4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472065, "uuid": "8c803ddd-fecc-47f9-a241-f4cdfad9b946", "value": "3072:8RXdvZ+pesl1DJErMIjM5fpxUQ8gio42JkDqUmLjiZ3l/80FgxyRtNFM/h3qpZag:81RZ+pVl8Jj+D8Ie80FlFrwVfquS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665472065, "uuid": "7e6cad96-bd3a-4b0f-b05e-4f7e82ebb203", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665472065, "uuid": "438020a9-9e98-4d27-9baa-2930fb6ac4cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472065, "uuid": "4cac8103-910d-4e39-936e-3346865b4b00", "value": "993a725b7bfebdf6ef321594358a766c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c53e1133-4909-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665454183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665454183, "uuid": "851888be-2e9b-4c06-8844-1263ea7bc00d", "comment": "Malware payload (SnakeKeylogger)", "value": "1c63eaa7ec9deb93e8a467c00687758a", "object_relation": "md5", "Tag": [ { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665454183, "uuid": "83e98caf-d104-4755-88e2-d51d30790bba", "comment": "Malware payload (SnakeKeylogger)", "value": "2d022208300a8b34f09d411b1df4d51f245b2cd11beb492c53c969926b89a22c", "object_relation": "sha256", "Tag": [ { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665454183, "uuid": "05e23bde-a30d-4b81-bd38-e54ce8688b24", "comment": "Malware payload (SnakeKeylogger)", "value": "1e3f7208d13ca868a00fb7095a404e3274ede7e0", "object_relation": "sha1", "Tag": [ { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665454183, "uuid": "f30f6ac1-5bc9-49e8-a988-3b00deb08eba", "comment": "Malware payload (SnakeKeylogger)", "value": "a0f588b26139d61daeaa638dc3f819065bd8d1f212bb721672bfb8eec1d334d11cc72e51ddcfe1d1e9e6173dc5a7a9d8", "object_relation": "sha3-384", "Tag": [ { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665454183, "uuid": "751defe0-638e-4f14-9900-b4efcdd92292", "value": "T130B423271CC3D22448FC19877EC36DA16572E734F785A5AEB204AA20DCF6176BD9B903", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665454183, "uuid": "2b6c6e39-3c82-4f7d-bf0c-e8a83f4b746d", "value": "12288:LTZA5K1b99EfCtr5ktaeJO8i9f9rbYn1poo:LTG5KBMqkbk9r4j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665454183, "uuid": "490743bf-8489-4550-afc7-73ef8fb01e5e", "value": 513789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665454183, "uuid": "4ff112d3-1137-4c25-991e-d3dfb2c98750", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665454183, "uuid": "b89e22ba-935b-4abb-a139-c8674b348522", "value": "PO-20220292.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "837638c0-49ae-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665524939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524939, "uuid": "92787e80-28c5-4c0e-97d2-13cbf502e31d", "comment": "Malware payload", "value": "1d1b16ad4f17509da0e12afadd7323f2", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524939, "uuid": "0034b599-05ff-48c1-a168-08a7c362c188", "comment": "Malware payload", "value": "2e892b726af9c7088abe86a2452fd5d29a1fdf8be722b1e8b1ccde601f8c34b6", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524939, "uuid": "e9f64959-2e68-4569-8b6d-ca6f6f37b097", "comment": "Malware payload", "value": "aea760d1bd0c8226291e4f5e8e912ade30d18797", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524939, "uuid": "514f0859-f5e5-4566-ac0b-dd8fce789ca5", "comment": "Malware payload", "value": "03d075df155ab12ee30cdcca2c7b41b596a9772def28f164406729cf3dc63e29b0a8eb975f7c08caa7b91c920e44ae21", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524939, "uuid": "e9c73b3f-c860-42a9-8564-14d605db2c55", "value": "T13BF52317F275455AD8F6D33620B42635A17B8D28CB17AB8B7D54B7BA24B7ECC0B802C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524939, "uuid": "32f87487-dd02-41a2-886a-4ba012e8e3d6", "value": "98304:Jqm6efffnRcj7jGPJqo27nY9ItsLA62ME:JRXcXglEsR2ME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665524939, "uuid": "a1dd3898-71fc-4172-a656-3327d068f725", "value": 3634085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665524939, "uuid": "ca87ec83-db61-46ca-b340-75ed5a3b4f3a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524939, "uuid": "660a1fcf-5956-4426-899a-20d889d084a3", "value": "GameHubs.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca777fab-4945-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1665479961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665479961, "uuid": "ae37e01d-22ea-41c9-9258-1fff316770f7", "comment": "Malware payload (Smoke Loader)", "value": "e8e6932ae8fa8c76332a56d9177af9b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665479961, "uuid": "8b45f1b8-bea1-468b-9d72-5802d51d2405", "comment": "Malware payload (Smoke Loader)", "value": "2edcfd3e16ee0a6623d98f40913cdd67c5b74c78ddf538427735f9053c7026d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665479961, "uuid": "c4f0dfc5-9b5c-4676-a4b6-91e6ea43a767", "comment": "Malware payload (Smoke Loader)", "value": "8a6307b5e496e186fb6270b7eccdf848cc302aff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665479961, "uuid": "a2b6ee8f-7d89-4022-80ff-311517c2089d", "comment": "Malware payload (Smoke Loader)", "value": "c97819dc34108ee741862cd73ec745134358fd4515d29d2ed96e4a99b463962e808d2ad8b166d23ece4cb0756909da1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665479961, "uuid": "4049364e-2897-42b2-b3d4-3781afcec531", "value": "T1CD24CF3232D0C072D6661279CD65C6B16FBBB830197996CB7BC8066D4F352E2AE39347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665479961, "uuid": "f7ab742c-057c-460d-bc5c-64e154355a48", "value": "f07757163332cdbf737bafdb4614222c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665479961, "uuid": "2de79c88-90b7-4c23-a60e-a16fcb36bf3e", "value": "3072:1iEODVj0mYpSLYMDE/RFYpAPGQL29N85SVY9wEOt3BcKCs0O:1e+m0SLYMDEomS9N0AY9ZqcKCs0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665479961, "uuid": "658bc075-93bb-4f14-9184-0678b4eaedd6", "value": 215040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665479961, "uuid": "2b2d7e0a-1fba-4baf-865e-93fe7629842b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665479961, "uuid": "e62d3cfa-2650-43e2-aa91-f0d3328c9f43", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10e16ff2-4997-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665514869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665514869, "uuid": "b976dcf2-5101-4fcc-ba67-a108ae01291c", "comment": "Malware payload", "value": "9a455e8e71087fecd34f257d6d094025", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665514869, "uuid": "1d5cdb2b-0763-42fa-ac88-c67bc4b5ffb6", "comment": "Malware payload", "value": "307fd1b8be0207e0310b20815327a0e8ae33f6adb2b5abd1455e81b48225d53a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665514869, "uuid": "5457ef53-5b5d-4970-9bb0-88ba9d69572c", "comment": "Malware payload", "value": "12dd54547e8c76a4892f6cb674f9b29a97ac84cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665514869, "uuid": "32870960-1e8f-4938-9f41-06ef0e566826", "comment": "Malware payload", "value": "92d73dc55026f901dcbfce6c32ca78e0cbc8f4abf99f6c9e59a12c77751d9a121c6358fb51b8976dacded8f508b92499", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665514869, "uuid": "7e8574ab-975f-4371-ac64-d9fefae0ba1b", "value": "T18924BE223280D572E2621A358D65C6B06BFBFCB55A355BCB3BC8176D8F312D29E21703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665514869, "uuid": "c3ffd19f-d8bc-4301-b0a5-8f747b914d3d", "value": "47f3841b8380a704a9ff258e0444ec1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665514869, "uuid": "7c7df973-d011-4f1d-87ef-a57588169876", "value": "3072:OlGkPImZEZMnJLTIZcot8PotHnBw2UGWw5RbfCFssO:OABsJLT4ctQBYw/EH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665514869, "uuid": "817ef222-513a-4470-9c18-23302c862534", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665514869, "uuid": "58f44bdf-9bc8-4171-ae0c-81c2ad88c769", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665514869, "uuid": "36a35747-a4f8-4e7a-882b-de3f57bb8561", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5a02a2-4919-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1665460879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460879, "uuid": "887216da-81fd-48dc-858a-6cfb7bcecab8", "comment": "Malware payload (RecordBreaker)", "value": "e5030e9f23f13afb77009eaf92e5b1af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460879, "uuid": "21959b3f-45ec-4325-b0d5-06b541d5f206", "comment": "Malware payload (RecordBreaker)", "value": "31991c4e5167dd4f5a7a3a71fe0b09cc8cad51bb610057c18f1d58383c47f79a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460879, "uuid": "df3e6b20-9c70-4d7e-89db-4063dc4c9271", "comment": "Malware payload (RecordBreaker)", "value": "95b48e12a3f70a3c91225a7f3a8433479f5ec7c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460879, "uuid": "759d6bdb-dac4-4240-bb8b-d151b414ea0a", "comment": "Malware payload (RecordBreaker)", "value": "7e9e04c333e3779fec26b96337f7d2ccd545f08813bf5603db4efee8b0f7a3f308017a0612cbe2618ad218530920ec37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460879, "uuid": "f42ee921-e2d4-45e8-b799-bb442d9462ea", "value": "T14524D02235D0C4B2E21615B58C69D3B07BBBB8350A35578B3BC8476DAF323D29E26347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460879, "uuid": "9bb9f752-024a-4ff1-a1b4-07e7ac5a7693", "value": "78ee95c35be8f9cbb7d14afcce7e80bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460879, "uuid": "4a5ef852-369a-4762-9350-2fb7549c9305", "value": "3072:fr1o/X/DAeaheDLg+XmARG2L747d5dR8xiqscwesRXQdO:fB2NagLg+XmEEfqsOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665460879, "uuid": "2d893a90-d43a-4b24-ad7d-7311a676a05d", "value": 216576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665460879, "uuid": "dae6983a-0d4d-4adb-b1bb-7a02f419c219", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460879, "uuid": "9db6bfe8-6c48-406f-ba27-e22de6149299", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0545f5c2-4961-11ed-9266-42010a9c0072", "comment": "Malware payload (Nymaim)", "timestamp": 1665491656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491656, "uuid": "2fa9aafd-4e90-4e75-b2d9-098c8469ce24", "comment": "Malware payload (Nymaim)", "value": "b2a861f82ac08a477f4d0d979b7ab14d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491656, "uuid": "c5bcccc9-4b25-4d63-b559-0ef7ee2a502c", "comment": "Malware payload (Nymaim)", "value": "31d3989bd568a29e211f378c9812e51ac312d4b0be152a8b4e102204dda1fd7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491656, "uuid": "07296683-e3e4-41ba-9aff-e9df398a5393", "comment": "Malware payload (Nymaim)", "value": "3a894274686b1b3034f7b145449fd0b1a328a870", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491656, "uuid": "cb4561ca-b051-4f9d-b186-c2c4c97164e5", "comment": "Malware payload (Nymaim)", "value": "c57b5b8b8cb8b3ca2291eec4ad99bd5d5135af95b9ac743d13c0721d0aff5a6b206a006115a3acf08f0d2782ad468060", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491656, "uuid": "5b507593-2876-4866-beff-1d333f8f1427", "value": "T1B674F1213980C432E6667534CD62DA71ABBBFC71483657877FF816AC0F226E19E34386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491656, "uuid": "d95ca739-ecff-44e2-b763-9ec507011833", "value": "4db5fa00d6d53e828ab0bf90238303f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491656, "uuid": "6803226d-809a-46fe-ae56-e36533953663", "value": "6144:512KuJLqBKVeCaB0haTbCGATMElxPC7+eNI5+IxmD+xKTE:5gKuJAKACdYTbChMIxPCRq5+ND1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665491656, "uuid": "f308087e-f41d-4d2c-9ada-35b5cbc51332", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665491656, "uuid": "1b9818f5-9624-4521-8f41-cbb3ff973f74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491656, "uuid": "bcf6d57f-b1c8-48b6-9f00-af76073f348a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44418140-493f-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1665477159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477159, "uuid": "a3c9bcbf-eadd-4932-a433-f57fe3d943fb", "comment": "Malware payload (Loki)", "value": "1f662ef04a2a4b28cb0cfdf311c1ffa4", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477159, "uuid": "89c2311d-b5d6-4a08-8aee-88514e003c61", "comment": "Malware payload (Loki)", "value": "3206c068ae0567b5c7ae99f72dc3dd0829606d985f927b4af894e65e057d95f5", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477159, "uuid": "7045d848-8039-432e-936c-da99a6866af8", "comment": "Malware payload (Loki)", "value": "c290b8657660b5c9c79d963f8732cc7559124563", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477159, "uuid": "79762372-0cba-469e-a9aa-d6ac4df19426", "comment": "Malware payload (Loki)", "value": "96b26a40beb0048cb3ce4a21bda945a91d51cf92d5c63bf4b4702dd7cb964ccc4965979d50312a056a00f73da2bc29e8", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477159, "uuid": "1e7fc35c-91dd-4353-896d-c670692f0382", "value": "T1EAC3024EC8146893E37369350A8D1CC575D93C8F41087861E76CFF199AF5A844AD7B8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477159, "uuid": "e6774e6d-d829-411a-99d6-5c32c501a6fc", "value": "3072:Q1UmB+IZ0NqIpvPTDYxasDnSSV1zc7WvHnN966m7Zo:x00NqA3/qaCvbzc7WvHNQz9o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665477159, "uuid": "7a8e7071-5980-41f7-be2f-119c7a2b967d", "value": 119576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665477159, "uuid": "bb060d6c-e30f-49be-a392-59f1289e94e8", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477159, "uuid": "d089a5cc-b20e-40e6-97e4-744ea62a66a7", "value": "demmurage charges.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef721e0d-49ad-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665524691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524691, "uuid": "2c5e848a-976f-416b-b4fe-5b5ee12ed569", "comment": "Malware payload", "value": "240ac3a69d9f3e08ccfab7504938c901", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524691, "uuid": "ec147357-8e0b-4abf-b61b-dce948b58a4b", "comment": "Malware payload", "value": "322584ef6955358609275f73eb02d506c3221766946944acbd1f447390783d0d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524691, "uuid": "dbe13636-bf0f-41e8-941c-48cc5f263731", "comment": "Malware payload", "value": "47097c50629720374f1bc23861f8b36048927798", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524691, "uuid": "edbc540e-9f2f-43d9-841d-9e968796ac1a", "comment": "Malware payload", "value": "75096e9f53861a9124d1a017e916d85d8dd55eff24922eb3412a9c4153578f974b7fd9f9e1c8196fbbcaef2c473d9508", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524691, "uuid": "9225ca42-33bf-4742-872d-a368b6540e01", "value": "T11526BE1637D4C125C17F03354973D35822B2F8679E1386AB35A0B36E3E767D08D62ABA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524691, "uuid": "5132b78d-0098-403f-8b71-82d5b720dca7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524691, "uuid": "79959556-aa96-410a-a95e-2dc09b0462d9", "value": "49152:xjLuSh3i+FtvkMzT+tUHVmlF8mskG+Vghm7I2IV+tpBi97UFcBCnvtlg:5Lu1GHoF2SHpcBsPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665524691, "uuid": "9e93a597-add8-48cd-81f5-d0da7961ab94", "value": 4640000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665524691, "uuid": "62dbd779-16ae-4acb-9308-829079979476", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524691, "uuid": "ac2060f7-7c9d-4db8-9990-5a6ae4fd2728", "value": "322584ef6955358609275f73eb02d506c3221766946944acbd1f447390783d0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b010bec-4924-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1665465467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665465467, "uuid": "e65d1205-09fa-462b-9415-27da3fb18a9d", "comment": "Malware payload (AgentTesla)", "value": "dc0c7012a3e420216c2c5660aca2072d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665465467, "uuid": "a87764c6-30f3-4e59-9847-78f70d404323", "comment": "Malware payload (AgentTesla)", "value": "3260d0d2b375bd3ddd97daeb52a486aca9f36bf95807d78d2655f90c30233ea4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665465467, "uuid": "d7812019-f114-47f4-8241-6ed1ef0d25d5", "comment": "Malware payload (AgentTesla)", "value": "41904e2009ffe0509f9a6e96df6357a071e4a321", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665465467, "uuid": "7133ccbc-fdb8-47fc-b90d-36f6372cefd0", "comment": "Malware payload (AgentTesla)", "value": "9ba5a46f105b285076f76cef17ff1dbf7b4357140bdf2e8a715eec4e2aa098c63610fda6a4a2500927a1c34e93546751", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665465467, "uuid": "16c91f13-df78-4a78-b12f-94968e7efb98", "value": "T1C1E48CAD762075DFC857C4769EA81C74FAA234BB531B5213D06721AEAE4C897CF240F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665465467, "uuid": "66e225a7-c511-4aaa-8c76-481850519d31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665465467, "uuid": "126fc304-3a67-4d67-8640-19e864c40475", "value": "12288:jauu2iNaLthgO9NrkNVyL2Sbv2scLvJyT+zADqjJ5n6ejcNgdJ/YfnCxTc6YcGW8:euu1QUObr4VjSbviokjrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665465467, "uuid": "f4d83680-5da6-4ad1-bf89-5a64f330e1db", "value": 709120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665465467, "uuid": "7eb10c27-5c3f-4dbf-bd54-dcfc7316cc21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665465467, "uuid": "928ac782-20fd-490a-aa08-c133c9cf33fe", "value": "alex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ad316a-498b-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665510048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665510048, "uuid": "b735c61a-456d-4bc5-b38c-0e720b1a19e7", "comment": "Malware payload", "value": "a1e05e1c08a5431f316fd2a1f6303565", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665510048, "uuid": "379e49ef-2b45-4d4f-9d87-d38980d0eefa", "comment": "Malware payload", "value": "32785f9d2c68a42369b8eebfd5026be9d8565e78c147323e1fae0aebb25a4d31", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665510048, "uuid": "1bf448ce-465f-499b-88d7-2200220e7cf1", "comment": "Malware payload", "value": "48d627a675086e7ca4f4fb581522db429ecdb785", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665510048, "uuid": "338426d0-a25c-4b2a-8633-2ef0638c4942", "comment": "Malware payload", "value": "4423403007e65fa3cc28648e669cd357b0e4c2808051058f0fa3fb2569b02b7eba860a2336309fa4debb39f3e54c4303", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665510048, "uuid": "f7adaff9-a654-4931-ba68-ae591c2e3970", "value": "T11B35082263EC512CF0F70B36EE359655A976FCEEBD12E21F1091750E25B1B00CA6937A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665510048, "uuid": "0082a5de-49a7-4087-babe-46b7f5709972", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665510048, "uuid": "05181dfd-d310-4a72-b233-fe0370c1e4a6", "value": "24576:lKKKKKKKKKKKKKK+8iCeUhWxcYO04Xppc5fCH04IxV:ZverO04TYfCH04IH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665510048, "uuid": "6562ed94-9d0b-4130-aec1-32351e38fe0c", "value": 1106256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665510048, "uuid": "6a5c170e-f751-42f5-9777-6949a11101af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665510048, "uuid": "8b0a0b91-6a5d-4555-940a-742a501ec710", "value": "32785f9d2c68a42369b8eebfd5026be9d8565e78c147323e1fae0aebb25a4d31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f4037d-4940-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665477878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477878, "uuid": "951675d6-81a8-45a3-bfc5-86dcb2327f77", "comment": "Malware payload", "value": "a6ddee665ff836912ddad1bee1357f90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477878, "uuid": "cd2163ee-41c4-4162-a4a0-0c9773eec31d", "comment": "Malware payload", "value": "32b6e41a775a69c42b7d3f911b08d8369b235867a58c1cb4152dd6b33e1b04d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477878, "uuid": "6cf310db-543c-449c-9aac-db043fb81d16", "comment": "Malware payload", "value": "e178e3a5aef26575775ef6b5961c02da82b46d5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477878, "uuid": "4918e984-21d9-4785-ac68-74d73b4a94f8", "comment": "Malware payload", "value": "acb9facfd3420e1641d38d9c7d69d62590171674d26577b528746345d84101889b5008f7eadfe34c0456f50105176b2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477878, "uuid": "8891a1ae-dc02-423c-b7a1-7342a14291e7", "value": "T13495A94380A2E880E14DC2BC0A3FCC60D2AAEC00531B82091862002FAEE057E96881EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477878, "uuid": "660decd8-6452-4dad-b30b-3d46b4cedbe8", "value": "6:idqGVg3F+X323wW0J7YPHBIJewJFwv9QZ:etGSGAW0RYPwcFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665477878, "uuid": "649587e7-4d15-4459-897b-5d716a5415dd", "value": 1878528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665477878, "uuid": "554fe894-b748-4df3-871b-761b8c92124b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477878, "uuid": "b4cbf640-dcfb-4c7f-a045-6dfce39d4c65", "value": "Documents.xlsx.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ede4bf-492e-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665470127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470127, "uuid": "5eea6f27-2005-4b15-9920-c6d60aba3b8d", "comment": "Malware payload (SnakeKeylogger)", "value": "a41ce92f0873cc9ece9ddbddcecb7db6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470127, "uuid": "52199383-3b32-4e45-934e-e87dfca18e58", "comment": "Malware payload (SnakeKeylogger)", "value": "339e52d55e2c529203ebba9d668b1a696bae78622bdc316f14b303e3d3e92fb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470127, "uuid": "a87999ea-aeb2-4ba6-9ee6-56655e5cca3e", "comment": "Malware payload (SnakeKeylogger)", "value": "5e1a191263048d6629369ff2fd18d6291fa10907", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470127, "uuid": "7a070ac5-a6ad-45c3-bcc8-52f755fb8440", "comment": "Malware payload (SnakeKeylogger)", "value": "a9be9acec0f4ea971f870a19ea6a89d39eb4d69bc091ad7355924eb2e96907436700bc9b5a774a381597b17b0ddb1bfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470127, "uuid": "e0a634b1-dd37-421b-9f44-d83b5ca11bc2", "value": "T1D5359D213BA18A0AE416127599B2CFB06BE41D2C946DC3479FD57E6BB1FF3AE3D00446", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470127, "uuid": "01b3fd7f-ac25-4ec0-8eee-fdcd12e46724", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470127, "uuid": "1de0e7c1-839d-469b-a630-97e487afdefc", "value": "12288:P27Y13KRJhS2VQD4KIxMphJkkW5ym3Txo3Bwfy4CQMmv4ve4RYcJbezuy5VNqmiX:TFw24PwhJgjxZd/Mmv4ve4RBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665470127, "uuid": "fcbb49c6-c8cb-476f-8de8-49d3ab013450", "value": 1103360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665470127, "uuid": "a4fdaeb9-6499-42a3-93c0-39727375550e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470127, "uuid": "ad3fa962-abe8-436c-b869-3ee91ef65623", "value": "a41ce92f0873cc9ece9ddbddcecb7db6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ddc7dc-4936-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665473538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473538, "uuid": "d80060e7-8cfc-4220-a744-8287f4845cb9", "comment": "Malware payload (SnakeKeylogger)", "value": "9362a419bf22dae313dd2df2db1263c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473538, "uuid": "074524cf-6a81-4a0d-a3c2-2a12d772c29e", "comment": "Malware payload (SnakeKeylogger)", "value": "34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473538, "uuid": "f44d9429-d697-435e-bec5-9e82f00c273d", "comment": "Malware payload (SnakeKeylogger)", "value": "a35af9c1afc0d948d262ca090d94aee21550dec4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473538, "uuid": "8df231ce-7c46-482b-bf2a-b469d1dcb280", "comment": "Malware payload (SnakeKeylogger)", "value": "f785d7cf389b9864bfd5e2bda3139265bd385429a0d30fc09455fbfc860f9cb311210e65e9f0c8aa0eb714e9563ff575", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473538, "uuid": "aa426ba1-1281-4f0f-b0ce-b706c1c60c72", "value": "T10605F81835E6719DF477CAB58FD8BCFA995AF672131B61B7606303898B2ED42CE80071", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473538, "uuid": "db7318f6-16b2-4ebd-a7c8-2cfa14695694", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473538, "uuid": "2f1ea069-d829-42ac-8a46-002614336cba", "value": "12288:q2iNiUvIYoiZURkkyLjYdtUFADqjJ5nLG/2Ry6EB9fv9zuetSQoEnNwMXlH4qZBG:q18UQYHZI8YdOjrLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665473538, "uuid": "de9f11b4-225e-49d3-a607-55979869eb84", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665473538, "uuid": "912631d4-6d97-4cd3-8aa9-6c0627a08d99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473538, "uuid": "eb7d4a1c-4050-4414-af9d-7f459d9e29b0", "value": "34386c8bb9b1f66f769134bea8e66f8ba8043c83ef81815a3bc6be4c2c932eeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b436480-492e-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1665469842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469842, "uuid": "2bf0a2fd-6dff-4df1-b53a-76ece1afacc7", "comment": "Malware payload (Loki)", "value": "814839df471cdee37fff82ff60f2e446", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469842, "uuid": "95f01d36-b13e-41ea-b2df-7fc09e7ec522", "comment": "Malware payload (Loki)", "value": "3586599d4978f9857550a52a8397edd027afe7f2eafb4f66e4af98dcd0337d22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469842, "uuid": "29e32c3f-3bd0-498a-85ea-426cf04fcd11", "comment": "Malware payload (Loki)", "value": "898906fa07ad96f45675876f8f273642a939e670", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469842, "uuid": "f7215d46-c8f9-408c-9796-74d2249666d2", "comment": "Malware payload (Loki)", "value": "d26ce78341423e6e79017a47e89d5cb7ef356d457043b8e6d70cd0059ce3f85134c7e24410364dab4ec5718b02fb42b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469842, "uuid": "f8a3c9a3-f9bb-445f-bb4a-1556604fff8d", "value": "T12404010AA964C496E4B37AB65E2917F16BFEAE351115434F57307B8A3831283CE1E34E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469842, "uuid": "8a56dc6e-fd59-4fba-800b-f68223a790b5", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469842, "uuid": "f87cf6a0-97ea-4cd7-b45a-a7f3b040f26c", "value": "3072:J1NjcVVnLpPueTnbhnvAJLRMGvyt+ty2a0HoPxi5WSaRq3/MpHcw5bAE6wMiH1im:zNeZdTbB0NMGvty4IxoWSaRK0pHc6p6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665469842, "uuid": "7a7dec40-38ba-4dbc-b56f-b5a5d151fcd3", "value": 189021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665469842, "uuid": "0fe0f7b7-677e-41fe-ab57-c254415c8c9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469842, "uuid": "98b984a3-e421-4539-89aa-c4ac0a369bb9", "value": "Groupbooking.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e618e9-49b8-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665529346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665529346, "uuid": "ed2912f8-1d92-415f-a911-a533897486e9", "comment": "Malware payload", "value": "60f328bf2460cf260c2ac895fe31f3e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665529346, "uuid": "be5ed4a1-d6e7-4409-88f3-c57bdb612211", "comment": "Malware payload", "value": "35884b9f1d36bffa1aef1496eacd2a273f19500034409e92683cfcb069e6ce6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665529346, "uuid": "4b662c51-2114-4c47-9b8a-f5e8f88a6519", "comment": "Malware payload", "value": "013b6d01eef938be1d5755e1e00987b578b690b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665529346, "uuid": "91512e74-771c-47f0-a770-ed1a469e9f6b", "comment": "Malware payload", "value": "41aff7b2e982573d3f2234af6df14d1a228626c211d5c3b45d195485c93da03dfabfffac2753edc98e7ab97105b2e7c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665529346, "uuid": "05886b2b-e590-4b62-9428-63494c42deb0", "value": "T15276332139D08D72C20211B1B8765FE5B2F082BA1E765727B3B1055DCEBF9C88C66F66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665529346, "uuid": "3272263c-6c79-44fe-85d7-e6fd7b6e1329", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665529346, "uuid": "c0f3fe58-ec27-4679-80f9-8e6fcb7ccb4f", "value": "196608:91OJaTxHTKH114/dOJJ75Y8pC1QuHd1p3s/ZTU/:3OJOw2dO1YxO/q/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665529346, "uuid": "07fd3687-7b77-4714-9c75-34d5516770f5", "value": 7593374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665529346, "uuid": "bc75334d-0c53-409b-88e6-e44826f0dae6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665529346, "uuid": "8b35a0e8-6cc5-4584-aeb7-d9097f3cb77d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85e86e9f-4916-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665459660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459660, "uuid": "12637bcc-a124-45dc-885b-5a3ff6ab02b0", "comment": "Malware payload", "value": "5daeef0317a070fbfb1620894fd1e053", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459660, "uuid": "9e7861c3-154b-4a3b-a8da-80ce7b1d99dc", "comment": "Malware payload", "value": "35c16d0a77736ce65f5863ae919ea1a98cc707b18acff556c34a83f29c3dfdba", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459660, "uuid": "fa5ed399-2486-4717-86fb-f5a7668a52f5", "comment": "Malware payload", "value": "eca4f37a24b4948e319d232603f9f31a3cff757e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459660, "uuid": "d8dec102-4a6f-4f14-9b49-33b7b2854d30", "comment": "Malware payload", "value": "57d5d8d5a68f407a4bbcb5c7af85a2bfe8ccf225d95f1b1f411839f33bbdefa8b08a2710ee54ec83a301fa7b93703982", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459660, "uuid": "f39f679c-3315-4f13-9838-481f99c00c99", "value": "T16A636C46C2D50463E9A68DB2B0E39BC31BA0F20D4DE14AE7958CB01A4ECF315759BBDD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459660, "uuid": "4f1007f1-10ca-43d9-95da-9aedb780ce90", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459660, "uuid": "7eeb242e-d741-461e-9299-6c021828b3c7", "value": "1536:E149ULHmpga/eHUTQQQQQQQBdBgN6b5/2kWSC6WLrxtDvas:qtLGpga/eHUTQQQQQQkdBft/2YWLrxtf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665459660, "uuid": "f2a68e09-f5dc-4e3a-b9d3-3cf44310d0d4", "value": 69112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665459660, "uuid": "07392466-efee-4f59-9b5b-520fde7002a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459660, "uuid": "a0014600-ac24-47d0-bd2c-ff2ee770d1fd", "value": "SecuriteInfo.com.Trojan.MSIL.Inject.20247.8325", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d24d59-4941-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1665477959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477959, "uuid": "96e148ed-5fb7-4494-8681-119433af1a6d", "comment": "Malware payload (Formbook)", "value": "fca8329d1b2cb450f6fa8ed740c9cf9f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477959, "uuid": "da69375b-53a2-4cfb-a9ec-2f72a232aae8", "comment": "Malware payload (Formbook)", "value": "369bdbe8219c53b7a315cf4a34147cd3b9979206e86c6f8243bfbcbd24c20dd5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477959, "uuid": "f3cfba76-ed20-4456-979c-92ccc78ca691", "comment": "Malware payload (Formbook)", "value": "7ef2ace8a3b6e46f7fd6b155396219e4955b1bfa", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477959, "uuid": "373d5046-6be8-4d59-b8f6-73f8aa70f3f2", "comment": "Malware payload (Formbook)", "value": "7d1d15df8a66614d447362033547e718440f8758598c7c2a00160978c9722e788ac3630f009fd02a26533a7c9e573319", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477959, "uuid": "2153dd70-96a3-4923-9293-3c3da00032f1", "value": "T128353021B2777DC7532602B1828F9D46A3287E47B35A1E94E01EEEF82DE4475A341F4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477959, "uuid": "d014afff-f656-43d0-8dff-9899a7f3db91", "value": "1536:KJ/pGEch6dtRGWbCtpl5kmrJ//RFxXxBpzB9TBtiBqK8Qf6YXkY0kY0kY92i3e+b:8Hf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665477959, "uuid": "4b60d8d2-3b9d-43ae-b322-02a810c6ee7f", "value": 1112268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665477959, "uuid": "03e403c8-bcf0-49e7-b699-ccbf3d22085a", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477959, "uuid": "ddc98ad6-feb2-4293-a68d-6a937bf9b489", "value": "RFQ# BCG-ASB- 18092K22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62610eec-4918-11ed-9266-42010a9c0072", "comment": "Malware payload (NominatusStorm)", "timestamp": 1665460459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460459, "uuid": "9f27746c-45c4-484a-81ab-10ac6a76374e", "comment": "Malware payload (NominatusStorm)", "value": "34f569e9577f57ba40d95082fb440fc6", "object_relation": "md5", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460459, "uuid": "3ddf3975-5300-460b-aa27-42a7772903f3", "comment": "Malware payload (NominatusStorm)", "value": "36b14086738fe7c98f7ce2f82bd83ec49e4a8d1b0211cfb440cc89e89775f426", "object_relation": "sha256", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460459, "uuid": "79baaa11-ddf9-4d7f-949f-ce7c59f25093", "comment": "Malware payload (NominatusStorm)", "value": "bfd227d21017e551e53bf475a829d49d633c761a", "object_relation": "sha1", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460459, "uuid": "b84bbbc6-b2d0-4bd4-bf0a-4aec07d925bc", "comment": "Malware payload (NominatusStorm)", "value": "b6b28eac60a30e855b39ee650b7473acb36fbae28917baa8ed94e64e4f1753fd4c62d0809576c97f8e71b2cb7bdf323e", "object_relation": "sha3-384", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460459, "uuid": "dd510c9b-2f35-4345-bb7e-ed3765ea0caa", "value": "T1BCC43919BAF0C032D17F42354D76D3486271F4A38C2746AB75DCA31D6F712918EA2BBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460459, "uuid": "1698d9f7-9b8c-477f-94bb-7590040c45de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460459, "uuid": "4d76cf51-b64b-4ca3-8bb4-6817b4396bc8", "value": "12288:lKKKKKKKKKKKKuC0i1esXq4cQmmTsG0OzSDWeVJv:lKKKKKKKKKKKKsxr4cQFTj0OZeVJv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665460459, "uuid": "61cd48c1-5228-4792-a5e6-94f103bb1eef", "value": 549392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665460459, "uuid": "3d608376-ee54-4fe1-ad15-877bfda5f3a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460459, "uuid": "bc090bfa-dc05-43f9-94c5-16f3b3e78159", "value": "36b14086738fe7c98f7ce2f82bd83ec49e4a8d1b0211cfb440cc89e89775f426", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8172470-4967-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1665494614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665494614, "uuid": "e9d6545c-f1a4-4954-9ac2-eb2057643587", "comment": "Malware payload (AgentTesla)", "value": "a98b08f74cfb240f0c4cb8784b49efbc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665494614, "uuid": "891cf04b-9ce8-429f-9b0c-7c3420a5e045", "comment": "Malware payload (AgentTesla)", "value": "36b2df9c23ea0ea0d3d223c8a77d99a9eeb66691ff0050d2a10a96d81c60d03d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665494614, "uuid": "e05a913c-0bce-4aa0-bf53-918c08a9d0bc", "comment": "Malware payload (AgentTesla)", "value": "510816912e137eec7b1862c3c474ae65ad5f7a2e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665494614, "uuid": "f714d40e-8156-4152-b6d4-43c26da4752a", "comment": "Malware payload (AgentTesla)", "value": "e20fbf81312e91fa34ac5aa9f65cbf1321e5dbfa7ff7f6bea6bf7b4c92196dfb93f969e86cd3dc039624432ccef78065", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665494614, "uuid": "86fc214c-0a6a-42be-9a86-e100b28c5c5e", "value": "T114F10816FBF88233DE7B0B3A2CB343800A75F2529857CB9F88C5246F5E533504A52B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665494614, "uuid": "28dddbc3-c66f-48ae-8c44-c3ae2e402aa1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665494614, "uuid": "80f68638-c7b6-4e06-a901-cb0d127fef2d", "value": "96:VuwgRWGwSnMc/mBDKz8/cVOLN1R+2zV6ZCqheLh3LPGXpKoGY9FxCrzNt:wxAcxEckLN1RJV6MWeLhL+539Ct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665494614, "uuid": "af5ee2f9-8ed1-40de-994d-31219d84365a", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665494614, "uuid": "1878669b-fc95-461a-971e-af7309f231e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665494614, "uuid": "ae0a2966-c8bc-4168-9672-b30b456af72c", "value": "Pedido PO-4093021b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d9a0fe4-4971-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1665498650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498650, "uuid": "0b312421-c329-43ca-9f68-db975d1736d4", "comment": "Malware payload (Smoke Loader)", "value": "5189cc656edc95e4273fb571bcf92c51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498650, "uuid": "9fed51dc-2866-46e2-b84e-84a269591f61", "comment": "Malware payload (Smoke Loader)", "value": "36d7bb161c8eeb810884cb1e50f8b770af1696f10202e3af249864c2f91db2a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498650, "uuid": "262344be-241e-42a1-b2a5-f755ad39ef07", "comment": "Malware payload (Smoke Loader)", "value": "a7053cddea0c08cdd89a8900ad97467ba48a78ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498650, "uuid": "57eed173-6aa3-45fa-a286-0d2d6daaa59d", "comment": "Malware payload (Smoke Loader)", "value": "61e43d2e37f1cf716036fd678ef88554bbdb9e485bfc654683ebfb3a8901bdff784ad649392f09bdd0c38e2c7974caf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498650, "uuid": "abf48042-7b81-4b31-9360-6cbe2ba5f030", "value": "T17724CF1235D0C073D25612798C69EBB5ABBBF8714A355B8B7FD8426D4F363D29E2030A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498650, "uuid": "837dbfd3-75a4-43a7-b8d4-71059ade40f6", "value": "4db5fa00d6d53e828ab0bf90238303f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498650, "uuid": "f4490e0f-95b3-402f-b9d3-e26813a64ff7", "value": "3072:Msj18fhQVNYV7Lw1vkGt8hTpTCZUVHEEyjzWIzer/O:MSUBNLw1vkZTpGEE7jzWIzez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665498650, "uuid": "242e1696-b313-4de6-b6d7-5634cebaafeb", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665498650, "uuid": "96a2e364-4f8b-4a2d-b10c-3f50625c539a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498650, "uuid": "ac2d0b6c-b257-4cae-9ea0-589e0f4953be", "value": "5189cc656edc95e4273fb571bcf92c51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87aa1f33-496f-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1665497888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665497888, "uuid": "6c874a4d-60cc-45dc-a83b-1e3f8acead5e", "comment": "Malware payload (AgentTesla)", "value": "3c376cc6d362ab9a941478241250f1ff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665497888, "uuid": "ee9bbd83-910f-407d-babc-cb70f512ae45", "comment": "Malware payload (AgentTesla)", "value": "37b4d94a45d2b219e534d24c47fb425415096e31b23c412caa79783a53ba37c7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665497888, "uuid": "026e9dae-6fb1-4320-b383-e118babe1c1e", "comment": "Malware payload (AgentTesla)", "value": "b6cb95becd8f1bcae613a2e246882295ac52683a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665497888, "uuid": "cc02c141-8b68-4a6f-b2c4-075ddcb28a71", "comment": "Malware payload (AgentTesla)", "value": "41fa02b3d6cca1da3168a3c02f18df55c30d9d40441e7622922ce648329b7741956c376603886a7ffcbd343ea885dc74", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665497888, "uuid": "c29bb309-5552-4aa0-bc83-4e47d81625dd", "value": "T10AE48DAD762075DFC85BD0768EA82C74FA5278BB431B5613E06721AD9E1C987CF240F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665497888, "uuid": "3d76edda-5829-458e-96b6-d88fc3e0208f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665497888, "uuid": "1dca2049-2fec-4a33-ab2c-33cb32b65648", "value": "12288:3fuvwWauu2iNaLsnKf3N3WzO11dNYaJHu1dDMemQxc6qbWADqjJ5nQca4SgaHag5:ywBuu1QoK/D1ZGFMKc6qbYjrba4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665497888, "uuid": "0db84b82-3192-436f-a55f-73af6acf1a9c", "value": 691200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665497888, "uuid": "412db940-a656-428b-b4c9-d3fd529b6a18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665497888, "uuid": "7b701120-1ebc-49b8-ae55-0e7b9799cd03", "value": "PAYMENT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd9cce69-492d-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1665469685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469685, "uuid": "76df3529-864b-4767-b553-53a1e5e33977", "comment": "Malware payload (Mirai)", "value": "f8526bc8b2375e440f7f54ec219c67fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469685, "uuid": "10491ead-cab8-45fc-a1c3-5735ebcf0583", "comment": "Malware payload (Mirai)", "value": "37ef032539e6cdbd30c12264e5f2fb70f438f2439d3ef2c846be9f6d8881d44e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469685, "uuid": "31a5c56a-46e6-4024-b9c7-0e0ab858c5a0", "comment": "Malware payload (Mirai)", "value": "c602d7d253310e5d09b2f399c58a9ddd24ca2f59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469685, "uuid": "9b30e69e-58ac-47a1-8d99-05ce0dcf0281", "comment": "Malware payload (Mirai)", "value": "6b093d6a0711599bc8d3e2d854c2d88c698f9d9c56cbb64895df1b5cf52ce8bd07fc7824b2e51d83515389cd084454be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469685, "uuid": "ea2bfae1-4ad8-4d8f-8d1a-05e854880664", "value": "T1F2539EB9C4E8ED98C6684578B714C93DD723940465D33DFAEB46CAA6800BEEDF0097B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469685, "uuid": "08bf0103-d136-4169-a7d0-d463dbf01f46", "value": "1536:FaG/kMsvJvMwtlg2bOSsHraOxy/Cfs32j/JQZI1qhC8Oa:FzsMSk12yraORf+uWZIYhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665469685, "uuid": "f1772e08-deef-46f3-be39-bbee97b53eca", "value": 66368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665469685, "uuid": "964e8e96-208f-4b49-85a9-bc46e7d110d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469685, "uuid": "b79de9cb-f117-4706-b4df-2500d93de331", "value": "f8526bc8b2375e440f7f54ec219c67fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08216853-4915-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1665459019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459019, "uuid": "4f65c260-3dd0-4f1e-bb58-e3baa487fb67", "comment": "Malware payload (Smoke Loader)", "value": "6b60aab71f4ac8420abaaed17cbf6f39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459019, "uuid": "98308b55-83a1-4dfa-b97d-a6a4d999c5d6", "comment": "Malware payload (Smoke Loader)", "value": "383f424d25e95e6d1b0b903ff48c8634e00cf27b864a7319c45fe9f04495d76e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459019, "uuid": "c42feb2b-15d1-4d97-87fb-556cc314becd", "comment": "Malware payload (Smoke Loader)", "value": "63975ba96ab74f28b1b747d68793fcbeda589998", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459019, "uuid": "e0e91882-84c6-4923-a12c-82e822124f14", "comment": "Malware payload (Smoke Loader)", "value": "d8c33062a915e2df48a8ccee2621095a5d2d6fd4633cdc8495401255de0c634b4ead764e9f52b79df52f4294f6ec909e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459019, "uuid": "ecb77294-0164-415f-a72a-0aa65e45fd65", "value": "T1C624D02236D0C476E26652358C65C2B16FBBBC741A75968B7BC8066D8F363D3DE28343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459019, "uuid": "c8fbb9b1-0396-41bc-b26b-c791c4fc174a", "value": "78ee95c35be8f9cbb7d14afcce7e80bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459019, "uuid": "384b6ad2-28e6-4a7d-80d3-a8f69d61534d", "value": "3072:x/Iio/XH3AH0az7L6Q7v/RGfEYe24JMW1/iBIfo0Gktfid9mlcSmlscxtnwO:xQi2rUL6Q7vMuJ4Cfo0zm9SOlsc/nw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665459019, "uuid": "f13a5854-6ff2-441d-88ff-5d3e5fe0b2d8", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665459019, "uuid": "d5c46fdb-88c1-4860-b2c5-ba299eabf1b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459019, "uuid": "fc3dad0c-2685-42af-abe5-0355c8757443", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9698654a-495a-11ed-9266-42010a9c0072", "comment": "Malware payload (NominatusStorm)", "timestamp": 1665488894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665488894, "uuid": "a255d7a0-9a24-4e44-9a9e-5fecb0f2f17a", "comment": "Malware payload (NominatusStorm)", "value": "e7e7ab452ebb1d7e853ae9b37597817c", "object_relation": "md5", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665488894, "uuid": "7f0aaafc-2acd-4025-9a0c-a5296e8833f4", "comment": "Malware payload (NominatusStorm)", "value": "388e3f77fe86bede3836dc02240ff66f106e6e53dae66390f509cb8072ddb5c1", "object_relation": "sha256", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665488894, "uuid": "435e3245-e150-4e1f-b711-59a79a80e102", "comment": "Malware payload (NominatusStorm)", "value": "a46c6e0b7b2034e8f03ca2ebc1af9efc30c04f59", "object_relation": "sha1", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665488894, "uuid": "a06dd320-799a-4430-98b0-d1822dad3705", "comment": "Malware payload (NominatusStorm)", "value": "99026bbea1560dca32934e4f29a110ad94bc95767d8f63bf0cddd30a163d3df8b66facd40b382e15cec3b14112036ac3", "object_relation": "sha3-384", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665488894, "uuid": "c2f5ca2b-5434-4908-9ee3-ff237760f55e", "value": "T16CE56A1273F44524F1BBAB305DB593502676FCA29D7AC78F3298911E9E21A80CE75B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665488894, "uuid": "6ed37bda-821f-429a-84bf-65803d403aea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665488894, "uuid": "666faf25-e6b3-4774-ac22-6946ec636995", "value": "24576:lKKKKKKKKKKKKKKKKKKKKsxr4cQFTj0OZeVJRnHDyIzkNi1JLjkpa+WlnwQwDiRz:GqcQFTIOZexuID1JG02iNefu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665488894, "uuid": "60534a0f-e07e-4b13-9181-1bfcd7e2dd97", "value": 3141952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665488894, "uuid": "912b3751-f066-435b-b906-356bd80f97c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665488894, "uuid": "4a6f08fb-caab-40f4-95a8-cece19d84eb9", "value": "388e3f77fe86bede3836dc02240ff66f106e6e53dae66390f509cb8072ddb5c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "242ac234-4935-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1665472810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472810, "uuid": "f2f93530-a7cf-438c-b740-9a094a46f8d4", "comment": "Malware payload (Formbook)", "value": "64a82fe55902634f54da4c995fa5c37c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472810, "uuid": "7dfc91af-c136-4f6a-bd81-570308112862", "comment": "Malware payload (Formbook)", "value": "3c11fa854cd456fac1f3719d3954bcfc4657437defd8d73f234b16805d121897", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472810, "uuid": "5a95ed3b-7f6b-44b2-8d69-04fc571b3158", "comment": "Malware payload (Formbook)", "value": "108ff32ee2790d5597bcd1abb47478a281b302f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472810, "uuid": "7f58b8cb-310d-4b81-899d-dedc19454271", "comment": "Malware payload (Formbook)", "value": "96e320120899df02c72a2972c096c4f17c73f7c645e47d1ae4a6e3b942abd92fcef84478f9bc883ea1f4c85f3f5e024c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472810, "uuid": "d2c13764-a8b6-4105-a3b2-09a72febe3ef", "value": "T1DDA4E102BEC188B2D4B32D361A796721A93D79301FA5CEDFA3D40A5DDA716C0D6317B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472810, "uuid": "730a5758-8abe-46f0-94a6-bc8994bf569b", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472810, "uuid": "da7427de-d8b1-4822-bb24-310b962ebd8a", "value": "12288:lToPWBv/cpGrU3y8tGQ++Ya0thd/wZxg1t:lTbBv5rUlG+Y5hd/wZiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665472810, "uuid": "5c9aca13-ef0e-439a-8747-9f1b6d09d1e8", "value": 485632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665472810, "uuid": "914236c0-78ab-4974-9cbf-3f40ee93e33a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472810, "uuid": "b89e472e-13a3-498e-9cc5-e13fbad3b115", "value": "3c11fa854cd456fac1f3719d3954bcfc4657437defd8d73f234b16805d121897", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e29d538f-494e-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1665483867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483867, "uuid": "fcbd0705-09b6-4bec-8de6-33ff891e100f", "comment": "Malware payload (AgentTesla)", "value": "59e3bfa55654fcf1cde7ff667aa3ab16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483867, "uuid": "e27e36df-71f4-4161-b361-3f3622b3aae4", "comment": "Malware payload (AgentTesla)", "value": "3c7b2f564044dbb6077904cd30071f38510ccc1efe61ec46e9fd83688d28dc0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483867, "uuid": "809be58b-31c3-4a54-902f-fb2916d5068f", "comment": "Malware payload (AgentTesla)", "value": "011e4d87f3d5182a27e7d69b117ff63ba6291fac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483867, "uuid": "b0b4b8d9-7827-4c45-96c1-8f8922f49ae8", "comment": "Malware payload (AgentTesla)", "value": "bb220ffddc3e1bbc3d63ebbeab4739051e55fc56abc6f531b212602c2b7c1233ed0ed30117c6d59d22b531064af5c345", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483867, "uuid": "51b61aa0-3468-4187-bba2-8c06bbe50be6", "value": "T164E48DAD761075DFC86BC4768EA81C74FAA234BB531B5217D06326AD9E0C887DF640F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483867, "uuid": "a70a3fe9-e951-49f5-8352-5f438d1223b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483867, "uuid": "3f50f9e8-e18d-46b5-a7a5-23652d045892", "value": "12288:x2lwauu2iNaLYADqjJ5nD6+A/vVINehO2VFXjjq4G8aRZ+d/k/rMcQUDakGmysoC:I9uu1Q2jrD6+QNINodjqjc/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665483867, "uuid": "95537a63-4097-451f-96f1-7d15a7036209", "value": 722432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665483867, "uuid": "2eb3ec38-c52a-486c-baff-2ddf49e87229", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483867, "uuid": "1e40b762-bd86-49e4-8f3f-2b26dca20c5f", "value": "59e3bfa55654fcf1cde7ff667aa3ab16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaad3654-493a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665475291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475291, "uuid": "0b63050d-4a2c-4d0e-8240-d3222b310571", "comment": "Malware payload", "value": "c3ea7a9142acb253b47927829730b1d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475291, "uuid": "4cc2a723-e677-47bf-bbd9-c08368edb362", "comment": "Malware payload", "value": "3d74ef58c00334e3ec44b26fabbf548c1879d4fcb3264c3fedd83129384f58d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475291, "uuid": "45f60e92-80f3-491e-b74e-5ab5b3286d98", "comment": "Malware payload", "value": "0c81ce34ba68e0e4cb4cce5288b0203962497d7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475291, "uuid": "780a5a97-a9c7-40f5-9552-ee38716ec822", "comment": "Malware payload", "value": "b3b5c6339dbca657cfa313fd91cfa812ea7f84b79aca0eacbaa09e7bfc220b37fac978338c281f705c87e45b61e5c280", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475291, "uuid": "3410e64f-38d1-4988-99a7-61e1707a122c", "value": "T166763329BCE0CC77D2183631DBCC3FF661E1C9148212696367418A7D6FBE221F6617A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475291, "uuid": "bd816551-5e2c-4cc5-859d-6eadd706b649", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475291, "uuid": "5cec4ff6-7a9d-46ab-81fc-ad13561e5550", "value": "196608:91Oqi714jmB48iWcpfES/HkRj+1O6UUBiGp:3OWjmB4xZpTEN+w8iGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665475291, "uuid": "6366d85d-d66f-4567-875e-17eac7b3e72b", "value": 7583897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665475291, "uuid": "99444cc6-ff09-4c14-9fb1-bc0612f54317", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475291, "uuid": "8b1b1af9-d245-46d6-be52-ad6a1138fdd2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bbd15b5-4940-11ed-9266-42010a9c0072", "comment": "Malware payload (AZORult)", "timestamp": 1665477708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477708, "uuid": "d899acfc-545b-40e5-b1d1-38b7f6ef7a1a", "comment": "Malware payload (AZORult)", "value": "3bc0908fd9c9459b268ff37e053ee8cd", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477708, "uuid": "2a767add-b95a-4b7e-9fb9-b95a8645f1e8", "comment": "Malware payload (AZORult)", "value": "3d80dc41c5833d53f59c27dc7a35bf9f05849e74701eb64567252152454c2676", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477708, "uuid": "39795858-f0e6-4482-8d86-a39143d5cd51", "comment": "Malware payload (AZORult)", "value": "eef10947db904d94a29a0ec1f3fddfc12c4dae8b", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477708, "uuid": "5c3fd0b1-2e7d-4ab9-9e65-70e0b41175da", "comment": "Malware payload (AZORult)", "value": "eeed472ed6fb78ec1b7e22bad75804773507082b66ab9dde4c3f1efcd55327737b60c7212ed8fa522111c00bafe28d9f", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477708, "uuid": "d7992f95-9c0d-4d6b-b302-426d54d8e7e8", "value": "T11C937D43C6D11813DD6A9A7270E28A871B70F24A6DD186E7919CE01D0FCF38276DE6ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477708, "uuid": "51dc6eca-dcc3-4232-8a6a-94f867bc79e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477708, "uuid": "781314b2-e3c6-4a1e-b856-498e6dfb4ff5", "value": "1536:8CknHJa9Knpga/eHUTQQQQQQQBdBgN6b5/2kWSC6WLrFhDvahDvas:8CknHU9Knpga/eHUTQQQQQQkdBft/2Y7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665477708, "uuid": "6065ada3-ae61-482d-8338-6ed5c5a55118", "value": 93888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665477708, "uuid": "58341791-469b-4a5a-b5c5-25fc1e1e4824", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477708, "uuid": "365e9891-aa66-44ce-b18b-487b7356181a", "value": "AWB DHL782049 Documento de recepci\u00f3n de octubre,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d48fc1b5-4918-11ed-9266-42010a9c0072", "comment": "Malware payload (WannaCry)", "timestamp": 1665460651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460651, "uuid": "d26dde1e-860a-42a1-bcc2-8ba6ae2885c6", "comment": "Malware payload (WannaCry)", "value": "cc5d020e8b62e7270fe9a144634215b3", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460651, "uuid": "f68fc9bd-b1b8-4187-b6ac-8c6a3da2ebb7", "comment": "Malware payload (WannaCry)", "value": "3dd24cb0c8eda1e40a44ac92de5e1fed2977774a75462c2bbb1f89590f45e7c2", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460651, "uuid": "acca8f93-6d8a-478f-85c2-fec8c0dfa6f0", "comment": "Malware payload (WannaCry)", "value": "c7a7317df6c7a5656d0935f88c7da319ca59103c", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460651, "uuid": "6be6f84f-f524-48a1-a857-0c9c7d742019", "comment": "Malware payload (WannaCry)", "value": "13aa22adaf4abadda84bfd34832866d087229723da80e727b2d70b897d63bd8dee19420721d098654d6459d4fd251a5f", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460651, "uuid": "01e05a79-cc17-4785-b5fd-a71521beeaa2", "value": "T1A5F533E49531B7ACF1940EF950AAC99B378724A5EAEB1F66D6C041AB5C44F9F8FC00C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460651, "uuid": "2a8f9b68-e2a8-425f-a17a-bd2811dcc118", "value": "68f013d7437aa653a8a98a05807afeb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460651, "uuid": "e8225485-9966-43da-a2ea-54d58579a8fe", "value": "98304:QqPoBhz1aRxcSUDk36SAEdhvX593R8yAVp2Hj:QqPe1Cxcxk3ZAErzR8yc4Hj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665460651, "uuid": "5ad533c6-ae0b-470f-8d84-523b0d1b803a", "value": 3514368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665460651, "uuid": "6632b37b-e771-4da1-bb74-65412aeeb2e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460651, "uuid": "ee8d1ca8-c3ec-4cf1-93af-005cc0dfabd7", "value": "3dd24cb0c8eda1e40a44ac92de5e1fed2977774a75462c2bbb1f89590f45e7c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2277af6f-4969-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1665495141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665495141, "uuid": "49377261-42b8-4f73-983e-db712169bc00", "comment": "Malware payload (Smoke Loader)", "value": "08c928863010d4c695db258085871584", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665495141, "uuid": "88903e5a-2702-4088-9620-cd7d533c78dc", "comment": "Malware payload (Smoke Loader)", "value": "3dd4de6be777f09de0c723e5bc9b433c94751799229e504bfd4322f00270dc5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665495141, "uuid": "ef14000b-f8e8-4ee1-8a6c-c0ce26d184dc", "comment": "Malware payload (Smoke Loader)", "value": "1b263953042aa54f20e75546b1f3b25b4029858b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665495141, "uuid": "407f6906-c6d5-48c7-b3a1-c81e6cfdd9bc", "comment": "Malware payload (Smoke Loader)", "value": "0a25b2252f951a17c141bd01f6ab194e7e20f90a2ab89ef56ca14f61acbb7529db36e00195064c6f5bdcc08f89476dfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665495141, "uuid": "43192a2a-f026-406c-b01d-69110a4fb727", "value": "T10724D0123580C8B2D2A352748C65D7B17BBBF8311637978B7BC8066DAF353D2AE25346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665495141, "uuid": "8ac9a888-87ee-4f01-9ce9-4cec82e75803", "value": "4db5fa00d6d53e828ab0bf90238303f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665495141, "uuid": "19cf8e05-ceb2-4b10-bf14-cceaa205082d", "value": "3072:+sjk8fdsVCtGLgitjyt8sOJfyrfpMFt+zFv+77gbWEoTNmhAo5VnO:+jo5sLgitj4OJfmMFtcJekoTKfn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665495141, "uuid": "882ecc6f-5ea0-43bc-a989-60dbf4c52ef1", "value": 216576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665495141, "uuid": "7edf139f-d6d8-45d3-be19-1e122a414d16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665495141, "uuid": "e28477b0-d98e-45f5-b5e8-94b8a9965f9d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad9268bf-4919-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1665461015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665461015, "uuid": "6d217fed-9cc2-4ef7-a6b1-03d4cb381ec6", "comment": "Malware payload (Loki)", "value": "c5ef69714a7fbc4997e8c05f1de64e6b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665461015, "uuid": "d6a4a4c4-61a7-4c15-90ba-0e62987738a5", "comment": "Malware payload (Loki)", "value": "3e42cf8b782abc2372d1fda2e773caeda09fa83f0d95f8363ff456c479c26272", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665461015, "uuid": "0a89533d-b192-4923-9bb4-a51f17e2df68", "comment": "Malware payload (Loki)", "value": "79064c3d312a65a36b0a80a90561a5eb287ab83b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665461015, "uuid": "83c66161-4033-4596-bd40-5c419b34ec59", "comment": "Malware payload (Loki)", "value": "45369ad0aa3bf3e4da8017a9ade2ff2322f4b770da4f39009dba1f7ede510fadf18994d942d70e1f34d69584cde90b03", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665461015, "uuid": "e0a92106-8ca8-4f57-a353-972104d9e26b", "value": "T139156A7E1A894607E8143275C883E2F32AFBAD606061D1CB1AD72F5FBC552BF951334A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665461015, "uuid": "99b73330-597b-464e-9177-146a32c2fc30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665461015, "uuid": "fbeb8ae5-7d0c-4f4d-bb20-4fd60ac5704c", "value": "12288:7TwKaM+Tx+tJZya1XoeoUjNmWuV5g6GFAQSQy4AI:GM+Tx2JZX1XoDD5gjAtQy4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665461015, "uuid": "85a35931-e332-4ddb-9047-6d6129a08d75", "value": 919040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665461015, "uuid": "0a959a36-8910-4906-b8d5-56590f8858fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665461015, "uuid": "8c8603ea-3884-4970-a68d-73e5d88982f3", "value": "c5ef69714a7fbc4997e8c05f1de64e6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29df757d-493c-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665475826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475826, "uuid": "a0ac3d11-93b5-4bf2-bba7-8974b13ddea0", "comment": "Malware payload", "value": "12e80e02b8681b3bb215f68f8de18caa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475826, "uuid": "0edd9aae-a600-40ca-a866-0ed7a59bd9d7", "comment": "Malware payload", "value": "3ee1f89eff7947e11f27208256b6e6531d7297eba5ba1d4723298cfd33a7c451", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475826, "uuid": "695e27ab-b0c1-4ff7-9707-f5ab99217fdb", "comment": "Malware payload", "value": "89c7bacae953e95e8016c46e95a840b5d2e9ff36", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475826, "uuid": "d94d5163-b874-4874-98c0-64237f5af586", "comment": "Malware payload", "value": "695cddc596336ebc3751d4f146dc192ca1e67a26d97f9c7f9d248f94c56d5d88b437a719ba06708a7bba599d772142f1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475826, "uuid": "3a6dcc8d-3173-4f63-a18d-200637128723", "value": "T1E0A68D7DDCBE863BD164C6B5DFC4882AB448D1BB31221D3661CFBA59830AD4269C327D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475826, "uuid": "52f47641-bbab-4b67-a428-5dd96ee6005c", "value": "196608:vdclHY8+sbviWZhnfsJm3uMdepQnwbn8hAeffp+D7Zhpf7tIDg8/y+8k6/c7QyxK:vdc/vVn0JO4pQa8CeffSv7tovbDQyjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665475826, "uuid": "ada943a0-4b28-4272-a1e0-6159cf438295", "value": 10223439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665475826, "uuid": "27550a6a-aed5-476e-bd0a-a1c9c56236c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475826, "uuid": "63d2d8f8-c924-47b9-9230-95c302bf9484", "value": "3ee1f89eff7947e11f27208256b6e6531d7297eba5ba1d4723298cfd33a7c451", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d571dd04-4940-11ed-9266-42010a9c0072", "comment": "Malware payload (StormKitty)", "timestamp": 1665477832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477832, "uuid": "c997d1bd-a1c6-4f48-9e4a-73ccbd2184a0", "comment": "Malware payload (StormKitty)", "value": "50ae452a762aae14ccab1d1e56983307", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477832, "uuid": "f1f9f228-2fa0-4fa4-a546-8ea683f918ab", "comment": "Malware payload (StormKitty)", "value": "3f3f17de70e897ba762f6a6073b6716a4fc01e04ea0038a4f01ce7842c7d8a74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477832, "uuid": "3aa70c03-f75b-4303-96cf-5b833e39190c", "comment": "Malware payload (StormKitty)", "value": "1fe167e21638f2891585d7e1498160e3d3720594", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477832, "uuid": "0cf367fa-963f-470d-8c22-45fbaccc7d0b", "comment": "Malware payload (StormKitty)", "value": "eff88eb94efe8a05eeb473767897b072805c07c09ad5e74abe3893a81fcaa60f1689deed0306602feda79ffc2b89d182", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477832, "uuid": "7127f364-12b9-404f-891b-eb62ff9ebd4a", "value": "T133248461BF318392D854CEB3AB6BF5F502123E79D9A1661B31CABE0B76F3143014752A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477832, "uuid": "0cd0ff86-647e-4d73-a586-ba56588ac3b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477832, "uuid": "8bf7a3b8-2582-48e3-be45-5a2b52607440", "value": "3072:GB0z1qxbki54KcMcc+4bIsJUWGTBPZFyfShcP:GB0z1qU7c+4Hql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665477832, "uuid": "dc7f7b86-21ad-4ecb-a1a4-4a1bd90049d7", "value": 218624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665477832, "uuid": "7e0ebe79-2070-498a-b53f-c32ecb810963", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477832, "uuid": "c77d7a19-dce5-4044-a69d-1b184612e481", "value": "ziraat bankasi swift mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0698eaed-493d-11ed-9266-42010a9c0072", "comment": "Malware payload (MedusaLocker)", "timestamp": 1665476197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476197, "uuid": "8444a602-f655-4db4-8f9e-300a3fd04def", "comment": "Malware payload (MedusaLocker)", "value": "36abb6a6fa18c866d1aad24576681997", "object_relation": "md5", "Tag": [ { "name": "MedusaLocker", "colour": "#B60B42", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476197, "uuid": "cb13b0ef-0c4a-406e-93e6-85b6692b14c0", "comment": "Malware payload (MedusaLocker)", "value": "3f5a5dd7c93418534cc11d16e3e8154b3574a1cec2544fdb13894129a906ea9a", "object_relation": "sha256", "Tag": [ { "name": "MedusaLocker", "colour": "#B60B42", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476197, "uuid": "72a7ee32-9498-4525-ba3b-412d8744b2b1", "comment": "Malware payload (MedusaLocker)", "value": "1fed1adfca60a14af5bc33fd561fb186970e7fb2", "object_relation": "sha1", "Tag": [ { "name": "MedusaLocker", "colour": "#B60B42", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476197, "uuid": "7f9e3860-57d3-4092-9fdf-516ac20b8d74", "comment": "Malware payload (MedusaLocker)", "value": "27d8b3a3e8d8dd8d8ceaf8cb6c27469a454e40308cdfc6f674815bc47ba7acfa6f74c17ce03ac9440a13fe1aeaebd0bc", "object_relation": "sha3-384", "Tag": [ { "name": "MedusaLocker", "colour": "#B60B42", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476197, "uuid": "6cfcc5b6-4fa6-4aeb-88d9-f4f26618ffdc", "value": "T1B5E4737EC12BCC2CF89D14B224041B1E3958F7BCBD9AE5ED215DBA2E956DC58B820371", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476197, "uuid": "d90b5984-2096-406c-a9d6-0409a516f0ca", "value": "12288:JPHoASnPvRFnfvfa+usAQxMaIBWMnoCniHZkMCWueaYhX0knOJe/uwKmQJXuVGkV:JPHoASnPvRFnfK+hAQxnIBWMCkTIa6XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665476197, "uuid": "ff617d74-61fb-4083-b690-f60c7aeab1b7", "value": 669970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665476197, "uuid": "36eb585c-f773-44b5-8eee-6c9aa730fa49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476197, "uuid": "fc085cfc-2e04-4be5-ac95-7c121a5bec7f", "value": "3f5a5dd7c93418534cc11d16e3e8154b3574a1cec2544fdb13894129a906ea9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e52154-4966-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1665493986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665493986, "uuid": "2593bd9c-0198-45e4-96cf-1b7a3bb2a0a4", "comment": "Malware payload (AgentTesla)", "value": "335d4b762415e79ecdf6267625ddf3d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665493986, "uuid": "ba2ae605-a167-4156-b20c-113a3fd80fb2", "comment": "Malware payload (AgentTesla)", "value": "3f7a2bb1fec9ba3d939367d1ebccf666711e3ca4feda0501d40cf6760e7cc706", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665493986, "uuid": "71e432b4-c52d-42d6-93f1-3888806da48b", "comment": "Malware payload (AgentTesla)", "value": "a22edece64e92a06714fef96fd19ac367ed9b7c6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665493986, "uuid": "e87abce9-351e-4801-9a64-64a7b5d22f60", "comment": "Malware payload (AgentTesla)", "value": "37955d57e609db6d1aeafc54946237d5dbe1b58b7b49dbaffce1ab4be3953bd5f9740b081a40ba7a1963e2a996543e76", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665493986, "uuid": "6df588fe-9e3d-42a4-ac2e-7593601df179", "value": "T17282F74517CC59B2C368B2739279854941FCF737325326E8F88EA19137BE20E1AB92F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665493986, "uuid": "f9bc6000-1546-483a-ad68-b13c75895ebf", "value": "384:t+dxfIzsBNgwpwvrXI16jQcyvpF1WH89d4c:W5BCwiv7ItHpFdf4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665493986, "uuid": "6569879a-d0f1-4748-8ca1-01d78fd825a4", "value": 18974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665493986, "uuid": "726e3a81-0fd3-48dc-aabb-92d8a0a00cf7", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665493986, "uuid": "9f7a009d-4fe8-44b2-88fc-80dc46267893", "value": "09275.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "943561d9-495d-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1665490178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665490178, "uuid": "daf6940d-2ebc-4f23-b4bf-fd9774dcb9c4", "comment": "Malware payload (ArkeiStealer)", "value": "488fae7289e40bb23cb8427cf7690e3a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665490178, "uuid": "8a7ceddb-4b6d-4733-95c1-aa18f6426df5", "comment": "Malware payload (ArkeiStealer)", "value": "4188c6ab98585f5f8426cd17aa5eb0e1dd96db49ffdd21cfb91b68f19d5e42af", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665490178, "uuid": "0e875f00-723b-4c4c-9fd4-9874480c6a35", "comment": "Malware payload (ArkeiStealer)", "value": "f7c1e28ef51ec7fcff52cd6d6e3e9933a143ab1f", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665490178, "uuid": "673eeb30-0c10-4c13-af08-bc0e76054ab9", "comment": "Malware payload (ArkeiStealer)", "value": "cfaf78b703d266adae56ee6c3121b9bb29f53b3b0f18c403ce91c8053217ee218cf57743d58d8fbe9539ca848a2c6bc8", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665490178, "uuid": "263f8f76-95c1-41c0-b183-c8f262dd1937", "value": "T1C9E4A0906EBC489BE82BA8790FA073FEE933481B57374494F3AFC3814D759E5495E062", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665490178, "uuid": "58d55717-80a7-4422-814e-7814780f1e6d", "value": "889d6e9adaf602123d02717fe501fa0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665490178, "uuid": "22bf88c3-04fa-4ffb-8107-24b8f7ed9bd0", "value": "6144:88cBjzaMPsdeeMeGlsK7Sd7SEmGva9pqPQ1W2wEW7mYiVAu:Batj7MOE9v1OW7Ti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665490178, "uuid": "6560cc24-3252-45de-8f03-7eeb0d228b3f", "value": 685568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665490178, "uuid": "54bfedcc-9e9e-401a-ad0b-37b8b705bece", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665490178, "uuid": "9cc646d6-4494-464b-aecd-a5c129b33a81", "value": "4188c6ab98585f5f8426cd17aa5eb0e1dd96db49ffdd21cfb91b68f19d5e42af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cd94ad0-4943-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1665478891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665478891, "uuid": "064bf92f-6b3e-4c9a-a37c-3403faea6274", "comment": "Malware payload (ArkeiStealer)", "value": "32a51d488c8a68eedb7221fc7e7ee196", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665478891, "uuid": "68deb2d8-1b58-4fa1-8ebc-0bee173fcc55", "comment": "Malware payload (ArkeiStealer)", "value": "436bb5dbf910f975b547dd626a47fbc898a5919efe301467bc748510d3903d3f", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665478891, "uuid": "7976afe1-7e61-43ee-80e1-422a6f548bb6", "comment": "Malware payload (ArkeiStealer)", "value": "98a0bef751da37a0bcbc6961ce3a5eaab705f311", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665478891, "uuid": "affc752b-f1da-4146-b5b2-729989f516e5", "comment": "Malware payload (ArkeiStealer)", "value": "b5412eba5adf6b73f65000c045586ef7d35ec2be5b8bc4dfc00c3bc8af26f7d9f141ef7a1a823fa5ac56676ca7b596a0", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665478891, "uuid": "7299c04f-0203-49ef-ae75-405c095df60f", "value": "T15824CF1631D4C0B2E26656788C75C7B4AFBBBC310A759A8B7BC8032D9F357D29E25306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665478891, "uuid": "2d295f38-41a7-4385-ae8a-6611e1f32a0c", "value": "f07757163332cdbf737bafdb4614222c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665478891, "uuid": "9265342f-faf6-4e53-906b-2604959b1c2a", "value": "3072:Uor1OMzjdwuLl6RzRFExpvIjPas+A2xj+o8cpSC990ixO:UslVLl6Rb+A2xj+Tcpf9b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665478891, "uuid": "77a06435-ab35-4b39-a43e-7c548c4668e3", "value": 215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665478891, "uuid": "57b49766-ce65-45b7-96f1-847042c69cec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665478891, "uuid": "265d2da6-67e5-4d93-8676-d4aabb28a6a1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "207879e0-4917-11ed-9266-42010a9c0072", "comment": "Malware payload (Nymaim)", "timestamp": 1665459919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459919, "uuid": "7a82475a-7665-4ed2-9f47-025b6182f856", "comment": "Malware payload (Nymaim)", "value": "b2bf45bbd8f6e8dcc9d80b72b519e188", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459919, "uuid": "331ccd27-487b-4697-bf38-3fbe7b17766e", "comment": "Malware payload (Nymaim)", "value": "441b9eee712b85616ca62d08810f6d4a232c2307811c211354be18c3f3ef90d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459919, "uuid": "97795152-49d9-4f4d-93a7-69220f0c7282", "comment": "Malware payload (Nymaim)", "value": "61cf3f29f1d310090a135d9049017229d930da93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459919, "uuid": "ac2c9c46-ae22-41b9-a9ee-be80a1eee53f", "comment": "Malware payload (Nymaim)", "value": "33ee40d90074a4dc48d796c6ef41fd45202142fc4f7344e689afeb3f823ce3378fb38b209ffea984dd9f6c4f1952d334", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459919, "uuid": "e241f4f9-3b1c-4ff6-a78f-1988b568f29a", "value": "T1DF74F12239D0D432EA6B75348D72CB716FBBBC641A305687B7D816AC4F226D25E34387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459919, "uuid": "bfc9bb3a-c79a-4d68-b1b5-e61f92b2b5b0", "value": "78ee95c35be8f9cbb7d14afcce7e80bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459919, "uuid": "eab68607-2dba-4b9c-b216-8f9786c2b631", "value": "6144:KpKD8L6c/vKEQEEX7cG4Z3thVnvXPm3CsVP3pkDdr:KpKD8p/iXjXwVLXPeCG3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665459919, "uuid": "a2f59d96-5292-41e1-8e1f-76a3aef659e3", "value": 348672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665459919, "uuid": "92d8a47a-199b-4974-a68f-1084b9ac0de5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459919, "uuid": "70566ff0-8d58-41e2-894b-71ea47c52ba9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c6cc4f-4918-11ed-9266-42010a9c0072", "comment": "Malware payload (NominatusStorm)", "timestamp": 1665460517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460517, "uuid": "60078368-d92c-48b5-9028-c77504166e0a", "comment": "Malware payload (NominatusStorm)", "value": "c3a06a3eda6e8a3f7aabfc1a81cb9c34", "object_relation": "md5", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460517, "uuid": "3075fbd9-d5fb-4c9b-87f2-438e70a8902f", "comment": "Malware payload (NominatusStorm)", "value": "445cbe8bdcfc9abf9847124feee0478d90948a708891ad373bf88b1eb5eb09f6", "object_relation": "sha256", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460517, "uuid": "c6cca005-ac86-47b7-aab4-3920ee875477", "comment": "Malware payload (NominatusStorm)", "value": "c3874645bbc9a105eebedeb4c3f87693e461c347", "object_relation": "sha1", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460517, "uuid": "a9835314-b178-409f-bb68-40b4f38df525", "comment": "Malware payload (NominatusStorm)", "value": "a6edb8d5ef610f58fcb40d179997ea271957c8efaef5b411ef533ca0521940baccee180b6e6d16574fddf200628caf8c", "object_relation": "sha3-384", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460517, "uuid": "1c1c394a-47b8-47b4-b6d9-cf4afac98fac", "value": "T1C2957E963B92C12AC06E03350CA1D38B2172F86A9F1342D734D9B37E7DBEAC44A755B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460517, "uuid": "71395eec-03f5-4ed5-afd6-0267298dd991", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460517, "uuid": "d670f540-462e-4975-ba43-49775025e384", "value": "24576:lKKKKKKKKKN7ChBWMQ+uSJJd3Dkd9+ZDd3vNSM0y9T+m5WNDV:JjLuSh3i+FtvkMzT+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665460517, "uuid": "a76780ed-726e-4777-ad99-3b07d12e3c3c", "value": 1899904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665460517, "uuid": "50a34422-30d7-4ef3-956a-635274cf97de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460517, "uuid": "536348b0-daa3-4f1a-8ead-7e80231c1afe", "value": "445cbe8bdcfc9abf9847124feee0478d90948a708891ad373bf88b1eb5eb09f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec21c949-493d-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665476582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476582, "uuid": "b4281634-9e43-4438-9e51-23c27cfba15d", "comment": "Malware payload", "value": "ff7d323573c6ea172e9b31bb2713426b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476582, "uuid": "532959ea-e128-46c1-a12c-18fccb9545ec", "comment": "Malware payload", "value": "44df734e0038af02960cbb49249a0e8d1fc3d76a0847811c2e5a5468b64c824b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476582, "uuid": "6d4c828d-2316-4016-8849-b8799f6b5f33", "comment": "Malware payload", "value": "cebe7317457ccd80c39e1d0b076bad431eedac90", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476582, "uuid": "deff6a54-fb2f-468e-a0c8-33e5394e6c4b", "comment": "Malware payload", "value": "ce76f686901249756e57610f4ae0e2a435671aa24a84f4ce488710b3c3edbbea1d92714f6f78a5f767012b95b0a8198d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476582, "uuid": "4543071a-ff0d-40eb-bb2e-a53308d9a743", "value": "T15C71FA3D638CACC3C21580F1D8597FD905A2F96706E717809338F9FD0927145556F9A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476582, "uuid": "39df871b-e93f-4297-8cfd-f810019879a0", "value": "96:9rLsUDCb7NnlOyK2I8MI11h4olTPRzvxHP3feW+:9/HCbKoI8fv4oBPFJv3feW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665476582, "uuid": "a8511c62-f8ea-4ac1-9655-2137676dbbb1", "value": 3637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665476582, "uuid": "93f929ea-9361-4b6d-b484-cc10b3cc7f07", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476582, "uuid": "e70417ff-3894-476f-889a-9335af2747e0", "value": "Revised Order 2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841c1c2b-49b7-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665528806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665528806, "uuid": "139a4083-e862-418f-b662-eade6c62d86d", "comment": "Malware payload", "value": "73af7aea83b7b9002ceedf0a1155b325", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Zanubis", "colour": "#CE30F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665528806, "uuid": "e31fa6ba-9671-48a7-affb-3f389895af2c", "comment": "Malware payload", "value": "4560c27d6656bcf5f5f4d101daab3ccdd5f0edd4f5b279b66464019a7cbe9aba", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Zanubis", "colour": "#CE30F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665528806, "uuid": "7ee10c50-c977-4568-9029-8759e49c7697", "comment": "Malware payload", "value": "256e6bd3683ae2a4aae48394e8231cfbbb06aeaf", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Zanubis", "colour": "#CE30F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665528806, "uuid": "8fb9fa6e-ff7c-43fb-b9f5-fa6cd5443775", "comment": "Malware payload", "value": "b1a37e1302bb66f90667215aa098cd6e8c6c4ce64b6fe7b8e44ceb6b2000f88044f81a3adfd3332f9706219ab82cc701", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Zanubis", "colour": "#CE30F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665528806, "uuid": "85074de9-b836-4fe8-9c51-c08c73669563", "value": "T15B16DF9AFB48A95AC8F7533345FA5232514B4CA68B43D6835D58F23C18B76F00F5ABC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665528806, "uuid": "11560483-40c3-495f-b91a-6bdba0690f4f", "value": "98304:SgdEMqWCi/8NKT47kiiO7dcFSK0jcFi2uNyKBd2ofrnK0K:SgegWPkxOZcFSKQc02syKrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665528806, "uuid": "50c9d3d4-e156-48a3-b3ab-cd1f2748c879", "value": 4206695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665528806, "uuid": "6ee311ed-8dd8-417d-a207-f1b3c2ee9bf3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665528806, "uuid": "8bd84ea3-9bcb-4304-bd47-a4ce8bcb4197", "value": "4560c27d6656bcf5f5f4d101daab3ccdd5f0edd4f5b279b66464019a7cbe9aba.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b29289f6-4970-11ed-9266-42010a9c0072", "comment": "Malware payload (Vjw0rm)", "timestamp": 1665498389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498389, "uuid": "20f150ee-d5fd-4e7c-8d09-d6483efc82cb", "comment": "Malware payload (Vjw0rm)", "value": "e0d2cbd0519e1f0dbf8c0b74c8ee1246", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498389, "uuid": "15adf674-f60d-40a9-bf7e-50dcdff6c85a", "comment": "Malware payload (Vjw0rm)", "value": "45f0f33921e9e548f1df35f5d30855704de3542789c4c7d2c35f68cd8ab0166f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498389, "uuid": "493fe6ea-e9fe-41eb-aa1d-5202c1be07d7", "comment": "Malware payload (Vjw0rm)", "value": "35187b51e45f7466ae98c67900c7c14f7ba268a6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498389, "uuid": "8ee503ed-1ac5-42ab-aad0-ccb150bf2a16", "comment": "Malware payload (Vjw0rm)", "value": "3af0bf7b59e40b07c662b1d6c97a1ffa17246eb22d168fa17ff1c565ee9b76908177f480e3580d7e7fb0b84e3c1fdf0b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498389, "uuid": "4826b31c-fa4c-4dd1-aef8-15ef9efeddff", "value": "T120035CA9C8771B51CE142F038AFCED487FB9B84D95E099AF3A15854C52A503DF0AD2AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498389, "uuid": "79b3b3b4-9b91-47e9-9ae3-7ef61a0e4390", "value": "768:2buVp24R6SMkM4gF8wsZ1va/a9zcHEdYHzePC:2w2g6qMPCwsZ14a9zcH+IzePC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665498389, "uuid": "a714884d-b08a-4ac5-8f9b-44403ee06b86", "value": 38518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665498389, "uuid": "1b5e3099-42e0-4e2a-ba5a-cc23418105b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498389, "uuid": "a1ea268f-5444-47b0-a65a-1fb4a64e3483", "value": "Invoices & Supporting documents.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be0d5bd-493b-11ed-9266-42010a9c0072", "comment": "Malware payload (Conti)", "timestamp": 1665475588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475588, "uuid": "2f541ef1-8604-4360-ae81-e939568f5275", "comment": "Malware payload (Conti)", "value": "20d411f2b4d8523910263b4672cd730b", "object_relation": "md5", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475588, "uuid": "8aa08be3-9fb0-4783-be13-cff28c4a1149", "comment": "Malware payload (Conti)", "value": "460877f22626abf2f3e95a1951d67bba7ab83a78603ced8d174b8d744d0f0359", "object_relation": "sha256", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475588, "uuid": "4c247644-1c88-45dc-aacc-b57a8c4e8d0e", "comment": "Malware payload (Conti)", "value": "100b91cabb59ad7dfbce46a6745bdaf613611491", "object_relation": "sha1", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475588, "uuid": "631f2abb-7efb-4391-a85e-042d58aa2a2f", "comment": "Malware payload (Conti)", "value": "93b3eaab6112875b544e4df6d9140c312b1bb28968d192db1c583af94702d632d9b98dbe556705d79f292bf45d963e90", "object_relation": "sha3-384", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475588, "uuid": "418f3910-715b-4bda-a0f6-48759b454205", "value": "T15BF4D6D293F78F45F09E67B898204215C6F9E534B6B7EB1E4F04A9AD1816B40BC60B73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475588, "uuid": "ce467928-6850-4c34-8d6a-d724aedb67f0", "value": "12288:i0OfN7IAz7ADp6xRPOfJrh+NRC6KEyJ+o35Q4Islewcc6AbFmKhNS:i0Ol7bop6xRPOfJrh+NRChoopQ4Isle1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665475588, "uuid": "c9fd0005-0269-4c89-a749-b70f852ae01f", "value": 759348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665475588, "uuid": "38b66697-e7ed-4316-af68-0fbb9ae6fc47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475588, "uuid": "7907aab9-2804-4c54-8700-9e4a808dc6f4", "value": "460877f22626abf2f3e95a1951d67bba7ab83a78603ced8d174b8d744d0f0359", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bf66486-493d-11ed-9266-42010a9c0072", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1665476232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476232, "uuid": "2cd5e09c-42d8-4078-abad-2fd756e0026f", "comment": "Malware payload (AveMariaRAT)", "value": "760135f8d889f70365c2d15651826c0a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476232, "uuid": "114fdce4-4fcb-4437-a662-b81e1bc1c95d", "comment": "Malware payload (AveMariaRAT)", "value": "46e639b4d413c5a24411dcfdb195d269d3e12e3e566d139a777c0378fa61672e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476232, "uuid": "02ab073e-a34e-4363-9b03-a941797275f6", "comment": "Malware payload (AveMariaRAT)", "value": "6d9f6e5c3acde105b9279654f072d62eb12cf942", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476232, "uuid": "bf06fadd-a5f0-4588-8413-d1f07421e031", "comment": "Malware payload (AveMariaRAT)", "value": "2ba2f075b448376cbea45fb94412ea46483c9fd5e0ea6bdc1ca1fe8d3ac994ffbf0d1af7fc4c7f190fa0a7563466a81f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476232, "uuid": "ade248a5-ee45-42fe-b2ec-b7e2cc350dab", "value": "T1D2155A7E16994607E8283274C883D2F32AFB6D606061D1CB5AD73F6FBC612BF9512346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476232, "uuid": "80636a31-1b12-4851-a394-7f54f1044e34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476232, "uuid": "a7858723-0439-46f2-a9b8-93eb757ea763", "value": "12288:t+wl7BMNrRP0RGLk+T7+SiHSOv5+XEjNe19k1yZSwShAQSQy4A:NqNrRcsLPeSiPv5+0j419GwiAtQy4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665476232, "uuid": "c9c193e4-b0a6-43ce-8859-0b100b275fdf", "value": 946176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665476232, "uuid": "eb19be79-4552-450b-bc6c-013f07f51375", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476232, "uuid": "57d5032d-dd0c-4a56-8291-6b4808f2d53c", "value": "SecuriteInfo.com.Trojan.Inject4.44941.29597.28145", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af85d477-493d-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1665476480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476480, "uuid": "b0ecec12-e0c1-47bc-93af-fd1849cec53b", "comment": "Malware payload (Smoke Loader)", "value": "a6bdd205a0e132ab8f590f2f24aa6dbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476480, "uuid": "e9f42ab6-30ef-4abd-af6c-17ea77db43be", "comment": "Malware payload (Smoke Loader)", "value": "472da274009e128287b9d2d422e6c0e8d15b580d334df995450e10158d5e9f11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476480, "uuid": "afd63b7b-c3b1-4b53-956a-f130e4068b00", "comment": "Malware payload (Smoke Loader)", "value": "7424e7ad27099a03b7615eeb5b7efca466f0c3d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476480, "uuid": "fa699ff1-7a89-4b3a-8497-78fb3563b91b", "comment": "Malware payload (Smoke Loader)", "value": "5fdece01cbdb37f82b75d5b776cbc818b9ef75f25a560f83763bc9f30d1f0d6129501c9952f5463e863acfab26675ff8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476480, "uuid": "0bc6e935-6640-42fb-afa4-2e701f5f0b9f", "value": "T1A854CF1176F2D87DC2A20D748C24FBE02B7BB8727930594BB7605B9E2E723915A72317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476480, "uuid": "f91f2607-6075-44ea-84c7-446c5768335b", "value": "2a1dd2daf6fcaa8405a3968231f4dd38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476480, "uuid": "590f5958-abb6-4f46-8ee9-e87d68bda417", "value": "6144:H1MEls6wa9O/FQwDaL/VZpm1p0W7gigavwVfIH:HhWW90BerNDiRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665476480, "uuid": "51d5b847-4f83-4355-bcd6-1b3146582f8f", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665476480, "uuid": "d3f23c45-a45d-4a05-a6be-0a34b8bc06d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476480, "uuid": "6095ce31-e2fc-4fff-913d-567585162dc8", "value": "472da274009e128287b9d2d422e6c0e8d15b580d334df995450e10158d5e9f11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe15413-4918-11ed-9266-42010a9c0072", "comment": "Malware payload (LokiLocker)", "timestamp": 1665460589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460589, "uuid": "3d22fb15-a190-46f8-ac6d-7ed2f11767ec", "comment": "Malware payload (LokiLocker)", "value": "affd7cfdd9720f8a044d5e9410923a78", "object_relation": "md5", "Tag": [ { "name": "LokiLocker", "colour": "#CA143F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460589, "uuid": "8bec1226-acff-4a82-a12e-74bf88203cc8", "comment": "Malware payload (LokiLocker)", "value": "478c116d9bb318b4621c7839c81be36261c38e748a593249f8c9c67789f71064", "object_relation": "sha256", "Tag": [ { "name": "LokiLocker", "colour": "#CA143F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460589, "uuid": "3ccdafda-9732-41d4-833e-33a9503e3970", "comment": "Malware payload (LokiLocker)", "value": "80ac3f86c3a31c4516f9077f8c5e990de2068032", "object_relation": "sha1", "Tag": [ { "name": "LokiLocker", "colour": "#CA143F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460589, "uuid": "20cb9b5f-8fc7-40dc-abf4-d853431d2563", "comment": "Malware payload (LokiLocker)", "value": "147691cd78fd09ab8364723362b080daeaa5c41d56fbcb70d17a70449d370ab493765b6a1f0f4ad9330eb691b0eb40c1", "object_relation": "sha3-384", "Tag": [ { "name": "LokiLocker", "colour": "#CA143F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460589, "uuid": "82e0b188-195e-4bc5-aacc-10eb68f2a682", "value": "T1EAE49D5253E79E22F3B786FD99B152348722BD97E636C31E338145C42E30758EE523A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460589, "uuid": "74633fd8-cc77-4083-97fd-25fd4af16374", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460589, "uuid": "4063566a-d0d7-46bb-a5fd-d49e5061e0e3", "value": "12288:1kr/10xl0PFS4jwbIsO/arlTT6zncVUJ7vndkrh:+r/10xl04EOIH/cTT6DNGrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665460589, "uuid": "581f5349-8088-4c21-b4de-004c4a3ba5d1", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665460589, "uuid": "154f9f80-3c2a-4a3a-adf5-685d8dc0e3da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460589, "uuid": "5af743de-026c-4018-bf62-a2134dcf7ac8", "value": "478c116d9bb318b4621c7839c81be36261c38e748a593249f8c9c67789f71064", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f30562-491f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665463316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665463316, "uuid": "c7f9d8e2-9869-48d2-b3f8-110871bcf359", "comment": "Malware payload", "value": "68f9d15c3af6c74a2ea1879707e67bf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665463316, "uuid": "fd1a67b5-6f95-4697-b03f-76cea4952759", "comment": "Malware payload", "value": "47e31462d17de74f16a191b643b3572ed50de8716d22d0ed697f587057c4f9ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665463316, "uuid": "cbafb133-da83-4e71-b48b-e86a762c37d0", "comment": "Malware payload", "value": "2fbe9d419a6bd6627c08f642d84f85a1de371b56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665463316, "uuid": "384d1594-b07e-4ce2-b50e-002f84ec83a0", "comment": "Malware payload", "value": "215ec327fcd9279eb3482436f74000c47bfd4ad9d47d2f1cbf4c84a3de3a4bb39190695acb10c28e5a845f39ba22de9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665463316, "uuid": "6a337cc0-7307-434b-b8a6-bf1bb1ac2214", "value": "T171C48BBBD7941410DB39EA3DA625C628DDDFAFE898E0E47836D5FC131E7B48845A0C18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665463316, "uuid": "b5f0210b-34be-4312-b336-66862ff415f8", "value": "48e414e431433a62713440d22abb8343", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665463316, "uuid": "69bc47e3-b147-4989-8f91-0a760f57456c", "value": "12288:WGPTr152DfSQR+d7DweLxfnh71ds/0rYXUWDx14pof:WGPTB5ufZR+dv3L9nh71ds/nNipof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665463316, "uuid": "667f10e7-8c36-4e20-8b12-460f63694ac1", "value": 566784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665463316, "uuid": "a000e7cf-9707-45dc-8b21-ac063fbf040d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665463316, "uuid": "251960f6-e17b-46d1-8dd9-32db2693a6b4", "value": "68f9d15c3af6c74a2ea1879707e67bf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4164837-4934-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1665472676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472676, "uuid": "53299cf8-dd66-4b05-94e5-489613a835fd", "comment": "Malware payload (Formbook)", "value": "69e8f706e073c639f0a76f51345747e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472676, "uuid": "9bc7de82-30ae-4a00-87bd-2f5b4f075f21", "comment": "Malware payload (Formbook)", "value": "480a54071c3d441bc1dcabe2d5580d11037778b3808eec7359088f7c6a8866b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472676, "uuid": "75c8f24d-f44d-4d33-8d82-49af724c3ae8", "comment": "Malware payload (Formbook)", "value": "f584fcd441d884d2cbc73f25583bb87d4ba0641f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472676, "uuid": "416794d9-8eeb-4e6c-9f40-56042be49e0b", "comment": "Malware payload (Formbook)", "value": "146ec2a8f836119eb2d90f708710e264bda3361c7ab91fcf236e42e39aafd67b3fcd2eb396bddf59312aa11b3b919d0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472676, "uuid": "5393156d-c4c3-418c-b7f8-22d9748f1837", "value": "T1055412293316D013DDE12CB26C7E66A62DC5AF162274578B8B207F0D7A32753DD6E309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472676, "uuid": "41b8904c-5145-4a0d-90c8-e4f87819e7ba", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472676, "uuid": "46e5f5e6-67b9-4c0f-b88e-9dc5010c7df3", "value": "6144:zNeZdTbDaVi2k58vVm3plHKPuTFJaPdtEp7IVts51vJKckAPE/FR:zNkTbmVid58dK51JaP4p7I/s51vJrkAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665472676, "uuid": "add94b06-104d-48dc-bd72-3e17a8604653", "value": 294075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665472676, "uuid": "847fed4f-21b1-4f8d-906b-abdab800edad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472676, "uuid": "3c63ac01-5a57-4772-9be6-cbd7b3aefd78", "value": "Roominglistss.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0d10d85-49a0-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1665518976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665518976, "uuid": "b65070f4-769d-4eb6-a60f-b0ddc417fc4c", "comment": "Malware payload (Formbook)", "value": "5cc24a82bbdaab6f009d121f24fff1cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665518976, "uuid": "b60d9b97-75f4-4580-a4be-15f4bd2f8c11", "comment": "Malware payload (Formbook)", "value": "49bee43f1928c8c6cf9c0d2d692df4581235784d51ded3051685fd18a51d5599", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665518976, "uuid": "a3018dd8-ad9a-4879-906a-10fa9813b593", "comment": "Malware payload (Formbook)", "value": "c43cc47611c09cc6504c6079b2b15d250f8d17ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665518976, "uuid": "392f012f-147b-414c-ac2d-bb47f866cf03", "comment": "Malware payload (Formbook)", "value": "ca63c984d976e57ea48d6f2801d9f41efa869c76d7b62d91157708e10e02442ea793982fd8418ce6c0980774edcf95c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665518976, "uuid": "f67c6ebd-645e-4215-9904-a23acd82d31e", "value": "T19F2559BA21858417E4297135C483D1B32AFB6E606162D1CB6AD73F2FBC452BF951338B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665518976, "uuid": "f39faead-bca5-48a3-a2e9-2a512a2252e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665518976, "uuid": "013368cb-3c2d-41f7-91a7-8567b683cf30", "value": "12288:8I1daQlg2iNSv+LwDAbn250bdzpBi7jYEFiyPHDmTthqtxypR7RAAu:di4g1VzqAlPi3YEFl7ConyzRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665518976, "uuid": "285fd6a4-a27a-4ae3-910d-b38a88fa761c", "value": 1033216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665518976, "uuid": "584e24d4-fe56-4bf6-a9dc-c56b98be7f2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665518976, "uuid": "a524f2df-347f-4944-93f4-038eb9ca3188", "value": "Justificante de transferencia ES080049 EUR57904 221010.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be4e565-4986-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1665507693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665507693, "uuid": "181ffd79-7fae-4847-9c69-8ef7bd6507cc", "comment": "Malware payload (AgentTesla)", "value": "8fcdcd4a5a722eb743b4248073bb95b7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665507693, "uuid": "31aad993-ef4e-4ceb-ab49-d64276bb03b6", "comment": "Malware payload (AgentTesla)", "value": "4a2d3ebfde9b195d40523f915eb96e1c1f23d85fff7ab61c4135825bc43a76fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665507693, "uuid": "354510e3-41b6-4718-a125-4b1407f70598", "comment": "Malware payload (AgentTesla)", "value": "3cec27406633c97631ebbe66cd84f27f3d041e47", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665507693, "uuid": "989bada1-4e47-42f3-a631-c611932deeda", "comment": "Malware payload (AgentTesla)", "value": "a70ec9fffb5ffdcc6d086be922887006ddb609b36713ca73fa7903ba5c6c7bb0867b579b785f74793a1c8e0c20d1d599", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665507693, "uuid": "bda9f5c9-8b01-4f4c-bcdf-34334a07e8eb", "value": "T1DBF49DAD762076DFC857C4768EA81C74BAA2347B431B5213D06726ADAE4C887DF640F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665507693, "uuid": "e7af1b92-ab6b-410f-86f1-940e847ed166", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665507693, "uuid": "c94b8872-a3c0-4c84-83bb-128febb8e9e8", "value": "12288:HuDauu2iNaLCsElPGHMo7uosimMcC7Dy1oefADqjJ5npvoQWtoO17qwJb60MEOo:Hu+uu1QmPGsoaosimMZy17njrpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665507693, "uuid": "268b5f6a-83c9-49e0-870c-78520f4fc39b", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665507693, "uuid": "165816de-f2e9-455e-8d11-18444115fae4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665507693, "uuid": "5f7ca497-9644-4650-93e2-a2e02710ae6e", "value": "SOA SEPT. 2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe82e41c-4964-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665493363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665493363, "uuid": "225b9c57-5a99-41b6-b6c0-34fa9d4c62a5", "comment": "Malware payload (SnakeKeylogger)", "value": "7b62969003889358d4f80971a2750b1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665493363, "uuid": "695a5387-b0c3-4bb3-8725-bba0b6c73156", "comment": "Malware payload (SnakeKeylogger)", "value": "4abb470a78c432cc2f4a2001eb2c5188b4c6f31fcc557fdace4e35222d976300", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665493363, "uuid": "5454563a-b7a2-4e78-9a9f-285999f36ca0", "comment": "Malware payload (SnakeKeylogger)", "value": "dc590b0ecebcb8ed17ffa330729a4a66991337b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665493363, "uuid": "4ac76962-2100-4381-95c7-9e185b0d6601", "comment": "Malware payload (SnakeKeylogger)", "value": "7fc48ea1341173313ad91cc62432ee09efab988b5fa473e0ed832da77b0913c181b37042add978659f09e14d73a189a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665493363, "uuid": "7b725ffe-8a18-4754-9b94-6970b880fae8", "value": "T1714505793A854906D8153135C4B3DDB326F66D146059C28B26C33F1FB9EE3BEBD0268A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665493363, "uuid": "918277d7-d20c-4175-91a0-dea67ef74f84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665493363, "uuid": "346b3713-cf05-48b0-9948-ab4b49f7ddfe", "value": "12288:w9AI9VRUsuAJTNRo0JGnScGNg4cAAh0nIsO13y6Ivxahw8a/AQSQy4ABRYcZbezc:81pX3JGShFcB0nkFzwAtQy4ABRBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665493363, "uuid": "5ee2d6d1-861e-4757-bc82-8327bfdcaf07", "value": 1199104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665493363, "uuid": "a9385153-c662-4fcc-9034-32c24d537166", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665493363, "uuid": "277385c6-74d2-4a8d-a0ac-d80303f64e0f", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3493d146-4986-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1665507627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665507627, "uuid": "01d46b19-ffc3-4739-8d21-3edd673eaf41", "comment": "Malware payload (RecordBreaker)", "value": "445b6f8ea1ef74e908a4fbc9605e600b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665507627, "uuid": "990310d7-b18c-4e1c-8da2-172124e957cb", "comment": "Malware payload (RecordBreaker)", "value": "4ac475f67ded60b56f4c840f5b5e1a34cfed8edbd6e403eff180ceedb7229e32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665507627, "uuid": "d3423ad6-5eed-4253-8f3b-a144814ff6bd", "comment": "Malware payload (RecordBreaker)", "value": "399c9f1551bdd54119dd3376ada59dcddb0fdbd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665507627, "uuid": "f5b6899b-5d3a-4150-8729-44344184ab90", "comment": "Malware payload (RecordBreaker)", "value": "060816ca89938c76c46f77200bfa775d9983d65e4f67a7dd6bd1c98a9e6a95865a3a7a12e2b69ed7a7cadec2377496fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665507627, "uuid": "65e7a82b-562f-4698-a735-1c7434423644", "value": "T16024CF113280C4B2E26656758C64D7B46BBBFC7559358B8B3BC82B6D8F312C39E25347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665507627, "uuid": "28817769-6682-4870-bad0-1800d362338a", "value": "47f3841b8380a704a9ff258e0444ec1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665507627, "uuid": "10ec6612-8d95-47e1-a86b-e9e03249ad84", "value": "3072:wFLPlQZEpCmL0bRtKt85rlH2ldWrF2jDrbDWyCEEvZO:w7VPL09tFrB2ldWhODrbKXEEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665507627, "uuid": "ed03416f-e213-486c-b1ed-40e0f7987789", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665507627, "uuid": "3073033e-247b-4a88-b1a7-dd90f666438a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665507627, "uuid": "2eff957b-e430-4c3d-ab93-f2667bd94f2e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83258338-4992-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665512913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665512913, "uuid": "08346713-9d1a-4b49-a41a-b583c089b4eb", "comment": "Malware payload", "value": "6fb3c0efb28addb1f3cb378767cc0069", "object_relation": "md5", "Tag": [ { "name": "pw abc999", "colour": "#554106", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665512913, "uuid": "5d82a034-94d0-4260-a8cb-7c1a47970375", "comment": "Malware payload", "value": "4afcf56dd43d79221d2af22cea1943f688148750d85cca58b7740f8717d693b5", "object_relation": "sha256", "Tag": [ { "name": "pw abc999", "colour": "#554106", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665512913, "uuid": "5b2bf5cb-868e-4ea9-9929-80e7494fbd6a", "comment": "Malware payload", "value": "a7dcf45cef3ab2d5eb59cfaa77bfc06751950438", "object_relation": "sha1", "Tag": [ { "name": "pw abc999", "colour": "#554106", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665512913, "uuid": "8a926996-5fd9-4a72-993d-1a4f29f56f16", "comment": "Malware payload", "value": "54e678e6bddc62522dacc6233916c7d2da78593edc1b43056f7c35ceac8ac154a18a81ef9730d84751f1973687315f58", "object_relation": "sha3-384", "Tag": [ { "name": "pw abc999", "colour": "#554106", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665512913, "uuid": "d68a3c59-fdbe-4e3c-897e-3cae5bdec455", "value": "T187A423C33BBE1C969D1B7C2A99552E04D320B483F1BD43F8FAA85098959DC4D1CB5F15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665512913, "uuid": "de7e276b-1d2d-45c5-b5ad-792904c24657", "value": "6144:pfmSKWSdZlU3zIEE1gr5kmPlW5GUZ/UpCOt8665wfxMRZayHG/KC1JsmKaRuSuE/:M1EmIk8laGU+pxt8Va6m7O9Buyqvbci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665512913, "uuid": "0aa4ea5c-1e4a-459b-ac05-90b22799623f", "value": 475934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665512913, "uuid": "1cfe97d5-a7eb-4edf-b950-6e7eb8e5f7c1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665512913, "uuid": "57991f92-ee31-4045-830f-99f85914fb11", "value": "b750e739-8fc4-4e4a-8c0b-16cca8563626.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c89530-4994-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665513746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665513746, "uuid": "d41bfbf3-b045-4526-bbfb-1947cd9fa49b", "comment": "Malware payload", "value": "fa44503fce3e8763e0e02cbffa182443", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665513746, "uuid": "8a4ebfdc-0fbe-49e4-84d4-fecbd9d91336", "comment": "Malware payload", "value": "4b3c74d47e2e6dfdd22283e50243004c80507aac639ff845c4570cad13aef422", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665513746, "uuid": "b818ef86-1a93-4df4-8c8e-8d9ce75406dc", "comment": "Malware payload", "value": "e5ab6291ac4738ef83c955bf685e4036168e9bd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665513746, "uuid": "40a6a7a3-51b4-42f8-9879-b061e93ebe2f", "comment": "Malware payload", "value": "bd5c0890dbfe912ac966e2eefc9f1a94cd78f8010d975a6d25f51e0c3f6ea5446ae299b3469f66dd7bcaa0ae5c422dcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665513746, "uuid": "31957d06-eb0a-4ba2-a8ad-5bff3a37cfee", "value": "T17E24CE3235C0C472D26625798C25D6B46BBBFCB55A2656CB7BC8976D8F323C29E24303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665513746, "uuid": "3374cbda-7148-4f39-99fa-9acfdf91f6af", "value": "47f3841b8380a704a9ff258e0444ec1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665513746, "uuid": "2aed3fa0-ad16-49c7-b457-69785320e770", "value": "3072://ZPlOZE+BX8pLynoF5t8xhG3/4W8RGL5/CPiJtaLQzZjlEZGuWO:/r6uLyoFIhOAW8S55EQFROGT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665513746, "uuid": "f0a2c754-4236-4428-b465-09439cb73481", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665513746, "uuid": "08e4f726-4672-46a5-b157-4ec24be42cf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665513746, "uuid": "210dd100-d47a-48a1-bbc4-bb438514eebc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59e10647-49b0-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665525728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665525728, "uuid": "7524c975-3a59-4af0-86f2-44cb50fdf393", "comment": "Malware payload", "value": "d881eaed84052ef57b241c96060d3878", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665525728, "uuid": "f13209d6-5cb1-4164-b19c-b01fb4835a7e", "comment": "Malware payload", "value": "4bcabec27b62127148e5a986ab1d36d6485e686f03ab012d3631be04b82c29f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665525728, "uuid": "b0211b91-b962-44d4-96d3-702095eba21f", "comment": "Malware payload", "value": "bbad1583bea9d1c198d9671f677770dfcbd77a0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665525728, "uuid": "2e390a96-a001-4827-bc1c-ebaaeb605bc1", "comment": "Malware payload", "value": "94c3dc8eb02c1ed7560e8a2df8c3503f46c4905555f4c6430349ca2f1e4425af99e175a3dc86a22b45a68f71adf258cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665525728, "uuid": "2bdea1fc-0014-4bc2-87d1-d9d420743d0c", "value": "T11BF1F812B3A84133EE2A0F376C5353801275E763547BDB9E98C8B12B5E537124AE27E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665525728, "uuid": "72d3ae9a-68ac-41f4-96c5-9d6074e964bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665525728, "uuid": "b95eeac2-2d79-46ff-bf86-67a991946009", "value": "192:N1paLF3mcLi2yQ61LFLsLjLu4QyFffzX:XpQFbLvyP1LFLsLjLu4dffz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665525728, "uuid": "12a1814e-b9c0-4b39-8fd2-1ddd9075d915", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665525728, "uuid": "febeb460-a0d2-45eb-8911-deb3826b71c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665525728, "uuid": "44ae94f6-285a-46b0-b093-413a17439cde", "value": "SecuriteInfo.com.Win32.DropperX-gen.2067.16190", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755cebcc-4967-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1665494421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665494421, "uuid": "b3af31b3-1661-46b0-aa57-39d3282dbbf8", "comment": "Malware payload (GuLoader)", "value": "7fdba574771de04bb6cdfb936ec21d63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665494421, "uuid": "a6094c5d-7f5b-4532-8047-a844a132cd20", "comment": "Malware payload (GuLoader)", "value": "4c920639c2d1ee9383050ecd1248d8877f5d2ae425d293ad13ddb81506c4cb22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665494421, "uuid": "12676f67-cddd-4b58-a219-9aaa5ad60655", "comment": "Malware payload (GuLoader)", "value": "defa5d937b13441af30f46f022086f8077d038d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665494421, "uuid": "a6eed26e-a353-4057-877f-064a6796f962", "comment": "Malware payload (GuLoader)", "value": "4789db91b3a6f9662d8cd889a6e844979846c3b7129094ce19527f20a8f2041efe57c0ac963f627636a24a44bd24791b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665494421, "uuid": "438b2de7-dd41-448c-8f3d-f12d9ed00724", "value": "T1549402223581D60FD97057357D33DC954962BC68B8B0A2EF32D0772E7E37A539A19382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665494421, "uuid": "ca06b55b-cb5d-4f1d-b59b-e45e99841541", "value": "24f4223e271413c25abad52fd456a9bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665494421, "uuid": "73455688-5844-40fb-874a-e7658695fadc", "value": "6144:QQA4cQr/lIKrOzlAnxhRVWM2W0Dwl7cxDq9JrIxE9w/c9r2tLgVEQo6T:hIKcyzRMTwSDq9aT/c12lgVPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665494421, "uuid": "01a2a1fc-0c21-4ec5-8ee3-6c65cb98703f", "value": 411289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665494421, "uuid": "6572cbf5-9383-4ad4-8b44-f45a84bcda43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665494421, "uuid": "a1c66ebf-71ab-4b55-b689-252ff86be534", "value": "BIG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c959a5-4941-11ed-9266-42010a9c0072", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1665478024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665478024, "uuid": "34808d30-10e5-46e0-ad93-7fb9c6283a56", "comment": "Malware payload (AveMariaRAT)", "value": "4a5e405c79acbc4e14ee5555b52211c4", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665478024, "uuid": "57ba9d6e-9146-4122-8c99-335948c77ad8", "comment": "Malware payload (AveMariaRAT)", "value": "4c9f1fab3e68fab2e202019eae63656b90d9742658056bfad67fc9bb3eaad401", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665478024, "uuid": "780c73ee-c072-42a7-8c27-1f6100fe55fd", "comment": "Malware payload (AveMariaRAT)", "value": "40dcae91bce392d9ac72c942363547babb96d7c7", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665478024, "uuid": "958607d1-1166-46f2-8e3f-b46d9899f512", "comment": "Malware payload (AveMariaRAT)", "value": "cd027394903c0769592ed9d0d4e9f7bed75f48cabf46d7b05fddcf589c43882051e0d1d6c1d485e5b8aae095d9e3aa62", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665478024, "uuid": "532f0a7a-c09c-49ef-bd3a-2369dd857e4e", "value": "T14A42E723B398523FDA548E729583DA210B30BD234943CB6672E87A3F5E17B00EE41770", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665478024, "uuid": "d8cf71b8-e3ff-43ab-a1d1-06674da790e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665478024, "uuid": "c40790a1-0664-4336-a640-1e296b0cede4", "value": "96:KeAUtJVC8yKviji/XWi6lMiPdJtetMmeKAOVeAxrbeGsaAA0lka/vPUIeXBDeN0J:KNspy5j2UlNPdJ4/TZVR9icDePUZeqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665478024, "uuid": "e913d3a7-cc30-4272-a00c-ab3fd3c9fb79", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665478024, "uuid": "6430ed0a-4659-4158-b270-2adcfaeb1b3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665478024, "uuid": "f9266c16-c381-4095-95ea-acac28517beb", "value": "Company profile 08.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e42afb5f-49ad-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665524672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524672, "uuid": "e4638d29-c8f1-4b05-ac71-cffbca9fcb39", "comment": "Malware payload", "value": "5e2e7b3f7863f8911ce2a06fab3036cc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524672, "uuid": "f7e6d835-9cf2-489f-95c3-9d17ba5f2dd4", "comment": "Malware payload", "value": "4d4856c6f3c3b401371446fcbcfaed21fe0769de5ba94583ec288db81baccd50", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524672, "uuid": "e81d60b9-519d-4f95-972f-2362ba3f56e9", "comment": "Malware payload", "value": "36b1e25567903f38043f351c714773c36989a632", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524672, "uuid": "23689f21-229f-4f73-ad73-e4682a31068c", "comment": "Malware payload", "value": "6de025cfb1c90f868f998c4fcabe25a592e092990131f6386ca0482d302c64e0dba3d95dffe5e06617bd33fe420bc6d9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524672, "uuid": "c3df57cd-99de-4453-bfbd-1d74621b49ae", "value": "T1F3F69E1273E1B172C16352749E5BB3B46ABAFF329521970F72043A0D7DB26C0EA29717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524672, "uuid": "7866aed3-3b7a-4ff1-9c95-ca9c84bdeda5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524672, "uuid": "9e15e01b-9bd3-4989-bba0-5e09ceba1d3a", "value": "393216:wMnF0gSwwQHg8TPUQfJXZ7JwD2nOMI9ZHA7:7nFjksJXZsMIH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665524672, "uuid": "6b614c3e-1c19-4d53-aebb-0602519aef16", "value": 16741688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665524672, "uuid": "e4297f78-e2e2-4398-a1db-e0401ebdeab3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524672, "uuid": "47c7c559-e75f-4235-8ef6-4b8ff5766094", "value": "4d4856c6f3c3b401371446fcbcfaed21fe0769de5ba94583ec288db81baccd50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a0a42a7-49a4-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665520441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665520441, "uuid": "b0160ea2-18f0-44f7-bbfa-99f1c9d397b8", "comment": "Malware payload", "value": "7c216cf238bfdc997e0b633fcdb92e48", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665520441, "uuid": "5cf44bbf-dd54-416f-aa9d-2e88a750d7a9", "comment": "Malware payload", "value": "4dfcdf228fbf6f9b2521c08c5b2602fec6eea40673c5b1fbabede79c7aa7aff7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665520441, "uuid": "a56dbb58-67a8-4b34-9414-874d38223380", "comment": "Malware payload", "value": "260c4eca900577511c5c938465fd21b42e390361", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665520441, "uuid": "aea85d8d-7223-4def-8ff2-aac4f54aa8c6", "comment": "Malware payload", "value": "f4d71f95f869f64561d474955d612b78b5fa011f9f971aa5fff8369e2deaf42e3c775599830334fd9975988475498197", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665520441, "uuid": "1809b4c7-823f-4194-b4b9-a4f009010325", "value": "T1C4F6CF1277D1E171C06B42784967B3A516BAFF325B22978BA2407B1D7DB32C0D939B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665520441, "uuid": "e01dcb95-7cac-4acc-a543-9296a1eb0a8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665520441, "uuid": "1284c334-0f39-4d6d-a514-ad27064675fd", "value": "196608:yd9JTZksaJ+1orTRtLxuPGpb9wDLaoyU/vZMZH31EZCOZHrc7:yDJTQTRv7JwD2nOMI9ZHA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665520441, "uuid": "e5836b1c-9483-446a-a62d-0216832affab", "value": 16150328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665520441, "uuid": "eb4e853a-5af7-419a-9973-4211e14512b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665520441, "uuid": "00b3d6bd-bec5-40c5-8062-54bd64bc587f", "value": "4dfcdf228fbf6f9b2521c08c5b2602fec6eea40673c5b1fbabede79c7aa7aff7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ff5626-499a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665516216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665516216, "uuid": "661ed5e3-d579-4041-974b-c44aabacce23", "comment": "Malware payload", "value": "9230055e85c4fad66c3fcbb75effec36", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665516216, "uuid": "efbf2f4d-1448-434a-ae76-fb0a5a0cf793", "comment": "Malware payload", "value": "4e14cc0d8897167d7519d5e359d1b39db39db01694729703a9cd3225653e50b6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665516216, "uuid": "9e8af753-8f75-4894-8668-998ef9449b8f", "comment": "Malware payload", "value": "4b22a0e4c0ade9f391dedfdb1f6c8360c844ca60", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665516216, "uuid": "d11b8e4a-d05b-427a-9edc-948c16192df7", "comment": "Malware payload", "value": "988c9e71f9a1ec5b252c1eca40cc1e8aad90bc1c6c3ddb7e73d591e60a33de63312fbaddedfcbf0fa2b467555b52feba", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665516216, "uuid": "4ece0f66-85a6-4c6e-bcb9-13733bb191d7", "value": "T11CA5236530A8C0B4D103547444ABCB62F6B67C2917BA694FBF904E7E3E63BA1E714B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665516216, "uuid": "993c93dd-b1bb-408a-a1e9-bad7c4a361e7", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665516216, "uuid": "8e3f3f3f-f7b2-4998-bcbd-b4fd04ba6808", "value": "49152:RnpEKUacBVQej/1INRx+TSqTdX1HkQo6SAARdh4:1pyfBhz1aRxcSUDk36SAEdh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665516216, "uuid": "c594ce99-16b3-483b-8259-d170bb69bf46", "value": 2191360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665516216, "uuid": "292d0df7-a1ce-4263-ba17-9ee3c8ce5695", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665516216, "uuid": "897ab33d-f48e-4bee-b45c-fd37f0c42a46", "value": "4e14cc0d8897167d7519d5e359d1b39db39db01694729703a9cd3225653e50b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac7bfdc2-4938-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665474327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665474327, "uuid": "6339e9a5-e0df-4be1-be3d-4c01e90e394f", "comment": "Malware payload (SnakeKeylogger)", "value": "81fb83375010b69037a4ce4593059c29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665474327, "uuid": "17aca0b9-3a0f-4e85-942e-95dec56a19d8", "comment": "Malware payload (SnakeKeylogger)", "value": "4efde8646629538aa3d423e120a7b69dccec759f6d1761ad5b6ddae09b0fe04c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665474327, "uuid": "6c2620e8-7f64-4b8c-ac04-9f962b63c742", "comment": "Malware payload (SnakeKeylogger)", "value": "23f5be4354660f5deea90418dbe273a864ab998c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665474327, "uuid": "2eded4ed-abe9-444a-a618-d0edd1ceb5f4", "comment": "Malware payload (SnakeKeylogger)", "value": "613833c08bcc46f2661544f5f5233f9a4f943c77ad625d68ebd5197358824fe35176bef85b24f6b4c5c23c04593aa7f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665474327, "uuid": "c51cde9f-2a92-4c5c-8971-ee4a5363564d", "value": "T174F4D0370BEA8B0BD125B7B885D1C7F2A3E9DC01E527C6976BC65C1FF08A661C621361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665474327, "uuid": "9508e480-ac1d-48fa-b246-c292d7ba0d3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665474327, "uuid": "ba8bdc07-1bb8-449e-88aa-4c8616726dba", "value": "12288:3A72iNEPfolsuhvmGz2VRfnhiwVMKmLdlPveN:W1QwVhvbyL3YPveN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665474327, "uuid": "af4f17e0-582d-4b0c-9eb7-1770083717e2", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665474327, "uuid": "d7dec37d-d98a-4917-aee0-c3347f9542d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665474327, "uuid": "26c8eed3-2e2e-474f-9f93-23784200abcb", "value": "4efde8646629538aa3d423e120a7b69dccec759f6d1761ad5b6ddae09b0fe04c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3171fe66-4958-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1665487865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665487865, "uuid": "cf686b74-d192-4bac-8d8b-045f75b084d1", "comment": "Malware payload (Formbook)", "value": "0ca1b69a96bd66b4ff5597f8df479aa9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665487865, "uuid": "c28b8efe-7b88-4e34-999d-58a6f96e21e3", "comment": "Malware payload (Formbook)", "value": "4f018ef50e478cb150999bd19bc7cdc5047e5a40f4939a1836db5e4089d71712", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665487865, "uuid": "5172bbbc-5501-484f-9cc9-eed51fc1ab2e", "comment": "Malware payload (Formbook)", "value": "2310750effd028ef00a49af3641a8b64930de73b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665487865, "uuid": "43b10611-652d-443c-a615-e6fc3eddbdb2", "comment": "Malware payload (Formbook)", "value": "5e252a3064d5c14f40d0ddfe4137e3bfdfdad49f45464104e62e48ab4ab0f02252c569b305a5e507a7b664fb5b70dd7a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665487865, "uuid": "0dd957d3-7957-4877-b2e6-fd70738132bf", "value": "T11DA1B3380B9C0893D50786F2D6263F221227F2AA9DCF0E85536EFAF1193F0119676F54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665487865, "uuid": "b5b8d2f8-e1b5-482f-b915-9457f1324848", "value": "96:/JqF35OVSgrdc5GlszXFK0YlYCYAWtUiqXE4h0Kxiyb/:xM35eSsdlMFK5lAAW2d0Q0KxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665487865, "uuid": "08fec660-aff0-4d06-ab8c-6cd497994c9c", "value": 4683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665487865, "uuid": "cf6219c3-4008-47ab-8e95-e7e6bbd0c4cf", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665487865, "uuid": "79f3c150-2363-4ea1-bf6f-7472fa32ca78", "value": "Swift EUR 138 928.76.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea33add6-496f-11ed-9266-42010a9c0072", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1665498053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498053, "uuid": "cb228ecb-ded6-4f04-bf49-80a36cc2932b", "comment": "Malware payload (AveMariaRAT)", "value": "9364b4d222cdf84fb1d64cddc2b54d76", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498053, "uuid": "cbad12e6-32b8-4e94-8a14-5f2b92299bc0", "comment": "Malware payload (AveMariaRAT)", "value": "4f2f9ef9fe2d491bcf577970d8221545966862149094d3230c56ec4313a5529b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498053, "uuid": "a52afa48-2206-4e5f-a8b6-20f4969b7153", "comment": "Malware payload (AveMariaRAT)", "value": "89f94dd68636230674855e86fb286138697f8c1d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498053, "uuid": "84ba7489-931d-4afb-be60-5cfdee0fd7fe", "comment": "Malware payload (AveMariaRAT)", "value": "1c73a515530fc8d176a55a1f36d70c1f96c8c0fd3efbbd903648817b871c5adb635931999070b343e03aac86c73eafea", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498053, "uuid": "ec976345-4945-4c79-8085-2a45c55faeed", "value": "T17244D0AC1FEDCE06D65624B9A82A6708C1D3B29D073B5055EF3E3728F1E9F42781E641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498053, "uuid": "3ceed8d8-476f-4eb7-a8f0-73b8b18d6c10", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498053, "uuid": "df71cd46-57d3-4fed-acc2-f87978769199", "value": "6144:RNeZCuUOb+Ie1QGpbEKOj/77BaManCiYi0zpyi:RN7uCpnO37gMICDiy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665498053, "uuid": "31543457-31df-4f67-83db-339c9a333bc3", "value": 271994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665498053, "uuid": "ec209fb2-e5f5-4745-82a3-5d0322f19bae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498053, "uuid": "b51a48a2-0968-4eff-966f-7e95d808e37b", "value": "from-imgMBTDOC0.EXE1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a82802f-4933-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1665472069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472069, "uuid": "27602d62-895e-4d39-bad5-543b6c0064e0", "comment": "Malware payload (Amadey)", "value": "da3c5e5fcab7da1eff36118243392b99", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472069, "uuid": "a48e8e42-0985-4507-9c70-7942064e06eb", "comment": "Malware payload (Amadey)", "value": "4f6c62edaefbf759cdb1c848ecac90ed248501be5876d0a62c90a86322ff14b4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472069, "uuid": "c42e5590-dd96-4672-9621-e8f81e9c9ff3", "comment": "Malware payload (Amadey)", "value": "4b0ada84e88a97311df43a6312cf87f1466db2b9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472069, "uuid": "ae0d1cbd-da85-42e8-b962-b771b2aeaf1b", "comment": "Malware payload (Amadey)", "value": "3d4d6057fdfcd3879a5fbc9b6a03eb0d015ed43219b2239b031aa119e7f5c7d24badf2e02db4d136ead85b3633c06226", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472069, "uuid": "36fbfed2-3bd7-47f9-9e71-9fdf38f039a1", "value": "T1FC54CE207692F8B2C00511704416DFE32BBEE9315964C6873B691A6E6EF32806F76F5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472069, "uuid": "ae4abf65-de9a-4c85-b23f-2182126134af", "value": "d432ab96c0953f4be1f6b5eda702e7f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472069, "uuid": "ecff3a1a-a8c1-40aa-8ff5-b04883cd904c", "value": "6144:AzgNwp6jUqfLCYc9JHR5AOX3/rrwVfquS:AGjUcWYUX/Td", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665472069, "uuid": "c4f35a39-cced-4685-a3e3-dfa61a3b6a17", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665472069, "uuid": "442810fb-badf-49a1-8550-f027d3820f4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472069, "uuid": "d3555abe-4b1b-4e32-b8e5-cb4a59792143", "value": "da3c5e5fcab7da1eff36118243392b99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fdde87d-497d-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1665503700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665503700, "uuid": "3a1146ee-1e1b-48e0-a54a-1d17b4123468", "comment": "Malware payload (RemcosRAT)", "value": "ebb80429c2ab3a4b98092d9681c83a0f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665503700, "uuid": "20c8939d-ff18-4c9c-bf2c-7679a949b0ef", "comment": "Malware payload (RemcosRAT)", "value": "4f7e671c26e269961ffa6a6639a5522b66c06c8c119bdfb297797473bb7b4cbc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665503700, "uuid": "f211c485-07f8-461a-bd12-4da9469cf9fe", "comment": "Malware payload (RemcosRAT)", "value": "ff42b517c77a1e7fd1e8c133cdc3702f455e2a2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665503700, "uuid": "65b29e9b-4bf8-4ab3-a4dc-b658d9971845", "comment": "Malware payload (RemcosRAT)", "value": "589356b0f14959ce6f1c6f7249573ff3d73065ac884d03170bbc7ac2df398a2fd1bc1ca259b01839d8c27fd1e5ef250f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665503700, "uuid": "259feb93-8378-402a-b58e-26508751d889", "value": "T1DC64138516A4C57BEEF28B722D3E1B15E7FB2C122478221F37440B89B4639D1BD8E359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665503700, "uuid": "c140fd94-6d39-4610-8ab5-2f7212907932", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665503700, "uuid": "973936c9-f377-4c07-8447-38f31f60d589", "value": "6144:HNeZm2smfQ8gA3mXO5cOZuIpkgaB/uPLDmzxxznqJRMVYaWp2Oal0t8FqD:HNl3mfQq3/JX0QLDi/zsaaz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665503700, "uuid": "c5a0bbaf-593e-4c26-8ad4-453fbce72462", "value": 330682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665503700, "uuid": "14598ca3-9b19-488f-8145-37625d2df766", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665503700, "uuid": "17a1f1e4-2d9f-42c2-93aa-96b2c676d7fd", "value": "ebb80429c2ab3a4b98092d9681c83a0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c2f9184-494e-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1665483668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483668, "uuid": "0682a19b-c4a5-4d83-98d1-e62568f2ee67", "comment": "Malware payload (Loki)", "value": "4852a190e8e3a53a2939820ca1c072fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483668, "uuid": "2b2e9fa1-eb68-4e04-b908-612c6bfaadf1", "comment": "Malware payload (Loki)", "value": "4fd08e621dd3e7f5f3aa09d04caebea182836ddf051693b2cae080cb671cd672", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483668, "uuid": "240a986a-edb9-43e3-9ddf-a0c5eda3ee70", "comment": "Malware payload (Loki)", "value": "390723c31b2ba935fe00be951e79e15863ca3da3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483668, "uuid": "8bfc51f7-d4af-4fff-b1fc-862dc423ddea", "comment": "Malware payload (Loki)", "value": "53a1f2c7676ffea6f0d3029626ea96bbbf6efec30f34e30ddce9005f261966f7cd6dcb5773eb653d7312ec77ac5edbab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483668, "uuid": "d261a21b-98f9-40e4-9bcc-cb4d15a03a5c", "value": "T14715487A26854A07D9543274CC83D1F32BFBAD68A132C1DB3AD72F5FBC512BE9502246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483668, "uuid": "12851143-290f-4b5f-829a-1080f145ff4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483668, "uuid": "8e2f17dd-4157-4778-a100-03b86d57fbbe", "value": "12288:/VwAvY8aJWNqZf3gl4GhSrz4/V0UCC3Cy9AwAQSQy4A:9Y8aJWIZf3gl4GSrE90/wCyfAtQy4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665483668, "uuid": "5b9ef004-3f53-4712-b87c-cee3587d553b", "value": 932352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665483668, "uuid": "d83974a0-b0f7-44ac-bbe2-50c646b889fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483668, "uuid": "88817d01-3f72-4a62-80bd-b6562e974dfb", "value": "4852a190e8e3a53a2939820ca1c072fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e29351c-493f-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665477122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477122, "uuid": "e515dedb-7ddb-4912-b962-ca0f60d62346", "comment": "Malware payload (SnakeKeylogger)", "value": "2ae30c21ab4afb53d617cddbe61b2ebb", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477122, "uuid": "769b5ae6-de04-4116-862f-9a347546e795", "comment": "Malware payload (SnakeKeylogger)", "value": "50381504610fe0169b5c3356308cd7138429542bfb85c4bdb12b643ae445f1de", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477122, "uuid": "2f6954be-1bfa-48f6-9058-2bdd4be8de8b", "comment": "Malware payload (SnakeKeylogger)", "value": "c3949a2384a5664e7cd22c46469142346d922f46", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477122, "uuid": "2c0c54e9-2a9f-447c-ad0b-84c1b8848156", "comment": "Malware payload (SnakeKeylogger)", "value": "19607655277738468a36bf9afac881807d81154651fd333c2462af8428f61c93baf2374558104ce8f332963877392989", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477122, "uuid": "617badfc-6746-497b-ab83-83b1262c72a5", "value": "T11DC3E147A1316E51C565D772C78F203A982E2D885638E225E9C0B969D336FD13C3CB6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477122, "uuid": "a5e23205-4069-477a-8070-930b1f6c7c07", "value": "3072:oxi1WYrIED7WdZ4ovcJ5j5ipH/WLb3tR0vrEPbu5FM3bb/TpTf:/IoIlGvjgQzfwMb2M3bpT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665477122, "uuid": "735e4458-dccf-4ec8-a12f-9653cba745dd", "value": 119560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665477122, "uuid": "c2546e90-ffbb-4c0e-9ae9-f0b89747ed64", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477122, "uuid": "f286bf4c-ee9e-4141-b257-96d65c252924", "value": "APO-074787648.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "600b0484-4940-11ed-9266-42010a9c0072", "comment": "Malware payload (Vjw0rm)", "timestamp": 1665477635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477635, "uuid": "4964b127-5014-4ebc-8bc7-8d030c109407", "comment": "Malware payload (Vjw0rm)", "value": "a3f0fc528a20dbcacfb69e1b69907a4b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477635, "uuid": "f6fe2ce3-efe1-4ebe-a362-1eefa5a131e1", "comment": "Malware payload (Vjw0rm)", "value": "508b21cb602b5a3e9e19eb6ba9e010fb0d4a743d18e4a869063f72e2454324f7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477635, "uuid": "b6e52cdf-72df-4d52-b4e6-516b46df8edc", "comment": "Malware payload (Vjw0rm)", "value": "400c75cffd7342908c1282b862d3df10d5a95e65", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477635, "uuid": "880488d4-c615-47c4-8831-66902c200221", "comment": "Malware payload (Vjw0rm)", "value": "e6c841e0ea9995c9feb3f9f215acf769ff06d80d07f499afb30322fa7fc3185a6b4854c5481a1c2196e42585fc0b5756", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477635, "uuid": "543e87cd-0e3f-4771-ad36-3e58fd1456ed", "value": "T16EB3CF0CB95BEB568B0A730A10F9074F3F97424C96A62077FF9E8C4E3BA701C96156B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477635, "uuid": "046454e2-4b70-4cc7-964e-c144c1c4a803", "value": "1536:W7KmfMkwheMurpzqwPUSvf0cCF11blV6DmEJMAB/iJuoG2446rTCRLTiR6RccQ:o2Mrqe7C/0vB2uo96/U/XPQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665477635, "uuid": "b2e43f16-bea5-4bcc-ae50-42915517efc5", "value": 115776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665477635, "uuid": "60f347a8-0a6d-4ca1-87fb-e74ec1283e2f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477635, "uuid": "dd13d2b5-1fb8-48a5-8d44-e474ee6c0c9a", "value": "transaction-statement_632ac8d3-e96d-a443-8227-db1e5339fb8c_de-de_381b3d.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bcda39e-497f-11ed-9266-42010a9c0072", "comment": "Malware payload (Quakbot)", "timestamp": 1665504579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665504579, "uuid": "4db818cc-05f0-4373-9557-efc9870e230c", "comment": "Malware payload (Quakbot)", "value": "69b1c830226f8f4331fc7686ba2ef3f6", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665504579, "uuid": "e1fbc513-768b-4d68-b8ec-ccdd9746355a", "comment": "Malware payload (Quakbot)", "value": "510450b841820750db3a1ea7d9baefb07ea83912949b2cba28e0ca3d7bad1adf", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665504579, "uuid": "e3afa8e0-881a-4644-9904-ce87e254497a", "comment": "Malware payload (Quakbot)", "value": "ada9bd1b5f293333efc00a1a554cb761d2c77414", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665504579, "uuid": "7bd22a82-67c0-4329-864f-c9ef71e082d3", "comment": "Malware payload (Quakbot)", "value": "d526011d67b31960ebfa2001fa4b7c8d30189566ba52b878ff142bd86d146db69249b1bc48aab351d5b664e6616dbfec", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665504579, "uuid": "29340d1a-95ff-4040-825e-cafbf7617d75", "value": "T13025026F4D53E8A44FACA77DB93B09A8370794ECA1AC10D9DF44F0A2B6C183D855F489", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665504579, "uuid": "d9b94048-8a2f-4d84-a53b-7007c2693430", "value": "24576:x4loBmSrZ9+FL+U5bcD7wHpBlpLP7aT3u:td4AW7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665504579, "uuid": "0e5cd337-46a7-4329-9ba8-c7965d36af27", "value": 975334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665504579, "uuid": "d83459b2-8d37-4d01-a826-1223dbbd1daf", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665504579, "uuid": "e8572eaa-3c63-4ca5-8a0a-212503f558f4", "value": "RFSL_4026.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b639e137-4979-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1665502261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665502261, "uuid": "af1cea42-7a9d-4de4-b10e-ae237beabd38", "comment": "Malware payload (Smoke Loader)", "value": "94c6ad8cf97c3f3651dfd705cb15ee14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665502261, "uuid": "1a35e9a3-59ae-4b92-9c19-070007d7029c", "comment": "Malware payload (Smoke Loader)", "value": "517072da74d8adbca6028938348cae30d6c8f8210cb29fb7bc184042bdc39640", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665502261, "uuid": "cb0d48ed-f295-4be6-b7f0-f1c3b7478c23", "comment": "Malware payload (Smoke Loader)", "value": "05974d1bc2813055a61c8a4425710b4a07061a53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665502261, "uuid": "e4251375-ddad-4829-8727-d0259a0ed225", "comment": "Malware payload (Smoke Loader)", "value": "7af03738f75dea317b231aaa900fba31bdca500d0c2cf4acc2ee5950a8d245bd7efc54a32f1ec0dd9b6527fe7da6e117", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665502261, "uuid": "1b0a966e-ee30-4e56-82c8-3b0d2c37e799", "value": "T13F24CF1236C0C073E26226398C65C6B46FABFCB55A35568B7BC81B6D9F353D29E21703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665502261, "uuid": "ca8adfab-90a8-4dd8-abba-f2071cb23d0f", "value": "2466deca3b013302337885751cf37be4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665502261, "uuid": "ea6ed61e-9221-412a-9803-04212845c523", "value": "3072:/p1TaTLT/0FyL94CPJs82t81ATjXhK16GJGcShb8tAsr6JaLO:/SnZL94Ca8gXhTGMcSZcAsNL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665502261, "uuid": "39094ae9-6c13-41d2-a301-f4e768044d63", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665502261, "uuid": "1123d8a2-c7b2-438f-8432-eca4cc6540d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665502261, "uuid": "cb263f29-c090-4dc4-b24b-ab0b7be48638", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b038eead-497c-11ed-9266-42010a9c0072", "comment": "Malware payload (WannaCry)", "timestamp": 1665503539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665503539, "uuid": "6c4eef2e-7abd-4a9a-8f56-47ed98dfffbe", "comment": "Malware payload (WannaCry)", "value": "b661c322cd1dd540fb6d1bf7b6dd027a", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665503539, "uuid": "55608ad1-0767-4a95-92b8-31a067288bd7", "comment": "Malware payload (WannaCry)", "value": "517a6237dcbc13bcb0d6128b40c9e982232ce7612c079e95ad5e855c33ac8a37", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665503539, "uuid": "e38e1d2b-5046-42da-8e94-685f3dbe8acf", "comment": "Malware payload (WannaCry)", "value": "a97b98e0e3670b338ba3398bf2ac8bb2d5f5c416", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665503539, "uuid": "b5f44211-8450-42bb-b05b-86fa4a640e9a", "comment": "Malware payload (WannaCry)", "value": "bd043372509f140d6a38db5904c7cc3035e3281a01574cb7b38f653dd3505c396ce21d28972759811e0480a8867f1a31", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665503539, "uuid": "582f6ace-244c-4510-8730-b956e6e1a0ac", "value": "T132F533E4A121B7ACF2950EF90466C55B368724B5BBEF2F2AD6C005AB1C44F6F8FC0585", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665503539, "uuid": "b785f706-28bf-4c72-a9da-07ce9ca94334", "value": "68f013d7437aa653a8a98a05807afeb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665503539, "uuid": "75ce614d-80b7-494e-93fd-787b09ac0afc", "value": "98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:QqPe1Cxcxk3ZAEUadzR8yc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665503539, "uuid": "7c76a62c-d213-4a4c-8db7-706a97600849", "value": 3473408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665503539, "uuid": "fe56c900-da11-4b93-84d3-dd40b84734f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665503539, "uuid": "d9c53926-a853-4d7b-821c-9cbdd9bcdc53", "value": "517a6237dcbc13bcb0d6128b40c9e982232ce7612c079e95ad5e855c33ac8a37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2301da1-4957-11ed-9266-42010a9c0072", "comment": "Malware payload (njrat)", "timestamp": 1665487651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665487651, "uuid": "787ec211-71f8-4a54-a1bf-02586df520bb", "comment": "Malware payload (njrat)", "value": "3286393b5bafe3f1f1e8014060d5cc99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665487651, "uuid": "64982d03-e768-4de9-9843-90f80542820d", "comment": "Malware payload (njrat)", "value": "5262a00b102fae801da7d448cba6bb4daa350cd6835096897de2f51085f9545d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665487651, "uuid": "be4cfe71-37ec-469c-9808-e72f9c745ced", "comment": "Malware payload (njrat)", "value": "087aaec41b638223a44e1584f502c556969e8b97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665487651, "uuid": "476a9223-80a0-4183-8932-19bbcc8fe480", "comment": "Malware payload (njrat)", "value": "6eff9eb873f1292e18e4c2c37659b787cb6395df507ea6477097ccdbff2244a3d81baec7d538986eed2d9cad3ccb3b44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665487651, "uuid": "ad9ef4ed-e330-46e6-985e-35264ff6ec4e", "value": "T1B3D42D7D8A99823CCBFFC7B108D29283067596C287126EED44C257370B5B6477712AED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665487651, "uuid": "fb388f34-bd86-4f83-9c33-33954e99095d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665487651, "uuid": "ab39c1ec-a9c1-48f5-9c68-14d346ba0584", "value": "3072:vN0ufW/mmuPu+PGGPWvnPnXf/nvmvGfP+/v/mP2P2uPGOD/ffumfv3GX/OGu2Hel:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665487651, "uuid": "63c65b25-784f-4c68-a121-5fe16a8f2843", "value": 634368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665487651, "uuid": "59af6381-8e57-45bc-b577-cc15d6d0f7ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665487651, "uuid": "fc3b6058-4022-4e69-bcfd-f14348c3796d", "value": "5262a00b102fae801da7d448cba6bb4daa350cd6835096897de2f51085f9545d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "546ffd8c-4960-11ed-9266-42010a9c0072", "comment": "Malware payload (WannaCry)", "timestamp": 1665491360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491360, "uuid": "559dd39c-dbf1-4e59-9f75-2315af8eb8c3", "comment": "Malware payload (WannaCry)", "value": "1eb27790bcbf66fe3a211749c7d29984", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491360, "uuid": "b76781a3-512e-481c-8a6a-1f1af843c1c5", "comment": "Malware payload (WannaCry)", "value": "532a04fc329deed06aa317b0c7fe4848cf6f1651b9980b1d2c9a0cc49b81f349", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491360, "uuid": "d4300434-7e63-4523-ae43-b66d5bc7fd3b", "comment": "Malware payload (WannaCry)", "value": "5c1af66ebbb64d910f041de44a33ec256afa3efc", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491360, "uuid": "6da9b167-8116-4761-a4d1-3af683b52a95", "comment": "Malware payload (WannaCry)", "value": "20c160f77b0a848de8ff23725168cd1898bcca561a56eac174ac148c124580ae2263186d02fe654f24285cc3b026454a", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491360, "uuid": "2624cf89-12cb-430f-8112-d1635536973a", "value": "T13B9533E97071A7FCE3062DF944AEC953329574B965EF3E01DB8004AA6846F5FDB805C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491360, "uuid": "6ae554d9-9dd9-49f5-9b31-988237fc8751", "value": "49152:rMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvm:rPoBhz1aRxcSUDk36SAEdhvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665491360, "uuid": "f16523d4-79cf-4be1-8c63-7db6c826e4e9", "value": 2061938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665491360, "uuid": "9df579ff-db90-4a95-8a79-2ac155c8204f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491360, "uuid": "fd603545-c19b-4ff4-8fdd-09409f1d9252", "value": "532a04fc329deed06aa317b0c7fe4848cf6f1651b9980b1d2c9a0cc49b81f349", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0ee8ec-4947-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665480581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665480581, "uuid": "aab31692-2ef8-4198-812b-e279136bf6da", "comment": "Malware payload", "value": "531f43d53a5c4b61adbf03b171b54270", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665480581, "uuid": "7a3448f5-5be8-404d-bb39-a28ca9d03b1b", "comment": "Malware payload", "value": "541c733595b3282b051a43d17ef5a5bb889f3ffa53a360917fc0a8913db3b651", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665480581, "uuid": "4686ec4b-21f4-4fd8-9c40-1dd55c9993ab", "comment": "Malware payload", "value": "f3aea990722a351a6d9c65684c3d91f6c8b49030", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665480581, "uuid": "8fd0bf9d-f4c2-4c21-bc5e-40dd4d964b37", "comment": "Malware payload", "value": "b162ba9eae59e50dc74699b5024ea08eaab2552e7561498da1693a6b5e592462633c39233341d8dcf328650558f1dae4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665480581, "uuid": "107ed5a1-5549-49c4-8b1f-d34688ec40ad", "value": "T1C3763374F56145BDFA21AA75CEAC2FC162BAF5992910903B3368113C39FE3C251272F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665480581, "uuid": "532ed293-12a4-4dd6-9fd1-fdb01fb8a5ce", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665480581, "uuid": "98cb3523-203b-4a9c-a7fd-40e47152e783", "value": "196608:91O2D3S5iqpUfRd7QLPMNW824jIQIbWPWYkyTPqlPxQ7vE1:3O27sxrMhKbausqc7s1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665480581, "uuid": "6a2741e7-953d-4bcd-89f0-39240e8128b8", "value": 7603824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665480581, "uuid": "d54ef01e-b3d0-4d98-981b-046a4c164cd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665480581, "uuid": "eff38557-4235-4d22-9398-539d83032412", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb99cb90-49ad-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665524711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524711, "uuid": "d1fd644c-e7f8-4550-9cae-d07b36bbf522", "comment": "Malware payload", "value": "aaecf87989cf669f4b88e67a55e234d6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524711, "uuid": "dfd6f6ca-e8c6-4940-b0db-47956e69caad", "comment": "Malware payload", "value": "546172e0cd61c74b7cd961f722026ea899158e351e2f585a3c6584307ebf43b5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524711, "uuid": "c8fc7702-c454-412a-8f2b-744b34ecadc5", "comment": "Malware payload", "value": "3491bfee826bea7d27d8d91235ab7aa200d73238", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524711, "uuid": "e265f232-dd8b-4b0e-a5c7-4ed112de1137", "comment": "Malware payload", "value": "84c48f2830d0285eeb9e32a665b2ae4de866b48a8f0f8de3246cd9cc00e732c2d20aa3e64df41d801ff5d588f9241196", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524711, "uuid": "bb8be438-e22c-4a8b-a4dd-0c14456d92f2", "value": "T1D1969D42B7D1C075C0AF02398C76A3DE1276FC629F2282E732947B5E6D76BC08971766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524711, "uuid": "3f9ecb05-42f7-4a60-8c85-ca8bfc65cfa2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524711, "uuid": "b62270c1-32f7-4515-abaf-c0d1a871d171", "value": "98304:CLu1g9ZGlWrfTZmHqXE9ssD/QjI+1ozfLu1TIRtUOV5ZK3psErUtgKpjF:Cd9JTZksaJ+1orTRt23psErUtjp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665524711, "uuid": "4af9fc70-dbee-44d2-a00e-4b968e9c379e", "value": 9166336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665524711, "uuid": "50cac1d6-d687-4ecb-ab65-2491bd9868b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524711, "uuid": "485213ad-fa02-44c7-8415-e0c002d3d141", "value": "546172e0cd61c74b7cd961f722026ea899158e351e2f585a3c6584307ebf43b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b13193ee-4970-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1665498387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498387, "uuid": "0b02b78e-c024-494f-9934-c9d49016f11d", "comment": "Malware payload (RedLineStealer)", "value": "665d61c26ec588e55a9bc7741fa75554", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498387, "uuid": "efe0a55e-3648-4139-aa72-1d1b47698d17", "comment": "Malware payload (RedLineStealer)", "value": "54c48351a11dc9d960b9956e9897ccc3b2337b25d573c0c1dcbfc0e0c85c0118", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498387, "uuid": "afd767c1-0866-4aa0-b5a5-110a9af3dae3", "comment": "Malware payload (RedLineStealer)", "value": "7c909d8e4b219b4383a8c63d1771b7af4041a866", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498387, "uuid": "8eb806e7-812e-49c8-be27-903d968c0742", "comment": "Malware payload (RedLineStealer)", "value": "92c3ab3df2c9978c2cb1a1459408d8ddef68a3c84cfdc39df0a4c60e203ce48bcf77882bc9f8aeee3bdcf17449059b8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498387, "uuid": "21c0877f-24c2-4829-9e21-797225d8156e", "value": "T1E6145CD827C9AD13DD7ECA7DA470A05187F0A563E952E32F1DD060AE1E62BC8CD11EB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498387, "uuid": "07ffddff-cf9b-4062-9620-51467c0d5bce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498387, "uuid": "3e7e355c-5d4c-44da-85da-815f076d7d2a", "value": "3072:CYO/ZMTFXdfomTSjOE1oW4ZVjDFWXRP9qhFSSros5G0hvJ:CYMZMBXdfoXKEGWCgpgh7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665498387, "uuid": "c19954b3-827d-4924-9d31-56b8ee8bb1bf", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665498387, "uuid": "c210c509-add2-44dd-9458-6f05f4777a89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498387, "uuid": "05b50b67-585e-49ad-86ed-737e42464ac9", "value": "54c48351a11dc9d960b9956e9897ccc3b2337b25d573c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d9b9e8-492e-11ed-9266-42010a9c0072", "comment": "Malware payload (Xorist)", "timestamp": 1665469880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469880, "uuid": "ab6ad3c1-7b36-48f6-9c47-a82a93c1a568", "comment": "Malware payload (Xorist)", "value": "953a0e8fc493465d0d186dbeea1450ac", "object_relation": "md5", "Tag": [ { "name": "Xorist", "colour": "#EB0FB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469880, "uuid": "6179825a-4afb-4316-b9b0-93a894b90560", "comment": "Malware payload (Xorist)", "value": "54dd94b75549efe6824143d4ad7ff79489b8c150f610c9b0609e75e5baf6b964", "object_relation": "sha256", "Tag": [ { "name": "Xorist", "colour": "#EB0FB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469880, "uuid": "cb2186c1-5125-495b-80f5-b1879d009d63", "comment": "Malware payload (Xorist)", "value": "e3dae9dae2ffcc6136d5151e3350cbb9672b3b2d", "object_relation": "sha1", "Tag": [ { "name": "Xorist", "colour": "#EB0FB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469880, "uuid": "70fa95a8-9c26-4608-a043-7991e7813379", "comment": "Malware payload (Xorist)", "value": "0d02d9666b47605dcf6c1f080e2a1a64865ab85cfc7cca648b87298f4897a54aabc65f3b1c258db580394798de5629d9", "object_relation": "sha3-384", "Tag": [ { "name": "Xorist", "colour": "#EB0FB2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469880, "uuid": "672f8d01-558d-441d-9226-cedaaa245a65", "value": "T1A5D4A7D4DFD6080BC8288F36542CBB9E8A1D577537678A7B61AAD0C907CD6D2FA0D09C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469880, "uuid": "b9da59ce-c312-4b94-a3a4-a42413a8b006", "value": "d9d5609df8f39c7ce06f045defa2e1ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469880, "uuid": "bd4348ca-04d5-426d-98d6-3299323f3f33", "value": "6144:mrYSYomWS//JmcZiWE58TR45SYomWS//JmcZiWE58TR4:4YomWS//JmcE2YomWS//JmcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665469880, "uuid": "0573cf6d-50c6-4adc-9f61-e961146ada38", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665469880, "uuid": "c96d8a98-8b69-4245-ad0f-c32e054222a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469880, "uuid": "f6eadfd6-98e8-40bd-9e25-a3696f26fe3e", "value": "54dd94b75549efe6824143d4ad7ff79489b8c150f610c9b0609e75e5baf6b964", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54440479-494e-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665483628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483628, "uuid": "9c0df923-d4f8-46a7-bae1-b1d6c958d397", "comment": "Malware payload (SnakeKeylogger)", "value": "7a819d32ef546814e228b5964b5b3c78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483628, "uuid": "f1533857-80f2-411f-bd8b-fd9a71782b62", "comment": "Malware payload (SnakeKeylogger)", "value": "552b11b82396419c3efd98ecb70657b2d7652d061bbd5d626e478812a65925ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483628, "uuid": "896a04fc-1251-487a-97de-20e69cee559e", "comment": "Malware payload (SnakeKeylogger)", "value": "666482fef570cf229e609153c96ee496f658d2aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483628, "uuid": "8c70c768-a226-4014-b1fe-db0a1556a1c7", "comment": "Malware payload (SnakeKeylogger)", "value": "7b35915aeff86cfd1f426dda83a1ec2d1f7a9638a0278dd9463e15c265320d0dabe4d4b8f9f48ff2fcef2fa5c2aa49f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483628, "uuid": "15e9133f-abc2-4f90-b487-52581b158910", "value": "T1C3157B7E16994607EC293270C483D2F32AFB6D606061D1CB1AD72F9FBC552BF961234A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483628, "uuid": "6dc0279e-0b41-4370-bd89-57ae88cd688f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483628, "uuid": "23ea99d2-b5b2-4791-8a23-d21c0545ed4f", "value": "24576:VD+uQcLMo/04D5mMTvGbM7kyxgxh0AtQy4A:VD+MLM+kMrboxhNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665483628, "uuid": "efd7d160-0a6a-43a2-ba3d-166f3da1154a", "value": 951296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665483628, "uuid": "02992ca4-702f-4c71-8746-65555332bdb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483628, "uuid": "c89f04aa-bb9b-4c89-8832-f98be97254c2", "value": "7a819d32ef546814e228b5964b5b3c78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "362903a6-4930-11ed-9266-42010a9c0072", "comment": "Malware payload (WannaCry)", "timestamp": 1665470693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470693, "uuid": "40a5d161-8d3e-4a45-bb36-f74680609802", "comment": "Malware payload (WannaCry)", "value": "5ba9a77f8212b09d214c8916ab9b9132", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470693, "uuid": "6980b41d-dda4-46dc-aada-b9ac25edd507", "comment": "Malware payload (WannaCry)", "value": "55a8efc280e43aa66f88441178afa4347a198b53d634006d7d28f27e013a3592", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470693, "uuid": "8300ffb4-a72b-47a6-bd30-c42d0c13d2fb", "comment": "Malware payload (WannaCry)", "value": "b8ef11f88f1264b996f73a92e91a7ae1b41fd537", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470693, "uuid": "b5f12726-e2a3-4eaf-8b6e-173a5965503d", "comment": "Malware payload (WannaCry)", "value": "94cde30af42d833a8a546352de72ff93ac9ac1e7337655a41268c7774086276b7f0472d62c26447651c458445f665955", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470693, "uuid": "132a7e1f-7163-4253-aea0-1b78a0b141c0", "value": "T14EF5D041BB98C1B6C38F01398467A72BA637B5615B30D6C7B3541EAD5E313D2BD3A30A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470693, "uuid": "7602a0cd-97d4-4bfd-a454-1b8cef16b76c", "value": "68f013d7437aa653a8a98a05807afeb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470693, "uuid": "ff2dab51-0803-4d17-af0b-5e281d203fbe", "value": "49152:nQbKUacBVQej/1IN076eFaHHfgYDTOcF+mtAhZLhQvub6ENHtZqgvuz:QZfBhz1aqFanf5DTO1ZLhQv5ENHtZql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665470693, "uuid": "55259851-28d4-42eb-a5fc-3cc7f67f412c", "value": 3514368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665470693, "uuid": "3e06af9e-5949-4880-8f89-15921032ffb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470693, "uuid": "0c0a0e9f-6cb4-4447-862c-7f16c827c48e", "value": "55a8efc280e43aa66f88441178afa4347a198b53d634006d7d28f27e013a3592", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c84a99e3-4940-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1665477810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477810, "uuid": "8aff5138-0510-4c01-9c79-3ae5f0552b85", "comment": "Malware payload (GuLoader)", "value": "aabe5c937189c08538b176076d51d910", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477810, "uuid": "c4889fce-e4c6-4bcb-8fbb-bdc673bd7448", "comment": "Malware payload (GuLoader)", "value": "569639aa4a8d4f7ad4f544175c30e6c6eb1ed148bba777f85db1ff849721f99c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477810, "uuid": "12ca61df-fbb3-4666-8ad9-fb35a05a0452", "comment": "Malware payload (GuLoader)", "value": "743c15ecb3d99ca57cdbbb0a3e7794001df01302", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477810, "uuid": "62d44237-34fc-4fe5-9fe8-b5bc7955d175", "comment": "Malware payload (GuLoader)", "value": "ee99ba5fda276e75d6f23586857555e5be1150173ad45d0f06da17816bcf48f1caff98bd1e7dd2fb50162678d6b47118", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477810, "uuid": "e199fa2f-b35a-4954-b016-e660948f58bf", "value": "T19EC3F106B170C4B3C5B50270487AEB7FFFBFD055449D1B47AB902E863E634868B2E256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477810, "uuid": "ce330053-983d-4845-89b6-3871796a516d", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477810, "uuid": "558df2f2-4a60-4aa2-a7f6-64f68e66b8cd", "value": "3072:WkBGWOsTIJgIDU5A/cmub1dMl9w8+4eo8FUZmfQcFfXPZlI/GY8:W1ssjQ1dMEH48FYcrfXRlBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665477810, "uuid": "c26c635e-441a-4132-9e0e-d6bb8f5d7b86", "value": 128296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665477810, "uuid": "ad274705-9e16-441b-ba65-18802a215b67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477810, "uuid": "9d62390c-6a86-4e80-8f70-1e880fc932a4", "value": "E-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb304ab-493b-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665475729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475729, "uuid": "552b4d50-d3d8-46eb-b63c-1891f8e91fda", "comment": "Malware payload", "value": "115917ab29c9a132c8687eb3897757e9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475729, "uuid": "f26ada93-305d-4de1-a14d-2f81d0182b4e", "comment": "Malware payload", "value": "56c8e2653cadc0ebecfc8816f877bddd6885e25f8638fa7b0771e39cc017677c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475729, "uuid": "0db27dd5-441c-4799-8429-52e2195ef4e6", "comment": "Malware payload", "value": "8f338513f14e66d2eef483e0ea12143c8e22f768", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475729, "uuid": "8517dc2f-e376-458a-a5a2-314e9056f88a", "comment": "Malware payload", "value": "b7454fd7e1b7d18cd7909a0b831c1dd4486ffe6b09fcbc064b7ff224e3a9556aa0ca49d6eb2bd0a52c56d23349932982", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475729, "uuid": "40050574-402e-4053-a49b-451708b4893e", "value": "T17CF4D6D293F78F45F09E67B898204215C6F9E534B6B7EB1E4F04A9AD1816B40BC60B73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475729, "uuid": "b6f32557-d278-473b-8b15-c6bf7570951b", "value": "12288:h0OfN7IAz7ADp6xRPOfJrhjNRC6KEyJ+o45Q4Isxewcc6AbFmKhNS:h0Ol7bop6xRPOfJrhjNRChooWQ4Isxe1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665475729, "uuid": "eb4a2501-eb92-44a4-a685-ad7ccb3c058a", "value": 759348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665475729, "uuid": "dd7cada1-98ab-40fb-becb-bd8a4d0242b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475729, "uuid": "7e7b8f6b-046c-49c6-8356-92ec97c3475a", "value": "56c8e2653cadc0ebecfc8816f877bddd6885e25f8638fa7b0771e39cc017677c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e86e4823-494e-11ed-9266-42010a9c0072", "comment": "Malware payload (Icarus)", "timestamp": 1665483877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483877, "uuid": "4c51b02d-5569-47a2-9517-cd3d4a6e7560", "comment": "Malware payload (Icarus)", "value": "d6ac3194d5eeaa95567b0dd49ceb08d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Icarus", "colour": "#24DF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483877, "uuid": "45857867-f8bc-4419-adab-5891d0958793", "comment": "Malware payload (Icarus)", "value": "56d73691ecf9a482beac4e8d0bae27abb8ff938d20f59989af5dbff34a2f8706", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Icarus", "colour": "#24DF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483877, "uuid": "11bab25e-3f8b-49a7-a772-b01c52f6b703", "comment": "Malware payload (Icarus)", "value": "86276f06f9915dd6308e9d81eb282d090460b013", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Icarus", "colour": "#24DF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483877, "uuid": "a02f328a-0ab5-41ad-ae56-4d0459553d0f", "comment": "Malware payload (Icarus)", "value": "682c0762f6559b55a962b4c59af46ff7288dd9f4755132ee9b3488022779f49febae74ca0d9d07edbc8bd4d654ec3ed4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Icarus", "colour": "#24DF59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483877, "uuid": "249d2e1e-42fb-4ed1-89c9-7a85ad2c0e7b", "value": "T1BC22EA1293D44371DAB6063239A3A351CF31E6575C168B6DB4CC920FBF726068363BE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483877, "uuid": "a8979456-36a1-4021-b264-22954ebde9b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483877, "uuid": "8b863fbb-fca4-4c3b-b731-8f393a9c2d72", "value": "192:SrG1pzt/L08LTcGXLKLx2vshDpJiS8uj828dzYcLe6ygF9sw:YG1pz1LZLTcGXLKLxDHSuj82iYcLPyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665483877, "uuid": "93d13b18-359f-4b9f-b740-f1cc2e016e92", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665483877, "uuid": "30da3327-ff20-4191-9453-db7864e3d8ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483877, "uuid": "a5dbd2e4-aaa6-4869-84ad-7a43a33a7a52", "value": "56d73691ecf9a482beac4e8d0bae27abb8ff938d20f59989af5dbff34a2f8706", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a877ae8a-4947-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1665480763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665480763, "uuid": "65f89a22-edd0-4d77-96c8-0fce8000f28f", "comment": "Malware payload (GCleaner)", "value": "2c26ec66b09196d1bcc387a6e4c999d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665480763, "uuid": "e2bb51b3-c92c-4592-a167-09b3ca8e3c18", "comment": "Malware payload (GCleaner)", "value": "56e180a89542f119e9a1ea6b1822651e2e35bab9fc23c1f045f988af67c5887f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665480763, "uuid": "ffc4ccea-b5bb-4395-9c02-199ae05fe2d5", "comment": "Malware payload (GCleaner)", "value": "937660865f3e17682539edc65f2d28ec7b7fa4cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665480763, "uuid": "0699502d-561d-441c-a738-52f55efc2b87", "comment": "Malware payload (GCleaner)", "value": "2bda974aaa04cf0ba1eb8c5ee36e1bc1f2998c0e03ee06a2a72f3e59be949f08503e02ec795631725f6ce6fdd61ea5fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665480763, "uuid": "efabb489-59c2-42ca-894f-dedc6b957956", "value": "T16874F1123994C432E62670358C70DA712EBFB8755A36468B7FE8466C8F257D2AF34387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665480763, "uuid": "4decd876-a926-47e3-9bb5-e54ff0ae4811", "value": "f07757163332cdbf737bafdb4614222c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665480763, "uuid": "ef5f805f-07e4-4b5f-949f-5955eded0d9b", "value": "6144:IyfoHL3ZA6EFk6msTaDx9t8TMFHNaVydMCc0Yz8HRF2w11P:IyfoHFA6p6taDPtlkoYWYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665480763, "uuid": "ff1e5481-0fe1-4979-b1d6-68dfe99999c8", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665480763, "uuid": "2f5431ff-bae0-4536-99c5-d19692e9e690", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665480763, "uuid": "0eb4cfd1-8887-42fa-9940-1520ad2a5c56", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ff9755-4985-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665507166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665507166, "uuid": "b3ba5d60-c9f0-45fa-bfcd-09b7f3d31fee", "comment": "Malware payload", "value": "ed9d35d322fa741f0bac0b6160be795d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665507166, "uuid": "9373855c-6c97-4071-bf09-3e8fc0c6c2e9", "comment": "Malware payload", "value": "57010882c49e6a6ec8fff4664eb8df03eb4cfb19d5ee32b3f973f03330e69cdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665507166, "uuid": "539fcad6-6a1a-48da-a9b9-d4dbc1ed538f", "comment": "Malware payload", "value": "9dd78f486eabbb7db125dcc728d0b0689f1938ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665507166, "uuid": "a52b7df3-c913-4132-b858-0faad95c28d4", "comment": "Malware payload", "value": "44df9547cf6e9545b71debb8263669d5afa1dcff85204cffb531245ac4d5792d5ca69df4b85822a76c0c53579bcca37c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665507166, "uuid": "185c95dc-a72d-4f87-a319-2af7ff60a08c", "value": "T1EAA6E1F4A1BB80D2F6479D812528BDE1067231B3ADDA0838136EAB04CFFFD953545A5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665507166, "uuid": "90e87c85-b7c1-415f-af44-0dd998b2149a", "value": "98304:jkx6WGD15XH5lvyNMHm1v1e6+bd8v5N5zw0eZj55c8SOEwK0FWLk7tGuxUrGC5h:Ynu1lHjyNMHm91eR8v5fiiB0DTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665507166, "uuid": "5b26ec50-bad0-4d25-9474-bc74fd7fd70c", "value": 9737216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665507166, "uuid": "28fc003e-ffe3-4fbb-a4f2-830c1709c5b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665507166, "uuid": "1fd39506-0cfd-4992-bd87-43cb32af5210", "value": "NEW ORDER OCT'11 2022-3406944888900422991.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a223ef14-495f-11ed-9266-42010a9c0072", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1665491060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491060, "uuid": "08698166-1f53-450f-a80b-fc7303f29e62", "comment": "Malware payload (AveMariaRAT)", "value": "b7fcbb8bad6d0b7829a81cb09b5465f4", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491060, "uuid": "5e03532e-5b91-4f40-8e13-1b8326686fc2", "comment": "Malware payload (AveMariaRAT)", "value": "57738c267a1b4151e020c2b803cb97ec90adf53163e3936abe58a8c58cf5d9be", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491060, "uuid": "217f3119-e23d-4613-9219-36f88d3bbb28", "comment": "Malware payload (AveMariaRAT)", "value": "445026eb5798cb7b19a4bb0981b4113dc5c4eb63", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491060, "uuid": "9ddec0e9-78bb-41fe-b2fb-e4134534c59c", "comment": "Malware payload (AveMariaRAT)", "value": "4ebf00264279b612d17f1ec48686353725be5ab62f8a78c856bfb3b32a988a05ac5b0baaa074e1e9395951316b413474", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491060, "uuid": "a26df6af-2eae-41ca-b6ea-0e9e3ed7a36d", "value": "T13745E1276BC68B90C9B477FB7398A6A8A3F2F1CB0300DB1B590D11F1BB53386355A255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491060, "uuid": "b3d2557e-88d9-47db-a1bc-6f2c9b598d58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491060, "uuid": "ea8067d5-951a-4a48-9541-b063bb8aea56", "value": "24576:SNriy/fTF3wHsOzj4j85M1hUQDAxzJX44g07:SNtTisOzj4jGM1aK4FXy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665491060, "uuid": "dbc77960-99eb-4705-b6ed-4404791128a1", "value": 1175552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665491060, "uuid": "3011ba87-8d0a-4ce8-ad64-b0d063b5225e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491060, "uuid": "e191006f-0408-4d9f-9ccb-9c354e0f9aef", "value": "SecuriteInfo.com.Heur.MSIL.Pretoria.1.13191.18621", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1381ba72-4979-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1665501988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665501988, "uuid": "be4e4aaf-fb57-4603-9a83-41e623f0ee62", "comment": "Malware payload (Loki)", "value": "ae93f6119326234f458a24903806b299", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665501988, "uuid": "e6a5b797-352e-4005-aa16-7ed59ecb8ebc", "comment": "Malware payload (Loki)", "value": "587522728615a4ab4812cbd3cd7f43df4ced696945aad8e8854dfdfa1538492d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665501988, "uuid": "a9b2e841-3207-4cab-a1bf-287c395ad139", "comment": "Malware payload (Loki)", "value": "9de9e2625baeae7d65bbd679dc1dd7a9675f1ae5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665501988, "uuid": "4ecfaecd-8b66-4052-af47-c829aa51fd89", "comment": "Malware payload (Loki)", "value": "0ce2ca585161f836e115e4537b9f91d53233388e37f11e53f0d7a7666ad0f0f38f616983073ac7cb52f4f70c4e82d2d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665501988, "uuid": "c951aade-3af0-4219-be2b-a26960e299ff", "value": "T13004124524E7C0B7D1A68B761D3F9725BBB6B22619F4531F23203F493963781EA2E342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665501988, "uuid": "8ecb43c1-5e14-44f4-b6ad-2724046e4950", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665501988, "uuid": "f0c2a36a-a14a-4aef-a232-03525a502634", "value": "3072:l1NjcVVnLpPunb+jdQPQ/A8ZhEwNDvdGipU1JwU/uJNg53xgpKAvEGXJYmpnVRp6:HNeZm+jdQPjpgvlp7mug5B1UECrxVbS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665501988, "uuid": "80d9e029-2b61-4965-b6a1-0dc79316d3d4", "value": 189040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665501988, "uuid": "c063b48c-e6df-4c77-b323-f98f2708f8d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665501988, "uuid": "9175f088-f9d0-4d00-b019-6ac868653bc4", "value": "REMITTANCE_SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f43fa6-4940-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1665477759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477759, "uuid": "80dd0154-675e-4284-b1d5-7f064c242ee5", "comment": "Malware payload (Formbook)", "value": "2d6f49107279b29519ea84adf2cd0527", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477759, "uuid": "43a0da93-6d1f-4611-9100-e13ca3b6aacb", "comment": "Malware payload (Formbook)", "value": "5889119a534e859a9b8e7a5962d1daa883ce6057e2b83334c50d005e93f36ae6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477759, "uuid": "ec6da6dc-51b0-4904-b322-f19dcadc3806", "comment": "Malware payload (Formbook)", "value": "c06be095a35e23e2c8ae5cec70b7e14e1ed70443", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477759, "uuid": "9504c084-8781-45dd-8ee2-e7db54cf61bd", "comment": "Malware payload (Formbook)", "value": "4e506566d590398a7520573513b442321539556119eb7be19d62ed72837d81754268e37bae4f2ca647719ac93f8e576e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477759, "uuid": "ebe17a67-efa0-4104-b046-7a585321199b", "value": "T176258B7E16994607D8253270C883D2F32AFBAD607061D1CB5AD36F6FBC542BF961234A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477759, "uuid": "f05cb4fa-ff54-4323-942a-68a8fd799326", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477759, "uuid": "377ff9b8-71e5-459b-864f-1b08fc7617aa", "value": "12288:eEwTfxXwxY0PrM4KdvZWqhglYlV/WvqHc3V5RGb0uSuEg21AQSQy4Ah:lY0Eg2zOSHc3V5Ri1AAtQy4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665477759, "uuid": "5448afe4-958d-421b-82ea-46630c7d8d97", "value": 1016320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665477759, "uuid": "9a37eee8-07fd-4fa9-a69b-9f9d5640486d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477759, "uuid": "53f3fc9d-83f2-4fb7-a910-b2547b26224e", "value": "HSBC Payment Receipt Voucher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17a649bd-492e-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1665469783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469783, "uuid": "95cc52b0-6ce0-46c3-9597-2ac66c867619", "comment": "Malware payload (Mirai)", "value": "aca59b367ebc9bfa5802790accd3bfe0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469783, "uuid": "474aa9be-0af3-4574-bb88-2348e9a67d4c", "comment": "Malware payload (Mirai)", "value": "5a3e7d4e7fd0889955f850f665f6dbf4135c962189772d7b46ffa9b995ef81ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469783, "uuid": "b7bd74b5-726a-40ce-9e04-f8382180ecf8", "comment": "Malware payload (Mirai)", "value": "b46389d5891a4fe2990e501c18f599f3ee85de08", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469783, "uuid": "9ce80554-05a7-4662-a6a9-0037af86cccf", "comment": "Malware payload (Mirai)", "value": "1472a7e6e1e1eac7a62e4a6e9ad290d3eca110321669b271551b4e1b354637bf069eebef7cd4ac31dbd0190ab019a865", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469783, "uuid": "714b9a26-d6d8-459e-9a01-8c5f806969ab", "value": "T142E2E25CFBB27C46C8BD7CF3A14F126BE64B5286128F472DE7304D8A564E256F448139", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469783, "uuid": "e9899f83-b181-49b3-a9ac-b34a2a4afc4b", "value": "768:pys0rbunM2xtJAiRiOTx5ejGSAwTOtHirgWQ:YuDtJAiRXTSAymHiO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665469783, "uuid": "bec6ec6f-1ae1-4738-9266-0efde1bed76a", "value": 32036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665469783, "uuid": "b216de01-dd6a-4d2a-ad0d-f26e05c697aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469783, "uuid": "0b03c345-a0f5-440a-9b1d-eeb62bc78ddc", "value": "aca59b367ebc9bfa5802790accd3bfe0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "656008f8-4918-11ed-9266-42010a9c0072", "comment": "Malware payload (NominatusStorm)", "timestamp": 1665460464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460464, "uuid": "f0fb3b13-9ff3-444d-acc7-399286c7083f", "comment": "Malware payload (NominatusStorm)", "value": "4a6b46d302f3217a87bd273791d2569f", "object_relation": "md5", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460464, "uuid": "13b2cfee-cdb5-4c16-bfe8-ba7941e8dcce", "comment": "Malware payload (NominatusStorm)", "value": "5a9664de14c405fce072634b48e05f2e543539b18cb067ab761454ed687690a8", "object_relation": "sha256", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460464, "uuid": "ecc15a1a-835e-42ae-b804-bd01d8a19bc2", "comment": "Malware payload (NominatusStorm)", "value": "a962581f09f58878cca287f7bb77319fd0ab5296", "object_relation": "sha1", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460464, "uuid": "7aca48c4-5a04-4429-8a52-11e973a1c728", "comment": "Malware payload (NominatusStorm)", "value": "e4ef2cdab289c750d9a36624d8147ca63a422bdfdbc5fe39b6928d6aa6235f12b2f37fabfc96eaea5f21cf1daa3555dd", "object_relation": "sha3-384", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460464, "uuid": "3c7cfb3f-795b-468c-bbd9-9ff4b61fcff6", "value": "T135740705B7D4D532D57F473A4E63D3881671F9A3DC63422B30E4AB6E7E302904D92BAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460464, "uuid": "d18c4e95-da58-42bb-8725-8451bad1886d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460464, "uuid": "348dd699-9d12-48d1-a593-93bb56f011ab", "value": "6144:e98L598L598L598L598L598L598L598L598L598L598L598L598L598L598L598c:lKKKKKKKKKKKKKKut89TsmYFZ2qrO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665460464, "uuid": "4fda1535-3220-43a7-9866-5db0f7a7792f", "value": 356368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665460464, "uuid": "c2028331-c44c-4c6b-a7aa-b14b5e1adb51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460464, "uuid": "80cab13c-49de-4dbb-980e-02a0267b8733", "value": "5a9664de14c405fce072634b48e05f2e543539b18cb067ab761454ed687690a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f87cea1-4952-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1665485258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665485258, "uuid": "589cbcfe-0c5d-4706-b6c3-4fd9d492dd52", "comment": "Malware payload (AgentTesla)", "value": "b1e52a30cd02c69aec7553bdcfacd149", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665485258, "uuid": "f157c850-c1d0-4000-8eb6-0f2aa287393b", "comment": "Malware payload (AgentTesla)", "value": "5b312f6c8aaea04ae089007f9429a8e651bb73fa2069fb9418d0fa85f04f7c17", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665485258, "uuid": "2ebe8d96-8adf-4b6c-b44e-61c4509b9d04", "comment": "Malware payload (AgentTesla)", "value": "f88059e4a2e45743a646294310bf3269c0d33b13", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665485258, "uuid": "9356671d-88a7-41bf-b91e-137cd4253cdd", "comment": "Malware payload (AgentTesla)", "value": "9d90ca46763f52b229abbba1c0b1fd3bc81c04ae86e5f184975ee3e52f79c2dcb9aa2bb91d3fddbc16b5d0b19365055b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665485258, "uuid": "345111ac-048d-4868-9cdb-72bcb2cbcc69", "value": "T146E49DAD761072DFC85BC4768EA81CB4FA9238BB931B5217D42725ED9A1D887CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665485258, "uuid": "416c8dc5-913d-4e64-a1fa-e503f1d9158f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665485258, "uuid": "07642ba8-985a-497f-9b7f-d5e8da6e6d18", "value": "12288:QTEauu2iNaLDAVenuEkgpx+ufw0Ot+L9sFV4FCmdqjJ5nWHyTMbNiQuHuzw:iDuu1QTH5n/O7FdmYjrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665485258, "uuid": "d53cf60c-bc4e-49cf-9e96-8fcf3d42d0ad", "value": 709120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665485258, "uuid": "f3ee24cb-8173-4a51-90e3-c101baa60f6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665485258, "uuid": "0075ac42-f33a-427c-8f07-6999e712e9eb", "value": "shippment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd59f73-4927-11ed-9266-42010a9c0072", "comment": "Malware payload (NominatusStorm)", "timestamp": 1665467112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665467112, "uuid": "c86b50ea-1d41-4eef-886b-bd2a0a46a825", "comment": "Malware payload (NominatusStorm)", "value": "e8938fb3ba610356082eb3ae1e5086c5", "object_relation": "md5", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665467112, "uuid": "17c6f064-4616-4335-a819-e0fea0f3b8c8", "comment": "Malware payload (NominatusStorm)", "value": "5c93731a1ccb92e98ae9b3a7dbfaaf3ea9444e23e67fbd54c02ca2cc49a35cf4", "object_relation": "sha256", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665467112, "uuid": "49ed3fca-e251-417c-89ca-4ee22e6bb157", "comment": "Malware payload (NominatusStorm)", "value": "a6a1a2c1968a91814f7deac5e54949584ccabe42", "object_relation": "sha1", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665467112, "uuid": "018ec7b9-4d6b-4fce-968e-908054cf8b2d", "comment": "Malware payload (NominatusStorm)", "value": "0cf7ba1df6426ffb4ffc14e23ac269c39ae5ac94d750443aebe260cea8ba987bfb81a8dc4c4b90419da09007760150d9", "object_relation": "sha3-384", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665467112, "uuid": "6b0a6319-55dc-415f-8816-da17388981bd", "value": "T1D4A60192BB918076CC5F0F3648A387567632BC22BF1346D336A87B2D7C772D046762A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665467112, "uuid": "797aa00b-580b-4068-b591-f1e41ef6bc47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665467112, "uuid": "e2f6911d-8930-478d-8df6-4dea2d602f1e", "value": "196608:JikgcchGqdPofKsIkzHLqj2L3FCGRbki2O:JikgPGqlDgcowGRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665467112, "uuid": "a3b1589f-c498-4a19-a222-55510b142c0a", "value": 9566008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665467112, "uuid": "647366be-082f-4e04-9f1c-0e63ec6a17e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665467112, "uuid": "48b606a8-ee2d-414d-a57e-c7ecd58d0194", "value": "5c93731a1ccb92e98ae9b3a7dbfaaf3ea9444e23e67fbd54c02ca2cc49a35cf4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf3fecb-499a-11ed-9266-42010a9c0072", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1665516150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665516150, "uuid": "0802487c-64b5-473f-9565-9c6a7969e171", "comment": "Malware payload (AveMariaRAT)", "value": "df1fc07a0fc0ce859dbda2390519a8f0", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665516150, "uuid": "0697e8d3-b871-4349-8938-764cec34cad8", "comment": "Malware payload (AveMariaRAT)", "value": "5cbb2697a315b04b71fd3f5e5b13122827bef573869fe0d594de05e42db9f7f9", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665516150, "uuid": "86f9d9b7-344d-47be-9c69-1e4d61c7d4ac", "comment": "Malware payload (AveMariaRAT)", "value": "2aada949aa95b49f3663530960b7281b33ce9d5f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665516150, "uuid": "45a502f3-cc81-4c27-8a31-5ea7d4c5bdcb", "comment": "Malware payload (AveMariaRAT)", "value": "8614e80678f1c03e490cbb7c781bd30692b9076b6140dc6d3298c89e9d499bfa13615b680e03ce5f659697462d6a4bf2", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665516150, "uuid": "97b2413e-d4e0-4e0f-9f18-053152246b5d", "value": "T1A14401211DC4D453C09A0F3192B37377CBBAC61264B65B2B2B938E5DBD36D81EA1E358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665516150, "uuid": "b9aa3d43-b319-4e35-994a-6c58a013528b", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665516150, "uuid": "4d15e641-72ff-4265-8eef-c1de3b840ad2", "value": "6144:RNeZK0ylr/28KYKjWeHlYznEy/meM22Rv3A2oLB8W54ESaAOp5EzWu:RNxcJjWeHWLEqFH2WB8cTSaAOp5Ez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665516150, "uuid": "c5292698-a630-4f13-af71-22c2fdc51c0d", "value": 271912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665516150, "uuid": "1cfe6cd7-560a-4773-9992-82bd7d80974f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665516150, "uuid": "bb8884ec-1206-4d88-8be0-353586ff35c7", "value": "BFM-720-7388372883783888278.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "015f49cf-4901-11ed-9266-42010a9c0072", "comment": "Malware payload (PurpleFox)", "timestamp": 1665450418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665450418, "uuid": "e827891a-3e84-4605-858a-94f70637fb95", "comment": "Malware payload (PurpleFox)", "value": "dacef68df7c7333c8ad24ee9bef99c2e", "object_relation": "md5", "Tag": [ { "name": "k0kz-ru", "colour": "#964702", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665450418, "uuid": "2df1a885-3f5b-499d-a4d8-f184d036cbde", "comment": "Malware payload (PurpleFox)", "value": "5e69ddd2de5b4dda8beae8b1288ed1a540006053fccd63d32c85157e1decc71b", "object_relation": "sha256", "Tag": [ { "name": "k0kz-ru", "colour": "#964702", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665450418, "uuid": "69643352-f842-42db-bc10-94e99ecd2556", "comment": "Malware payload (PurpleFox)", "value": "506f9dd4055caa2aeafcf60e58317422280c1524", "object_relation": "sha1", "Tag": [ { "name": "k0kz-ru", "colour": "#964702", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665450418, "uuid": "8e0f7549-a8d4-43f4-9a4c-0e9841016ea0", "comment": "Malware payload (PurpleFox)", "value": "de20860c571193f6c879e1785fa71a7d6b031b454f48ff81ebbc9e7c55cebca2fcb4a88b73305448569d868f76315c1b", "object_relation": "sha3-384", "Tag": [ { "name": "k0kz-ru", "colour": "#964702", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665450418, "uuid": "7c183cb8-81c4-4570-a775-eac1e08c9b97", "value": "T19E92D56A5E0A03FCE75F5C5501CA2FD3CBDED12F291E6D9678C6281E745AC09B8E18B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665450418, "uuid": "6462d738-b7b7-493b-81fc-581db1a1ff44", "value": "384:TWiY+ZjnvPFNI0M6vKKH2C7DwaVxlP/nw7/Xe0kdNqc1VC:TdY+RvPFeuKKH2CfwexBnwzzkdMc1VC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665450418, "uuid": "c1bcc2df-699a-46dd-98bd-8fb3ddb1c494", "value": 21059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665450418, "uuid": "9eb47ff6-17a9-4719-86ed-8603c03a77fd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665450418, "uuid": "543fd0d0-f341-4671-b80c-28596906d523", "value": "i(8).php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b0cedb-4907-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1665453031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665453031, "uuid": "574a6e5e-b483-4db7-9e03-9f5997de4ea4", "comment": "Malware payload (Mirai)", "value": "9b1c978a953f68583eacc9e3af839226", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665453031, "uuid": "9be0a8a7-c8ab-45fe-82cf-b384be33e43d", "comment": "Malware payload (Mirai)", "value": "5f0dd09ee48e43f2521d291a3e12d7b41c161d0408eb15c258589904980e4fb1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665453031, "uuid": "04cb17fd-9651-42a0-a822-4a271bc2ae29", "comment": "Malware payload (Mirai)", "value": "2dd2d174479246a90a60f40ee248709b47f1918f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665453031, "uuid": "87e0fb19-188a-466d-ad3d-709742de435c", "comment": "Malware payload (Mirai)", "value": "b3be53836dc61e5609e7d74f09d4df0639058a133ca1dc7681cbb5a3506d5e3adac2a20db0feb06483c3ff73017e1088", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665453031, "uuid": "462c5d02-a2b2-4647-a551-75f72113699d", "value": "T103436BC4F643D8F5EC8705702077FB379B72E1E922A8D647D3B4DA32AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665453031, "uuid": "c08ad2e8-3146-4b14-8e92-ccbcddd9524e", "value": "1536:JeESt/basV2rcZhG6ySN7naIpW1ZzWOIaEjrqMJs:JeESt/basVTgS7naIw1ptXES+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665453031, "uuid": "548c3998-1dfd-47ae-9f5e-d3f49c9a4fea", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665453031, "uuid": "15f12e86-f4e5-4a44-a3f6-801a3ab9037c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665453031, "uuid": "0d984471-0009-4f24-9799-0e4a44e1a936", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f9454f-4947-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665480563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665480563, "uuid": "ae6b6b8a-6cc8-4ae6-b77b-ab71376da6ad", "comment": "Malware payload (SnakeKeylogger)", "value": "8e4fe0eba2f621e42e82f6bee8dc20a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665480563, "uuid": "84acc39d-0a4e-4a02-8427-d06892081ad1", "comment": "Malware payload (SnakeKeylogger)", "value": "5f35ca42912431ff5592f1a2913e4136a888fc9c04f1655a2c52998a5d2161ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665480563, "uuid": "8d977116-f07e-4b47-ab16-4cb575603634", "comment": "Malware payload (SnakeKeylogger)", "value": "415256344e274c46edbd030cdedc1e04e4132467", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665480563, "uuid": "607fde92-4274-4129-b6a0-271ca79d2902", "comment": "Malware payload (SnakeKeylogger)", "value": "2b41513383a147f00908992009fb54f50bfc1b1c5111de56f1a99d8c056f2d73d482fa849ce44616ebedc21dbe5bcda4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665480563, "uuid": "a1ba41a4-457f-48cd-909c-88d7ae009e10", "value": "T1C5256A7E269A4907D8153135C487D1F32AFBAD506062D2CB6AD72F2FBC413BF951238A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665480563, "uuid": "ca736766-ba30-42be-b6cd-76080369582b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665480563, "uuid": "5ae80fb5-cbd5-47f1-bfe3-408b7050bba1", "value": "12288:kw0GC7UsCAoE6kiGUen0JzuRb0JA0ka++jAFe6RAQSQy4AR:sGG/6zGUW0FuRbgka++cFeaAtQy4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665480563, "uuid": "dbfd71d5-fa0a-4826-a708-a7de9086cd3d", "value": 1003520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665480563, "uuid": "8350161b-74d7-4c22-981c-e433569c124c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665480563, "uuid": "8ee0e5a8-ea2f-4abc-892e-72bcaf5a5297", "value": "8e4fe0eba2f621e42e82f6bee8dc20a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "621aa294-499a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665516293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665516293, "uuid": "9fea0ff4-e48f-4491-9f66-55934d601529", "comment": "Malware payload", "value": "ea1b0c2b8cec16c6a41ee9f62b8f8a2f", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665516293, "uuid": "fc01ec3b-0550-46b0-b637-63a9398ba25e", "comment": "Malware payload", "value": "5f3b61ec8bb616562e56257f61ecd25d07778dfc65a1c0feb843169e6ecd38ca", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665516293, "uuid": "aa1acdc5-c678-4b41-ad92-5a2eaa4ba3f5", "comment": "Malware payload", "value": "196d8b6419af6af71845338d9492f3b6eb62d153", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665516293, "uuid": "1e893983-135d-4fc5-b82b-51fbf152dbc0", "comment": "Malware payload", "value": "91d7c0c5e6f18eba7ae96b3b7973a61c59a67cceb0c3119cbeb438298db7b9b42451ca926ce6d2181811444c1e620756", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665516293, "uuid": "1df2926d-0c1e-445c-aedf-3b47bc515b1a", "value": "T140033D5E16B60532C263712D6FAB6A04763BC10B180DCA1E3CADA7D05FD153D4ABAFB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665516293, "uuid": "f3acff66-4b1d-49be-b17a-77fc0cf09b39", "value": "768:Ev8GGIBrs73VR2kXcu1uQZbvzvg1Nstys+EdF:E02rCSK2T4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665516293, "uuid": "26c4cc6e-9205-4ed8-9e92-6f94e46a5cb8", "value": 40872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665516293, "uuid": "db974b12-9902-4d2b-acec-265e44412c6c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665516293, "uuid": "710411ff-7c15-4ed0-bf84-0b8d4d3fcbe4", "value": "What_is_an_open_book_agreement (lpl).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e600dc0e-492d-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1665469699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469699, "uuid": "b10aee00-b1ca-4808-9dd4-aecb76a2878a", "comment": "Malware payload (Mirai)", "value": "7a6a7d409ab5ff4effa0b2f93259a417", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469699, "uuid": "428af259-952c-47e6-a60b-7825c1ebb16c", "comment": "Malware payload (Mirai)", "value": "5f5d2b5ed2475c229f9f9694d168b1f78a65af790ad9d149076d5f0a8b5d6535", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469699, "uuid": "1af6f37e-2e14-481c-a44d-79d94e6170d6", "comment": "Malware payload (Mirai)", "value": "8ffffbf44db48bd61c8b5ac8a1805c2009c2537b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469699, "uuid": "a2da2fa4-55af-4714-9632-fe901edbe7b7", "comment": "Malware payload (Mirai)", "value": "73b3bd6001407953ca55e21bdb276eaec9f2e35b0bd6939273864b1a9c2cf5f5748c4946c9629770e3c10d6cc72f7ce2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469699, "uuid": "da7fb6cd-c2b6-4695-918a-eccf067098cd", "value": "T15DC2E119ED996641C320C9BE97FCE202145213F8FBD136A12E1213FE477F99A18B8D47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469699, "uuid": "d8642f77-d212-4c93-bb30-c5b5c860742a", "value": "384:tR3r0Hhg/0LFuvf2CsK1wT5eY5JFGlNqEjHRZL2CtsN/juS7GhymdGUop5hkNh:tR70BLBHcEw8FGqEzRR3MrSs3UozGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665469699, "uuid": "982f7110-4646-49a3-87ac-918c465d3ea5", "value": 26312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665469699, "uuid": "5ed8f571-3c6d-44fc-abb1-d19bf6353a98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469699, "uuid": "035e2000-daf5-4c21-86f0-ec0380eadde6", "value": "7a6a7d409ab5ff4effa0b2f93259a417", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abcbaea1-497c-11ed-9266-42010a9c0072", "comment": "Malware payload (NominatusStorm)", "timestamp": 1665503532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665503532, "uuid": "f2ad9dbb-8276-4d4f-93db-296fbe3877ac", "comment": "Malware payload (NominatusStorm)", "value": "74aa4f5857bf44680d9fa8b86f6f5705", "object_relation": "md5", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665503532, "uuid": "ef14c737-cd74-40bd-8863-591b956fa0a6", "comment": "Malware payload (NominatusStorm)", "value": "5f824d1d4d37c41b270f4ec275b8df51c2d0cc28bc55cd96092653de2687aca3", "object_relation": "sha256", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665503532, "uuid": "5ef6d0a3-10e0-4951-bfcc-daed9a7175c9", "comment": "Malware payload (NominatusStorm)", "value": "e72accda4aece3442c0a2d9ea5819dbc72cb51ff", "object_relation": "sha1", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665503532, "uuid": "5a287e28-e9ca-4014-a550-cfd3cba11cea", "comment": "Malware payload (NominatusStorm)", "value": "08704b3521bfb3f863f23cfbf8839a5e29ac062fa85c25ea51306e73cde751763bc22f8cf1367f75e6ff582528f4e059", "object_relation": "sha3-384", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665503532, "uuid": "c8f8746e-5c03-4041-ae29-343c0467e8cc", "value": "T1AC96C0963BA5C06BC46F033258A1C38A3272F4A69F1243933499A73E7DBBBC44D715B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665503532, "uuid": "f9819903-d4de-44f8-aa24-669b661d20d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665503532, "uuid": "767c4a37-7d0a-489f-86ed-72a51957ece2", "value": "49152:ajLuSh3i+FtvkMzT+TIRl6ftjnWbLrxU0Wq83hg:GLu1TIRlClurxU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665503532, "uuid": "b88beac2-2a6c-432f-ad93-7a62d91a0707", "value": 8962048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665503532, "uuid": "cb1125a9-7518-4fae-9c98-150aad4914b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665503532, "uuid": "bd6e4225-a0a4-4172-90c1-60027da2779e", "value": "5f824d1d4d37c41b270f4ec275b8df51c2d0cc28bc55cd96092653de2687aca3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb272ad-4939-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1665474573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665474573, "uuid": "057c9406-265d-49dd-8283-68d4e389a477", "comment": "Malware payload (GCleaner)", "value": "e81283f0cd5468ff535d5ccfc0c90612", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665474573, "uuid": "9a89f09a-bb24-4ad7-a4d4-dad45cb98c72", "comment": "Malware payload (GCleaner)", "value": "5f9a01202ab0db3309e8285d83252cef4b81b9cd832a9785a18098761d97f427", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665474573, "uuid": "695b675f-16cd-421e-b6d8-ea19bd8c39a2", "comment": "Malware payload (GCleaner)", "value": "d2f30e83af8debf167634bdfcdf0599aa0da061c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665474573, "uuid": "19cb8e7f-99eb-4ad8-b317-584573ab486c", "comment": "Malware payload (GCleaner)", "value": "234ad8e7ff51a573dc3a1e5143f55035b585cc4ad14f1b4622d534d39bc59f2e1286f1aa3dd7474fce0cdf31c22e2523", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665474573, "uuid": "a30a2107-e7c8-4151-816b-3b2912ded674", "value": "T16574F11139C0C432FA6A75388D65DA706FBFF87419215A877FD846AD8F266D1EE20383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665474573, "uuid": "283eae62-dcab-4e1a-b655-91b7d08446ac", "value": "f07757163332cdbf737bafdb4614222c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665474573, "uuid": "24062a9b-e0d2-4303-bed4-cdc8f6d3770b", "value": "6144:bEfIYLX5GdV87FfVA7J4DxF8Gi1sg5qelnazgwCIo9scV:bEfIYlG/a9A2DxF8Gi1sg5f9FwCISNV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665474573, "uuid": "e75095b7-7f0f-40e0-86aa-c2d884b293e4", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665474573, "uuid": "5c7efb4b-fc3b-4e7f-a227-62ec578cbdb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665474573, "uuid": "bed587a8-98ed-4fca-8b04-1de30a447447", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57998d16-4971-11ed-9266-42010a9c0072", "comment": "Malware payload (Quakbot)", "timestamp": 1665498666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498666, "uuid": "035ecac8-6dc7-4fb8-8dbf-2ceaf570afb5", "comment": "Malware payload (Quakbot)", "value": "10bfddea67b45ba4b8439f1fb5147796", "object_relation": "md5", "Tag": [ { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498666, "uuid": "edd6460c-019c-448d-9a20-696d0d4340bf", "comment": "Malware payload (Quakbot)", "value": "5fa048bfec7dccf343b60224d2212cdc19a4b04db40b831d7a7d79568fd1df5f", "object_relation": "sha256", "Tag": [ { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498666, "uuid": "4b762e26-c6d3-4e9a-b020-c9d6d24ab83c", "comment": "Malware payload (Quakbot)", "value": "1e185f4a0ee125efdda2543e6f8f0f2f60929794", "object_relation": "sha1", "Tag": [ { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498666, "uuid": "f61402f0-39e9-429d-a0ae-2890fb1bf044", "comment": "Malware payload (Quakbot)", "value": "606570170eeaccb988835161216af0a0d01c4ec8e6177ebf67d293c8a337e07d2aac93c890635d674afdcf39c3893f12", "object_relation": "sha3-384", "Tag": [ { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498666, "uuid": "29b4b88c-5657-453b-85c2-bd140ebe24d1", "value": "T17EF48E33A1D084B7D12A1E78BD7B9268482A7D206F74A94B2FE41E4D4F399C13E752D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498666, "uuid": "63ab413c-3f68-4371-9caf-bc957b376e52", "value": "dc4e58cc3b4290a5b1fb2b2659f5959d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498666, "uuid": "86d6885b-efa9-499f-8a39-07fb312f8440", "value": "12288:e+4QHixeljmtjVFJcPp+cygICZoxlSr9o6q65UZXJMeGbX//9OT:5DXjmtjVD3cygICZwSJo6q6qZXJM5T/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665498666, "uuid": "4a680f5a-f198-4755-ae7a-6a4375f07891", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665498666, "uuid": "1a056a6a-2fc1-4f8b-8542-e2adc7959bea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498666, "uuid": "13c87353-eac5-4f4a-a588-7eca3edb4a82", "value": "coercible.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b0eafd3-4983-11ed-9266-42010a9c0072", "comment": "Malware payload (njrat)", "timestamp": 1665506403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665506403, "uuid": "ca357b59-2998-4337-afac-c906dd027253", "comment": "Malware payload (njrat)", "value": "e6b50e399eeb427f01dfec104e8cda5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665506403, "uuid": "9c4d565b-32f8-4db1-8577-1dcc72b57b0c", "comment": "Malware payload (njrat)", "value": "60dcad6ab951a06c869184647ef9fd530a49f1d24a6798f79ce3c47fc4039c38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665506403, "uuid": "aed61862-f7dd-462e-a308-f406a9223121", "comment": "Malware payload (njrat)", "value": "1f9bc5d2d8992df42e9ac9e784a346fe4185edbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665506403, "uuid": "000c1c6f-6722-4536-9098-8b8e1f38b67f", "comment": "Malware payload (njrat)", "value": "fe4bd690ee15a17c3fadc40355a07b2d94035fb0a02dce48100e56bf0999dbbe554c18346ca7b71923b71cd27ce8e869", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665506403, "uuid": "7f48e3b7-63e8-4ea0-88c1-0b02739376b3", "value": "T12013F84CB684E175D5FF8BF1B4A2B2890B71A01BA906D30F99F114D94FB3AC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665506403, "uuid": "ab5475fc-753d-45bd-8602-2999739d2732", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665506403, "uuid": "07c7490b-2168-4ba1-bd4e-53445eec979c", "value": "384:YZy0sYz/wpa9GP4Uy2Jd670AwEo6lhSzIIij+ZsNO3PlpJKkkjh/TzF7pWnPMgra:uLsKR4gh2vsNI6YuXQ/oW4+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665506403, "uuid": "51046170-6f86-4592-bcda-44ac112c20aa", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665506403, "uuid": "301e2cf4-4cea-4e99-a90d-96ddad957a8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665506403, "uuid": "23545a3d-ab56-4875-beb5-a3d13687378b", "value": "\u0430\u0432\u043f\u0448\u0437\u0433\u0440\u044b\u0432\u043a\u0449\u0433\u043f\u0438\u0432\u0430\u0449\u0440\u0433\u0438\u0432\u0430\u0440\u043b\u0449\u044b\u0433\u0438\u0430\u0438\u043f\u0448\u0449\u0433\u043c\u043d \u0432\u0438\u043f\u0448\u0442\u0449\u0433\u043d9\u0430\u043c .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f4d6baf-493b-11ed-9266-42010a9c0072", "comment": "Malware payload (DCRat)", "timestamp": 1665475594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475594, "uuid": "9f8643e2-764b-42dc-8fce-de9ec5f08800", "comment": "Malware payload (DCRat)", "value": "0a38b80ab6227ee704dd0a87d3b35fb9", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475594, "uuid": "e7b487ed-2568-45a9-8857-536739d59173", "comment": "Malware payload (DCRat)", "value": "6145f4ca45a1b49ba067c0e007679d07f47077b89c1c4e241a5ffdbc2a3424e8", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475594, "uuid": "5371ee1d-470c-4991-95bd-8fd7e4c69f65", "comment": "Malware payload (DCRat)", "value": "86661dc0a56cd2ec326d253cd750ffae945e70ab", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475594, "uuid": "2c42abbb-3459-479a-9ae9-de97cee590df", "comment": "Malware payload (DCRat)", "value": "9dca13fb3d20274ede2df2e832fb68c277f8b8d1f37ce8e897907d4af682325337b448fd5c32edb894703d6766d77866", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475594, "uuid": "b964bd75-7bb9-4db9-b227-679fec7cfa4d", "value": "T1B0D5E0027E00CA02F41D1677C6FF49A447B49854B6E6E72B79BA372D16223A77D0C9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475594, "uuid": "20252f3b-9a31-4f42-8f6c-a9f021921f9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475594, "uuid": "47d6b568-733a-4c8c-952c-1fc0201ec3d4", "value": "49152:4jzi8MEymPhUhxq00tWCHhXo4zoMUss7j5oRKxXokYk1:aPJymqhxAtdHhXFohCKXokYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665475594, "uuid": "3445c198-f22d-452e-9123-acc10c535d39", "value": 2773504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665475594, "uuid": "aed316ba-66d0-4b80-811d-1cfab5a11985", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475594, "uuid": "e0da7297-2b41-485c-ac8e-a6a22ac4b4d2", "value": "0a38b80ab6227ee704dd0a87d3b35fb9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d295a54-497f-11ed-9266-42010a9c0072", "comment": "Malware payload (Quakbot)", "timestamp": 1665504715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665504715, "uuid": "78da7d60-2f37-43a2-976b-8ccf6f830ee6", "comment": "Malware payload (Quakbot)", "value": "ea8c8dcc622789e8fbd459ececb76eb5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665504715, "uuid": "13e2131e-622f-45be-af0c-6465c7355a4d", "comment": "Malware payload (Quakbot)", "value": "616a531ff72b31cd7f9b6093bd98db343fa42907127dc82763539d34f49a4e88", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665504715, "uuid": "91b7a7c4-aaf2-4af2-b01d-82d217a313ee", "comment": "Malware payload (Quakbot)", "value": "431dd17f86d4d34254310ee4e872b07461d17e52", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665504715, "uuid": "c26114c9-1b25-4b17-b00b-c87483987f7a", "comment": "Malware payload (Quakbot)", "value": "ac4eee2d72b0165ccf79020274954ed1b645fbe20b9b6a31758c42e773c6479d36fcbe40970d6e36eb61205880e5c767", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665504715, "uuid": "87110a89-d0ce-43d6-9974-0e283e1c433b", "value": "T1ECF48E33B1D084B7D12A1E78BD7B9268482A7D206F74A94B2BE41E4D4F399C13E752D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665504715, "uuid": "89ebb3dd-c7d2-4199-bc55-ba813a3462a0", "value": "dc4e58cc3b4290a5b1fb2b2659f5959d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665504715, "uuid": "4a3bfe33-28dc-487e-a174-4ba9ec1fa251", "value": "12288:e+4QHixeljmtjVFJcPp+cygICZoxlSr9s6q6xMZXJMeGbX//7OT:5DXjmtjVD3cygICZwSJs6q6yZXJM5T/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665504715, "uuid": "cf9c3875-e789-4a44-a8d8-d0f483b22c75", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665504715, "uuid": "73b40e44-ac62-4269-b254-e556b2ed3d2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665504715, "uuid": "d456210d-4687-4b43-9a84-2f080feaad72", "value": "popish.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e274309-4969-11ed-9266-42010a9c0072", "comment": "Malware payload (NominatusStorm)", "timestamp": 1665495214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665495214, "uuid": "11f38fa4-5869-40f4-ad1f-bab33629f22f", "comment": "Malware payload (NominatusStorm)", "value": "41535a7c1859e82d5ff7542a383c74d4", "object_relation": "md5", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665495214, "uuid": "d20017f4-8669-4a0e-a1a2-24af66d523e5", "comment": "Malware payload (NominatusStorm)", "value": "61cf69a052cd3178faed518f622572bcdd1672fe5bc3515733032a46ada5f7c2", "object_relation": "sha256", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665495214, "uuid": "63bbec40-81b1-4c98-aa5c-af6c6757d559", "comment": "Malware payload (NominatusStorm)", "value": "41173035cfa8d95170eb7a337ab94d689255d8f3", "object_relation": "sha1", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665495214, "uuid": "2bc174e4-d1bc-411c-ac3c-0a9a130255e2", "comment": "Malware payload (NominatusStorm)", "value": "d0df67008a61ed6fe14159ce3af6d28e28ace601734636ae1b71b1274fab4edbc8851e46fedfe657f9403d35e612a5e1", "object_relation": "sha3-384", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665495214, "uuid": "8a372ef4-be28-4091-85d3-d54dcf8e109c", "value": "T1B846D5B3B4A39299DD1A29F2C97E1D0992343C67AF445EA7B1C8351B1DB34903AD381F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665495214, "uuid": "99430ee0-9508-4ca1-bfba-72c01d1e8fa9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665495214, "uuid": "eab950fe-11b7-463b-a8d5-6d21ff7bf2cc", "value": "49152:2jLuSh3i+FtvkMzT+3HfOGlk2Ph0fh4loTpcAqOdxnG:qLu13/Jk2Ph054eTp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665495214, "uuid": "d9cb0c49-06cb-4d5e-b8ee-726e534fb277", "value": 5515552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665495214, "uuid": "bcd356c9-d503-49a6-aa41-4912cc60940c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665495214, "uuid": "0af69f52-268f-44e7-9dcd-c1bef6cda70b", "value": "61cf69a052cd3178faed518f622572bcdd1672fe5bc3515733032a46ada5f7c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640c4170-49a9-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665522739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665522739, "uuid": "6c1471fa-5276-4f89-9d0c-61be29aaca97", "comment": "Malware payload", "value": "054693669ab2fbcd6b5c94f5f5baa2eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665522739, "uuid": "917c29b1-4cfb-4b6e-a42a-beca0505f3df", "comment": "Malware payload", "value": "62364bf7618d4dfd38a9729b866f1094f11da68c136545b13e84d1b525494001", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665522739, "uuid": "b1159a47-dfd8-4957-824b-35bda451f68d", "comment": "Malware payload", "value": "c8371be0d0dedcd5b5e5e8a5fcfaed9f5225579a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665522739, "uuid": "7a1cf806-e347-4855-9a20-1f773db15ae2", "comment": "Malware payload", "value": "0ba4a7f55aa4d91e960f5c7f262ae85406d8bbfef5cc33507c23397653f40fba292d9dbf32bf4e0041d7bf88ff4ab30d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665522739, "uuid": "1d9ab33a-a482-4907-afab-04472cf74781", "value": "T12524CF123580C072E16235798C66D6B92EBBFCB19A3557CB3BC4676D4F322D2AE24307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665522739, "uuid": "f7d04cb0-fbe1-467a-bec1-ce8189115a45", "value": "e680a2b40b54e6ebf1523763588728dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665522739, "uuid": "dfb05dd6-5705-418f-8d0a-d4154e09356a", "value": "3072:ybF/2xU7gnnuJg7LufODVjvGs2D+G3fCffRhXFe8rofgPslcpO:opWvnuJwLuWDV86+afZagPscp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665522739, "uuid": "24030535-77bd-4447-93d8-96a98dfad6dc", "value": 220672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665522739, "uuid": "4ecf0027-8444-4933-8ccb-896b3ed553e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665522739, "uuid": "93868443-5e2d-4f44-b7d3-263810ecfe65", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f017d6-4941-11ed-9266-42010a9c0072", "comment": "Malware payload (Vjw0rm)", "timestamp": 1665478001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665478001, "uuid": "5184aae1-8855-4b5f-aeff-de60e11b556f", "comment": "Malware payload (Vjw0rm)", "value": "8f1ed7462dc08d0897aa79afcf256925", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665478001, "uuid": "f9d3b613-2479-469f-b48c-7a23bb990b66", "comment": "Malware payload (Vjw0rm)", "value": "6297ad7d2e748eb48b9572a3702188eeb569aad21afc52e0aa813df2294683cb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665478001, "uuid": "49c0339c-4c11-4614-b0ff-07adba465af4", "comment": "Malware payload (Vjw0rm)", "value": "cbd38c7cb35f8d5f0afd542dc939dad41806f717", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665478001, "uuid": "ac4faf3d-9404-493b-bf3f-93239278e2b5", "comment": "Malware payload (Vjw0rm)", "value": "e9384f0f7aa32525e97fd3fdac4c0cb362b2fb07a7cd164a7fedebc06220230259d84b83ec51a56ed04ca192b561eafa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665478001, "uuid": "72cd9241-76b0-4210-ad88-f93d6c189a50", "value": "T146840864FB845A8DF6990A8BD03D6DAE37B35B05C5E3B3CCA3A7354B255EE5E6108C00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665478001, "uuid": "0c2bd711-ff6a-4d0a-9439-9fa5a67f4779", "value": "6144:SX3RPvIgjpK1By+Z7lgwf0wNLrfoPeQhdREF3Tu:ONISifsekEdu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665478001, "uuid": "546d32e9-68a1-48a9-8d2b-5f9cbb848710", "value": 395423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665478001, "uuid": "3d04581c-14a7-48da-ad3f-aeae25b3a8ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665478001, "uuid": "9fbbfd78-2cb0-4b4b-b12e-73f6fb07027f", "value": "Purchase Order No.002548.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a13e9ee8-4968-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1665494924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665494924, "uuid": "b041e943-68f8-4210-92df-a9f73b40fa73", "comment": "Malware payload (GuLoader)", "value": "3abb54929b0d85d1ffeaa65d86fcdafe", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665494924, "uuid": "4ed90725-1bea-4f68-bd6c-d6375f4ccba5", "comment": "Malware payload (GuLoader)", "value": "62b8711f2d78a0d166a8e80f4b98dc2068eb289d0b5503330c6900cc1a259878", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665494924, "uuid": "eeec2584-21b6-40a2-b38a-5ca2046337b7", "comment": "Malware payload (GuLoader)", "value": "74875692393c240efe1160d80b1dd9a3289118d6", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665494924, "uuid": "0879abff-2269-4a04-b12e-ed989e7a2bf9", "comment": "Malware payload (GuLoader)", "value": "3164474178ebf4f386c2f485ee34a7e01998a8bbc17da9945b8f95f6f4c7c8aaf3ba567baf1ca95f31354e5ec0573401", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665494924, "uuid": "82aaa377-002f-416d-a0c5-1106ae6ad5cd", "value": "T19C443C30581F69AF86BF13F588C6D7D8B72C8FDD006E98A65C64D6BA1C01B10D7E6389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665494924, "uuid": "c8877c96-d58a-4ecf-9b48-1bb1da997950", "value": "6144:aYcAVe+ZMzZ7vO0398jfOHcCltntGzr/hf1ROY:alo2Z7hmC8CTtG/haY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665494924, "uuid": "4d14a9a6-7479-4550-b8cc-1d9f15453c83", "value": 261295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665494924, "uuid": "a0cab1fe-4fa3-42f2-a0b0-59ced0fbf8a1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665494924, "uuid": "20ea1697-5b73-4f7b-a192-ee40536b5f31", "value": "PO 9419(Draft copy).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db13a382-493e-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665476983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476983, "uuid": "343a5c7d-88b4-447a-9c08-cb9b062972dc", "comment": "Malware payload", "value": "87daa4a8fb8b7ad768ca4234e2dca5b6", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476983, "uuid": "ec00f88c-ffc8-488c-93d3-12a3c4071f25", "comment": "Malware payload", "value": "62c654b6f0d666beeb865fb2c3f2c59a2d541be6ad20abdb59cdc9bd10234d1e", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476983, "uuid": "362e9e5e-8436-4cfc-99d8-f4a4b55b8ea6", "comment": "Malware payload", "value": "8e85f7141166e3a879e02b473bae6d744d0f9e6d", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476983, "uuid": "bea27757-0ee1-4482-b55e-022ef036f70b", "comment": "Malware payload", "value": "45d36acad9aeb7bd98433c08e7a634499466fd09fe453a013d6293c99ac060bfcd776a903e0cabaa63b73c4f223b753f", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476983, "uuid": "f58a1086-3de4-41e3-977f-e129327d0881", "value": "T1D9D302CAB9456B38E9711171040B171B94352DA2E96BC382E7813F8CEB39BD44FA396D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476983, "uuid": "28a12c33-ba33-4c98-89c8-e7cda421841e", "value": "3072:BR4QT51c5y3gWpnwYE4M0ets5++SwtLMx8WVj5sW+Bd8Fh:wa51wWG8MjKTPBMx8qsW+oFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665476983, "uuid": "a6bb296c-68c4-4646-b82c-d68a896f3886", "value": 138232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665476983, "uuid": "d4cd0660-a5b5-4b26-af49-bd5aba4626ad", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476983, "uuid": "dc1fc715-b6a6-41a9-86a8-33cdd6b7d6cf", "value": "candy.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd3f7bee-4918-11ed-9266-42010a9c0072", "comment": "Malware payload (WannaCry)", "timestamp": 1665460638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460638, "uuid": "232a820a-92aa-487a-9082-c60bb4bcf9cb", "comment": "Malware payload (WannaCry)", "value": "74ef2414a12a4160bfc7632b01e073e5", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460638, "uuid": "ee4f3244-bc7b-4e9c-9178-30d818c0b58f", "comment": "Malware payload (WannaCry)", "value": "630d75fd88047e413c8cea30edbaf3a3b987a9cfebf298d4d0b01b1f11275fb5", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460638, "uuid": "27f8a855-2a76-4c2b-81e5-735bf2010a3a", "comment": "Malware payload (WannaCry)", "value": "f9618fc409a0af309fe50dfa93d702a9357e42ef", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460638, "uuid": "5ed811ad-061d-4a10-8937-a93fde43bdd7", "comment": "Malware payload (WannaCry)", "value": "01bcd1e1155583f63b14741f367ffbe75ab791f578246f771b3973cd6708fdd0873c67f6c220a218e299d0b2098e9c0d", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460638, "uuid": "d915e9de-d3ad-4de7-a8e0-5e6509990baa", "value": "T16DF5AF5B3B21D33FC07201762805A1B78AF6ABE1A19CAF57D28C09591D11658DFB2F4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460638, "uuid": "46048dc2-a0c8-409c-be01-6042af3f6749", "value": "68f013d7437aa653a8a98a05807afeb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460638, "uuid": "bdb1240c-efa4-4124-b8e2-0efcc43ca27b", "value": "1536:Bo1Jfsh3MKNQugai++N9S4A3v9q/j9GwJ12f:BozecK+7hMV9qbUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665460638, "uuid": "188caed1-c92e-4755-b09a-0c70a167c383", "value": 3514368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665460638, "uuid": "f397fab8-ad63-4ce2-a527-270f83b4336b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460638, "uuid": "c2ef73a5-aecc-4cb5-8420-b56753d80ad8", "value": "630d75fd88047e413c8cea30edbaf3a3b987a9cfebf298d4d0b01b1f11275fb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b798af-4933-11ed-9266-42010a9c0072", "comment": "Malware payload (CryptOne)", "timestamp": 1665472271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472271, "uuid": "f5b436dc-8a59-4c4f-a813-dfc70cb74485", "comment": "Malware payload (CryptOne)", "value": "3b0d45d7af40fbfc6366ce8c56662851", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake outbyte drive rupdater", "colour": "#AD1756", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472271, "uuid": "65600d57-1fd2-4571-b2e9-287b02d4e570", "comment": "Malware payload (CryptOne)", "value": "64f05e1fb698fd86a92a27ae0625d41aee90fb27ff0912cdd57f445a632ee8f3", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake outbyte drive rupdater", "colour": "#AD1756", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472271, "uuid": "20c1d5c7-ce32-4bb9-908d-060336484480", "comment": "Malware payload (CryptOne)", "value": "80dc4c5c02e7d39490389f0b639e80d42ea62f24", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake outbyte drive rupdater", "colour": "#AD1756", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472271, "uuid": "a98e6f49-c58d-4642-b083-2e469d602e98", "comment": "Malware payload (CryptOne)", "value": "a23933a129c7fd50f5413ff823d3f51b238106b779428d5e4e51a0604c2e5997da7dd46e890801d35218bc8f825a81a4", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake outbyte drive rupdater", "colour": "#AD1756", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472271, "uuid": "051e20c2-1b7c-4be7-bcd0-918666e10ba2", "value": "T1350733122941486ED8860B700CED7D58A86F7F1C763438D622D7BAF4D771A027EA1E6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472271, "uuid": "bfba2b30-6cf9-4d6f-bc68-aad7e2382dc5", "value": "8c16c795b57934183422be5f6df7d891", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472271, "uuid": "828386bd-a5ba-40d4-8d2c-b9a6b77b95b5", "value": "393216:V5o4VeiYWj5C8uC8Sd59g4//CqgaDBPylTQ0aZpMd+Ctoq:VUjm4C8G59g+Ia1nZpMdD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665472271, "uuid": "01b56fbb-5990-4f24-95ab-15328b18606d", "value": 17650597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665472271, "uuid": "3b6fce14-71b6-4e88-8343-096237a31898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472271, "uuid": "8b452d63-e832-4184-abb5-5fc3991c2836", "value": "64f05e1fb698fd86a92a27ae0625d41aee90fb27ff0912cdd57f445a632ee8f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d643c21f-492f-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1665470532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470532, "uuid": "28cf1241-14c7-4ffa-b45a-7e92f28642fd", "comment": "Malware payload (Mirai)", "value": "aea3698a7a3864d08e3b8956f490fcaa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470532, "uuid": "209d7bfa-7dac-4157-bdcd-06b8752697de", "comment": "Malware payload (Mirai)", "value": "6600405186b896d94581e0d31fa5055b60a4692e67646ceb450ecdef448e4e86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470532, "uuid": "aaf00e09-872d-44ef-a252-3ee25aac4c7d", "comment": "Malware payload (Mirai)", "value": "9cad4cec2fdb55ee50bd8d5c6f1693b1d0c78277", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470532, "uuid": "3bb3b5f3-f1a5-43c8-a839-04634d66769a", "comment": "Malware payload (Mirai)", "value": "dd3ba9e73ce87f958a18f88189634562e16b2011768de00393de00475986b9c0e64ed75206f9e0bad7e05df14ee375e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470532, "uuid": "5ae073dd-e43d-4f1b-ae56-b23ae2a7e7a1", "value": "T1DB734A24A9792F26C1D4B17B62FBC321F2E5220E25B4865D7C760F8FFF2465068162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470532, "uuid": "a648001d-26db-4a63-b996-8437a7c92ee1", "value": "1536:TQ/UNMve8GSD77dXkvSJju+gc2iYR9QhLX56vNYCCAfOFx9:s/prpju+gczYGbovNqAfK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665470532, "uuid": "b28fc66d-16a5-4ca4-b0f9-d0d71d5aa578", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665470532, "uuid": "42523435-2966-492e-b507-35c355b46f55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470532, "uuid": "bd93d8af-4f68-434b-ac87-be3359c94d9f", "value": "aea3698a7a3864d08e3b8956f490fcaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b3b48d5-495a-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1665488901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665488901, "uuid": "940d8d24-eab0-42a3-95c9-0cb7939c681b", "comment": "Malware payload (CoinMiner)", "value": "ee0f00010a940c8088f0cf4e667a1c7f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665488901, "uuid": "7dc7e7e2-4a83-48ef-98ff-e5d98d1c9ae8", "comment": "Malware payload (CoinMiner)", "value": "671cd3f8f449315ec837b2b7afdcdf89b67b8636dddbb5886050908a8c9af595", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665488901, "uuid": "fde60fb9-dede-43cc-ba30-93c5afdb583a", "comment": "Malware payload (CoinMiner)", "value": "7b42c34d9cfa0c777fa15ad073a58a619593d8fa", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665488901, "uuid": "121561c5-4162-4c28-a979-8a1859814054", "comment": "Malware payload (CoinMiner)", "value": "19d1f7626b0b1d0d981809052f064e064258f7bef6a9e3bff8ff65e578c0a6f8e46892f6789ac11486b8984cca0e8ba5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665488901, "uuid": "4cafd4b7-6197-48c6-8ebb-28f40acc0c45", "value": "T1FF96E091FF47595ACB2B9B31119A0FA8E331CC4777038BDF1628C469DC6378A9D21AD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665488901, "uuid": "e2f273e8-28de-454c-9919-7405912f37f5", "value": "98304:egJ1jikGonRhpkKCLlpAxFka+D8bA/WEAtTcx60lGUi:e8xikXCKCJpADkcbEAKxXIUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665488901, "uuid": "c8ed4af3-2026-423c-863e-a647d46c9574", "value": 8700543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665488901, "uuid": "142724d9-0500-475c-92be-6bb3c68741d5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665488901, "uuid": "eebe3c1d-3b47-46d3-b386-0071b9bde2a8", "value": "671cd3f8f449315ec837b2b7afdcdf89b67b8636dddbb5886050908a8c9af595", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bdf4737-49aa-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1665523074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665523074, "uuid": "49d5935e-8318-42e9-b321-9215d4e07c6d", "comment": "Malware payload (Formbook)", "value": "01ef9966091f00c2feff9ca03f1296c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665523074, "uuid": "42347b0e-f98a-44e1-849a-95fa2148a2e2", "comment": "Malware payload (Formbook)", "value": "6896d536efc4ff152a38b540d922490261be8f76eeb3a1e41f03744330e0fb1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665523074, "uuid": "db89e010-bc1f-479d-8c1d-2005087ed31b", "comment": "Malware payload (Formbook)", "value": "a097b016274dedab1de106d186270ab4c31d286e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665523074, "uuid": "3b61a3a0-2ee8-49f9-9a6b-378b69fbc2ae", "comment": "Malware payload (Formbook)", "value": "72bb1d4128fdc08b3edabaf646e072711c1fab00e1405f3a0a42aa33a4bf0b8332eec073aad3b1dcaf880ed39b3e98e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665523074, "uuid": "7becd521-57df-4abd-b641-fa2802dd1938", "value": "T1AA357B7E269A4907D8153135C487D1F32AFB6E50A062D1CB6AD72F2FBC412BF951338A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665523074, "uuid": "8916b546-0712-4eed-8096-c4a11241604c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665523074, "uuid": "b8b34e6f-f587-4e6a-b135-2510da59838c", "value": "12288:R8JUsSqcPTvYeuVGXaqA5kRfOUcLEsGHP5r+1wmAqIZlS9MpRAQSQy4AP:R89whueaqKe5s00wcelSWPAtQy4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665523074, "uuid": "5d1dae51-4d19-45c0-b05e-aceb50db4bbc", "value": 1069056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665523074, "uuid": "5e920454-504e-415e-9836-6239ed937cc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665523074, "uuid": "da1e9d0e-eb98-44b0-a34c-f0731d6d18b2", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd69e2c-48fe-11ed-9266-42010a9c0072", "comment": "Malware payload (DCRat)", "timestamp": 1665449446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665449446, "uuid": "93b9cdb5-3977-47d4-9575-ef564e502e68", "comment": "Malware payload (DCRat)", "value": "624edf10661243c73fa1ec517c525b6a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665449446, "uuid": "9d760880-32ab-4dd1-8926-c5bee79e308b", "comment": "Malware payload (DCRat)", "value": "69b6674c7790ab93f80d47ded0d57f1ac7b842526bcde5ecc89d9ec084d78964", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665449446, "uuid": "2a35a6ba-ca14-4820-b9c6-25a7ece03c0b", "comment": "Malware payload (DCRat)", "value": "9d5ed9fb7603a90bf1c97cf350b6e9f3118e5359", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665449446, "uuid": "2676bce7-ddac-4921-abc2-f232119ab06b", "comment": "Malware payload (DCRat)", "value": "cff42ab8b13d104ad4d0f3e72a2277b5a9ba33c2894e14428debd69f6c35ddf5cda0a70643ab0eed49592432deb466e2", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665449446, "uuid": "843c35dc-5937-44df-9c0c-21a1f1e7ca62", "value": "T143455B017E84CA51F0091673D2EF422847B4AA517AE6E32BBDAE337D55123977C0E9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665449446, "uuid": "edbe37a0-86c0-4a76-aca0-693a7846ec26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665449446, "uuid": "465a548c-a0d3-44fe-b31d-0074eff71a8c", "value": "24576:+tgRC4aNuQ2KoDPlSeiU3dOdAYjf1biL7ijqb:6gRC4pQ2HDNjiQOdfjdeL7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665449446, "uuid": "e456faa1-ae2a-4c44-8588-87929215c4ff", "value": 1243136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665449446, "uuid": "87cde828-6c83-483e-b073-f2af09550d9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665449446, "uuid": "7f12c4db-6631-46e9-8495-2da2b9ed10f9", "value": "69B6674C7790AB93F80D47DED0D57F1AC7B842526BCDE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e39285-4989-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665509070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665509070, "uuid": "08c9b120-0728-4784-8191-6e4142d5522e", "comment": "Malware payload", "value": "3503daff3eff743790593d0ad8cb9913", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665509070, "uuid": "6a5ba1c4-e6ae-44a9-97ac-8e1bcc2a3e55", "comment": "Malware payload", "value": "6a674b99bd769a8d3192367622ad61a7eb6f4b005c67a65508a5e99791fe526c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665509070, "uuid": "c2d12438-862c-44f9-a9cc-bca52186c46d", "comment": "Malware payload", "value": "c89630e6690f0638bbf0af4d8db86b81032cb3e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665509070, "uuid": "2e3dbfbd-f87d-4686-becc-81f00d6a5df5", "comment": "Malware payload", "value": "7ec0f2571427f5135b437e9b7e47d23d8286071274bbc514b339059bf3514892048b9882414d185f9121154558b9f42e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665509070, "uuid": "362d66fb-b7f9-4f84-bb20-aaca1627aaa2", "value": "T144547EC163948067F8675A744EA3838AD769FCC1AA34758B2320F35E0B3BDD25FA8715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665509070, "uuid": "0c8f5148-ee8f-4d1a-a49c-b72c91b72a3b", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665509070, "uuid": "c8d491b3-91dc-4864-8c93-6eafbb114770", "value": "3072:CvGyYiSDnt1J95MLZvLJd21leZSANnW5uyrhFfYMVdzSRmqpC2cxlcKk:G4Zy5FuCSANWrh9fWRTrGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665509070, "uuid": "c2596ef5-8b8a-449b-b350-f7da018c7689", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665509070, "uuid": "ab23a287-a9a7-46a3-853e-69d0f2561d5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665509070, "uuid": "86001c68-5415-42f7-8aca-ae0a81844b4d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe24cb8c-4962-11ed-9266-42010a9c0072", "comment": "Malware payload (Gozi)", "timestamp": 1665492503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665492503, "uuid": "9d36162f-a0f0-4621-bef6-e01133cda683", "comment": "Malware payload (Gozi)", "value": "3b892bea0f8cbe0b61ee380743567d1d", "object_relation": "md5", "Tag": [ { "name": "185.212.47.133", "colour": "#7E59F8", "exportable": true, "hide_tag": false }, { "name": "194.76.225.60", "colour": "#8DCBA0", "exportable": true, "hide_tag": false }, { "name": "91.213.50.74", "colour": "#DEAFE2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "tel12-msn-com", "colour": "#34E411", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665492503, "uuid": "3a782687-3c17-436e-9116-af55b5452894", "comment": "Malware payload (Gozi)", "value": "6b722961edc010c5487de4ef7eee84b586ac3c3f06dbd1920935ea5f7bb90543", "object_relation": "sha256", "Tag": [ { "name": "185.212.47.133", "colour": "#7E59F8", "exportable": true, "hide_tag": false }, { "name": "194.76.225.60", "colour": "#8DCBA0", "exportable": true, "hide_tag": false }, { "name": "91.213.50.74", "colour": "#DEAFE2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "tel12-msn-com", "colour": "#34E411", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665492503, "uuid": "8d471999-f0df-460a-a9e8-2fda34d428bf", "comment": "Malware payload (Gozi)", "value": "90522132e3a97e966e5270a8e105cc33f0d6c4e5", "object_relation": "sha1", "Tag": [ { "name": "185.212.47.133", "colour": "#7E59F8", "exportable": true, "hide_tag": false }, { "name": "194.76.225.60", "colour": "#8DCBA0", "exportable": true, "hide_tag": false }, { "name": "91.213.50.74", "colour": "#DEAFE2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "tel12-msn-com", "colour": "#34E411", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665492503, "uuid": "0ec1fcbc-c2a3-4ae0-8b86-37f64e417153", "comment": "Malware payload (Gozi)", "value": "e2561b6d602c48000d59c5fe51d07e87f5ba14c4101191f5f8cb2909f03e64374f15f1c0d5a23d062ed631f36ffb43d9", "object_relation": "sha3-384", "Tag": [ { "name": "185.212.47.133", "colour": "#7E59F8", "exportable": true, "hide_tag": false }, { "name": "194.76.225.60", "colour": "#8DCBA0", "exportable": true, "hide_tag": false }, { "name": "91.213.50.74", "colour": "#DEAFE2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "tel12-msn-com", "colour": "#34E411", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665492503, "uuid": "328c4209-cbfd-4f9c-a9cc-10be5d8043ac", "value": "T1F103F1A418107CBFDF2FE13B6315E11EA5B583C1150B0EC9E274E6DDE276422EA5C28E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665492503, "uuid": "7281246c-e36a-4ae8-bae0-9db66882f7bd", "value": "a225a198dd77b77924eb15a705beb665", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665492503, "uuid": "c0505ed3-7a39-4203-8679-bc5c93f09801", "value": "768:Z41V8UHIm2wyBdcNtW2RTYBfx6w39rDE3Lkjx2K/ZK38ua:ZefIZwAdeD8B56w39HE384h38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665492503, "uuid": "0cc82c17-1cbb-4355-a26e-e5210b7ab13e", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665492503, "uuid": "174c7ab9-feb4-4f76-be4f-46a4bd09c618", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665492503, "uuid": "9ceb3c47-a44c-4890-bc4a-a505d6bf562b", "value": "Lx6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f14aa0-4940-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1665477808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477808, "uuid": "bfc899f5-8d47-4052-964e-fc8b1666e983", "comment": "Malware payload (Formbook)", "value": "c161d73d91d25f8c82810e2c18d3d795", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477808, "uuid": "bffc64bd-fa8d-4fb4-8d1d-18159fb362cb", "comment": "Malware payload (Formbook)", "value": "6c27b925f1eaea5b33c4f0ffa0113071d12980dd458169018c86017702ec4944", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477808, "uuid": "b15425e0-1d34-424e-8f03-899fd833748f", "comment": "Malware payload (Formbook)", "value": "421e5555d4ffba4d67c273b8cd88d93cf74b8e6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477808, "uuid": "3ae7ba8d-2ecc-4080-acb4-72ab979bb9ac", "comment": "Malware payload (Formbook)", "value": "38fa3c678ceeee09f33bdbcb22ad3fb74d0e75f2c8aedd8247f87aba8a7fd4dc82d8320186c696a527ff58c8e3106bb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477808, "uuid": "a39f83de-8a0b-4b4c-92c6-1d3032a123f6", "value": "T1DA95D7F4A0BB4096F64799813938F9E105B236A3ADCE0C39136AB604CFFFD953545A4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477808, "uuid": "3217147b-50a1-4d12-8fec-39fc7ca0afc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477808, "uuid": "21116127-c7fc-4bd3-80fd-f5705c3bd4d5", "value": "12288:pG2nx3jVOgf1k3ECnmLpeU1aJiNA7xSVrf7Q+xmnWZQzjFeM6DJOjB9sTTHy5Jtb:CINeGOSVrf7Q8mnYQb6VOxPaofmhW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665477808, "uuid": "86c92854-21b1-4ad5-8ad9-dfb1c775fb34", "value": 1917952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665477808, "uuid": "5725815a-0674-4374-b1da-66bad9611f89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477808, "uuid": "98813bda-9971-437e-86b5-b3d04ca82c8b", "value": "Esipsduo_RFQ_PO111022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f695dd0-491a-11ed-9266-42010a9c0072", "comment": "Malware payload (Guildma)", "timestamp": 1665461313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665461313, "uuid": "2996b17f-efb9-4d61-a450-e24905e6f8b0", "comment": "Malware payload (Guildma)", "value": "dc4a29c237dae53a9c58bdefbad2ca58", "object_relation": "md5", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665461313, "uuid": "1d921964-5798-4659-9af1-2f823f2be102", "comment": "Malware payload (Guildma)", "value": "6cd4c80a42f4bf32e84ca9979d4e0c323f53a5305f7dee3ed20dba356b44bafe", "object_relation": "sha256", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665461313, "uuid": "9793de8a-87d2-48ec-903b-4ddf2664fc5d", "comment": "Malware payload (Guildma)", "value": "a76d2989a0531e00844cf19fa785df57f11fe5b0", "object_relation": "sha1", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665461313, "uuid": "af6bc4ca-c802-426c-b9c6-cc7f9f743e91", "comment": "Malware payload (Guildma)", "value": "5b545469d598ca33aba84be0b3c65cab106fdf13ed72167bd838121630e024614ef400126576b101ffef35fb40d67a62", "object_relation": "sha3-384", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665461313, "uuid": "31e8a387-923c-4659-8be3-559e6f59c30d", "value": "T1ED1102B186FA50F9E95B44F0C11F256283E755D9201A7F4F2861670D0B640C7A476A03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665461313, "uuid": "0e0b43bc-faaa-439d-8155-2ac87ec8f12c", "value": "24:9mDJtPjORjEyD2ixjlvJlFhp7WpCHjPIyHhJtMJp:9MtPjAWOlxhF0pyXtCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665461313, "uuid": "8d98bae2-c330-44d8-9caa-947ee633c049", "value": 1017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665461313, "uuid": "a4eac3f5-9bcc-43d0-a2db-8440909d694a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665461313, "uuid": "cdf44f78-51ed-4d17-ae88-dd84011f63e8", "value": "Titulo527_995.20227.24962.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51633529-49aa-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665523137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665523137, "uuid": "d5cabcac-be50-4205-a65a-c1d1887f063d", "comment": "Malware payload", "value": "31137b2785ede2f4a589e3bdba8bddbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665523137, "uuid": "17c6b1c0-ca8b-4e48-8ba3-1514ef70580c", "comment": "Malware payload", "value": "6d81e3f6c9c87c663248587794508df7662018f8bbf7bf62e8d58828e973d211", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665523137, "uuid": "e0ce477c-ee49-4b28-99ae-a5ae61b55187", "comment": "Malware payload", "value": "05bfa8e32e23f19dce2b578f250ae0aba8e9f704", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665523137, "uuid": "02a7d4b3-dd2f-4626-8133-27e8ca79b2fb", "comment": "Malware payload", "value": "fa87777e1f54a2dbf74ed5b005c0c8388aa0fb569199fc4aadb04790ca7076921c55c8ad0c92ff0bf2629ce717a6a654", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665523137, "uuid": "eecb6479-ad9b-4983-a3c5-64ea2281f116", "value": "T19A7633B671C308B2D2D351319CC626C567F6F2888AD18D6B2378273DAF7E25699E3134", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665523137, "uuid": "4667846e-b4bc-4014-98eb-4a0034471681", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665523137, "uuid": "f9d8747b-c19d-4f5e-8b1c-b51863fc54c8", "value": "196608:91Om3HZVMYNCSk4KGzNAzUqr6M9u4soSOhz30D/iqkDoF:3OmXPMRSk4KGSzt91siqNF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665523137, "uuid": "d0718166-0e12-4d0a-b264-385c5c324e54", "value": 7616601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665523137, "uuid": "703040dc-c8f0-4d30-a835-348a9b3ce5a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665523137, "uuid": "f7a826a3-e5dd-402c-9ac4-e497c3a8152b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b6cf10f-4982-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1665505867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665505867, "uuid": "78532da8-3a35-41b6-ba01-7ba4267944e5", "comment": "Malware payload (Smoke Loader)", "value": "82bc99b63c7b78418b1ce9c51f58bf2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665505867, "uuid": "f9801846-ac93-47fa-b513-c6244d0b70e4", "comment": "Malware payload (Smoke Loader)", "value": "6dcbc5062f4ccf8f9c254d76d529c29cb371e19adc01899497004d61d3fa1310", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665505867, "uuid": "9a2009b1-0994-483f-a523-03b896c0a35e", "comment": "Malware payload (Smoke Loader)", "value": "42e782e67c1fd12c8ebcba6cab8fba713871b472", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665505867, "uuid": "7430582d-5974-4a1c-be5a-4da85ff1a827", "comment": "Malware payload (Smoke Loader)", "value": "f6a58208235a90bbfabb0bcdf79e368f925882812797764a25d776a3b9345ffd50c6d6c4e1fdab867ba3b29168ba0328", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665505867, "uuid": "9c2f5d7f-937c-4051-b2e4-08898fae0ee1", "value": "T1E624CF2236D0C432E26616398D64C6B56F7BFCB15975878B3BC83A6D8F352D29E24343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665505867, "uuid": "f51352f4-9678-4423-b51a-c6400682f145", "value": "2466deca3b013302337885751cf37be4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665505867, "uuid": "b8980b45-d9cd-477f-8b59-9bc67ca8645f", "value": "3072:5L1WaJDTFY/wFoLTTuLt8IEJmrEsDRgzhBo+jVEIO:5NZeLTTuEJKEsDEU+hEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665505867, "uuid": "8bcb5594-6f5f-4d3f-94ea-e41fb6e40a06", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665505867, "uuid": "3b296090-2878-4ae0-ab8e-06640da9d62a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665505867, "uuid": "91de1009-9ff9-4c3b-8b4f-d69cb3c42514", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6474449-492e-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665470129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470129, "uuid": "ab9506f4-8aba-4753-b038-bed3f8942e0e", "comment": "Malware payload (SnakeKeylogger)", "value": "a413ad7ac1514409f8c5c84487ae57fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470129, "uuid": "ccff9097-4bbf-4710-be7c-ce46f611e79b", "comment": "Malware payload (SnakeKeylogger)", "value": "6e465bbc2fe0c1a5cd112367facfb57b11f10c9cad8fa10514d73a977cb636cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470129, "uuid": "c29b17a8-5454-4bb3-8330-2c9a6d6a6d3a", "comment": "Malware payload (SnakeKeylogger)", "value": "1b40d3632d62ff05ad93aa9e02cfef4e0b3d1cb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470129, "uuid": "d76f302e-2f97-44fd-8e03-a9f45015667a", "comment": "Malware payload (SnakeKeylogger)", "value": "a290ddbee066b1f3b1bd3183c50d7e4c71417947546aad91fb7903fb11e74e6a846e69edeff217039d3ad7d4053805b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470129, "uuid": "2d15fa79-6b3c-4a79-8e5f-aa07c372d52b", "value": "T10AD3081D3BFC8800E5FF8A7315B19211D7B5F862091ACD1D5AC1F9592A7CA90CE1AFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470129, "uuid": "d24088d9-b6d0-456c-9eea-d9fb849432f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470129, "uuid": "60262e69-0e41-41f4-9249-8265431c68ce", "value": "3072:uzRJAs3QPzWJ3H6gfzO4Nb8NRwBl2FbY:slN7Jbnyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665470129, "uuid": "05c4b8b5-4632-4165-9ec5-ab7b11b83c72", "value": 130048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665470129, "uuid": "204b26a2-46f3-4e71-ae96-24e870f83e7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470129, "uuid": "7e23b750-2b6f-400c-82bb-5534e69686a1", "value": "a413ad7ac1514409f8c5c84487ae57fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1670e5d9-494e-11ed-9266-42010a9c0072", "comment": "Malware payload (DanaBot)", "timestamp": 1665483525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483525, "uuid": "4788753d-6bfc-490f-b4bd-6070fd8427be", "comment": "Malware payload (DanaBot)", "value": "db7b9097515bdd31c0b02533d75c676d", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483525, "uuid": "9d9b1143-b67e-4c3b-941d-e27a36dad7ab", "comment": "Malware payload (DanaBot)", "value": "6e7bd8911ab83364178e8e18ba05f35c78469b7d8ca12fbc06695cd39fb8c0b5", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483525, "uuid": "d8447791-019f-4891-ba79-2cfb59706fc7", "comment": "Malware payload (DanaBot)", "value": "7dace67c913abfef16b613c072010ecc8cb56021", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483525, "uuid": "d000d434-5d2b-409e-a214-e719aac4ff33", "comment": "Malware payload (DanaBot)", "value": "b9a13192d84bfa809fdf22cff5e0159d9eab99f234ddc454b956eaf350221304f2d67272f6eec71650555685c86cd672", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483525, "uuid": "b1e8cfd5-bdde-48a9-990d-540a5008e850", "value": "T11F65233A76A2C0B0D5630EB85414C3E4AB7FB8B16770545FF7A857AE8EB334181B2356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483525, "uuid": "145771a9-08a4-4848-8408-9f90564fe3f0", "value": "93226edf73e88569fc77ee00d1ab94d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483525, "uuid": "ded29658-80b8-4aa6-9934-11de9236e781", "value": "24576:KCnWoU0I5kxIGdU9P8aCw3RUzyuB2WcdeA3/iB9FobICvozjNHMy029O9VFkbxX:KZtp7z1Mzf2WcUbBH++5f0F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665483525, "uuid": "6289b141-0392-4586-9ea3-523a1a2d4546", "value": 1445376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665483525, "uuid": "00f40805-c999-4e9b-9adf-bc237dbe0f8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483525, "uuid": "1ec52233-1b62-4c46-9c09-9474a500fd97", "value": "6e7bd8911ab83364178e8e18ba05f35c78469b7d8ca12fbc06695cd39fb8c0b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8d9dc7-4940-11ed-9266-42010a9c0072", "comment": "Malware payload (Guildma)", "timestamp": 1665477894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477894, "uuid": "6e23be2f-9d6e-4888-9df0-25fd21b8a617", "comment": "Malware payload (Guildma)", "value": "b5acaa50c4ad13cb929426f3be1dbb40", "object_relation": "md5", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477894, "uuid": "d90783da-8a3c-4701-ae07-27d172e04ed6", "comment": "Malware payload (Guildma)", "value": "6e88ab76c148e396da1a4839f6a5c0042466b3c28b8fb7a399467adb541b0068", "object_relation": "sha256", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477894, "uuid": "5b2289c7-39f7-4f16-a04c-7e7198dc6221", "comment": "Malware payload (Guildma)", "value": "5b1a61db688201ec4c4834c409a940c5ee1b6697", "object_relation": "sha1", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477894, "uuid": "160f7444-4315-42bc-844b-2f9db41ce7ef", "comment": "Malware payload (Guildma)", "value": "9226baef79d2cbd7b2996f24816a9ec943e358ede772151d81573a50ccd63edffbe7e74107fb8eb998631fa0996c44d2", "object_relation": "sha3-384", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477894, "uuid": "51e1d171-e3e1-4e72-b36a-813f295064a7", "value": "T138F0F18C054937A4D4649133DDB35B6C0D8C79875B2E63F7921A9D4795C00C036C49D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477894, "uuid": "9b8d58b9-fc6f-4396-9eb7-392aed170690", "value": "6:4xtNfl+gRObl+9AFcJc/kv6u4tdlweBVANOmbbPemlOe4B7yNJEICZVDEfYu0/IT:8rfl3OB+9Ly/kCzlZyOe4EEn34QgT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665477894, "uuid": "8e9c73e8-e9ce-4661-8e22-9717477f8e19", "value": 505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665477894, "uuid": "cf201509-28df-4051-be3f-f442d61318f3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477894, "uuid": "64f86b0e-740f-4f9a-bf88-47e7aceb4446", "value": "Titulo527_995.20227891.316593.19418.lNk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf60dc6b-4937-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1665473956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473956, "uuid": "0fcec3cf-4766-42ae-970f-c94346277b2e", "comment": "Malware payload (Formbook)", "value": "a93f5a2c6e1278d1b8b93e8e9b950f26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473956, "uuid": "0a5b0c31-df13-4b2a-b1a1-5defc1bb31a6", "comment": "Malware payload (Formbook)", "value": "6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473956, "uuid": "e7d8ad95-0529-49f0-ab98-b28adbd7e0e3", "comment": "Malware payload (Formbook)", "value": "5c3a7b41d017bcabf9d441d81c6c46a05b76d0f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473956, "uuid": "aedca593-3e38-4587-9575-2af3c01c55ab", "comment": "Malware payload (Formbook)", "value": "3e1cce34876d0c0637d79c3b2c7f527a60c740e371a37e70fd96f1686a640fd5938dfe124aa9bd402568a3a0a02cd9f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473956, "uuid": "2f986787-ea76-4c74-8f47-dc608ff3b501", "value": "T14D05E0371BEA4F4BC129B6B881D1C3B6A3ADDC01E567C3972BCA9C1FF04A5658760361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473956, "uuid": "dddd2571-dcc6-4d67-9d97-1396d20adfef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473956, "uuid": "c92b2321-95cd-45c1-a78c-8c89d67b64c9", "value": "12288:WAv2iN9IcvSoun3A1fLsumo2Hv3hqWxGAT8dTTip5Q+:f1rAn3A1DsucjGJ9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665473956, "uuid": "c6a1fe05-0a02-499e-90e8-ec1fd45d9866", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665473956, "uuid": "f6d1b5cb-b72a-4c62-83ab-cdf877a0f0a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473956, "uuid": "6e72a3aa-1155-432e-a373-de085ac909cb", "value": "6ec0c1af929d468390638567352ac6ca1d56b3732ff159ccd043ffbd9d57721a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d55d2b-4940-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1665477826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477826, "uuid": "e3455796-69df-4d1b-a820-a831f47ae52a", "comment": "Malware payload (GuLoader)", "value": "6a1ee07778a039f803612f2fd5ba8d7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477826, "uuid": "151487c7-0d16-4436-98e6-7f9c91b90f57", "comment": "Malware payload (GuLoader)", "value": "6f38ffb300810f0fa58fd33ae0c8f5952211ab6af8f6e4a09abd98c0a1399529", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477826, "uuid": "a115b5db-e592-4504-a038-c4fe13de9208", "comment": "Malware payload (GuLoader)", "value": "9c56ce1a377cdaaa27161c9a29155903ffff41ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477826, "uuid": "cf3dc49c-819c-47de-ab4b-eda8f3509460", "comment": "Malware payload (GuLoader)", "value": "74282d5be53d4525045da403afb8c77a8bd719864642315493747dc4c0f83b4f1b97ace2224f380f7a72553ac53d4870", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477826, "uuid": "f3bc457f-7e34-451e-8905-5141763bebd0", "value": "T10AE302012271C4F7E5270270097D5B3AFFFB810450992B4B6B746F463F23A92A63E25B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477826, "uuid": "5cf4d650-596d-4dc5-a172-f199a24b0b0a", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477826, "uuid": "cbf49075-e1de-4fed-878e-df3d4411744f", "value": "3072:3kBGWOsTIJgIDU5A/cmubup7VdMlCK5LCz2HkCX1VY7fexDbvxj+a0xl36qR7f/P:31ssjQup7VdM5LCzC11Hvx+a0xlhWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665477826, "uuid": "83aeea9c-f9c0-4f88-9fdd-dd4fc77fb0b6", "value": 143504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665477826, "uuid": "8e9e4d5f-1555-4be6-bde7-e2ab1d40daf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477826, "uuid": "ac66aa73-be0a-45c3-b87a-4c3e1c890ccc", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa297e73-4910-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1665457278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665457278, "uuid": "93ff1973-40cf-41d3-ba8b-80d5c6b01517", "comment": "Malware payload (GCleaner)", "value": "385c8df02a1ccc4415e702deafddae90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665457278, "uuid": "25a18592-ee44-4311-98a9-fbd55c11f865", "comment": "Malware payload (GCleaner)", "value": "6f959997fd2a9b93f18088188cae26410b5041713449349b7ddacb806a41f8b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665457278, "uuid": "20e7ae64-91d1-41a0-be96-1ca1ebf05678", "comment": "Malware payload (GCleaner)", "value": "85fdbcc2ea0d66bd472c225b3d8d4c0e4677b9bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665457278, "uuid": "eac81cf6-db55-49bb-bca3-197aa3eea001", "comment": "Malware payload (GCleaner)", "value": "0dcf4d9a9002901edd42b0e8ee48d99103f7454d88ec38fd605cec49e86c546b037fd25ddbc970eae03df80e7800115d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665457278, "uuid": "57fdb24e-431e-42ad-b8ad-9f190932fdc6", "value": "T13C74E1223980C432E666B135CC76DA713FB7B8751931678B3BE8526D4F226D2DE21347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665457278, "uuid": "05b6ce8a-12d0-49cf-871f-cac6c416ef46", "value": "78ee95c35be8f9cbb7d14afcce7e80bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665457278, "uuid": "7bf9f0f6-ac7a-414f-b354-ea462a9f444f", "value": "6144:xOgx9wLr11UkJxfSUYtf4qsbYL9AI+rNSlkbLp/PXO7c:xOgx9wF11fSUYtf4qpLGI+rNIchXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665457278, "uuid": "4596a734-8c71-4693-955a-f4520158e732", "value": 348672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665457278, "uuid": "d097e8f0-24ca-44fa-b145-847125c5e08a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665457278, "uuid": "9e8f468c-3608-4731-8459-ac954347c1bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e2dbc3-4958-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1665488161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665488161, "uuid": "0d7c742e-a4b7-4927-87e8-e0c403f4767f", "comment": "Malware payload (RedLineStealer)", "value": "2fcac397054c7cb891d7135125798e7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665488161, "uuid": "1aad57c0-c85d-45c6-a61b-163d5a2b2f8c", "comment": "Malware payload (RedLineStealer)", "value": "6fd2101ef8a9c57ae97eabf68eeac3ce6ae3bef8f6641185157fc224bca556e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665488161, "uuid": "82517bb0-a545-4494-aeea-931e908232bf", "comment": "Malware payload (RedLineStealer)", "value": "07484de06df0238ea220f1cf5a902d7f34b088bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665488161, "uuid": "dde5a7c7-4114-4c1d-9dc0-35f6163d9f70", "comment": "Malware payload (RedLineStealer)", "value": "00ce06b132df9f5df4774ea93de85241b78317b451f1679d89fd5b82a21c8748fa32dbe15fb8e9a75a0a38454d423fd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665488161, "uuid": "252c5a18-1f4e-4bc4-ac25-cf358e57695e", "value": "T19A75AD177A59CE12D0690733C4DFC00883E8AD82AB66DB5ABE8A33AD15613E71D4D5CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665488161, "uuid": "fb38d0f4-ac6b-4435-8a33-72c682b1a420", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665488161, "uuid": "da94adfd-6c3b-4122-a19a-30ffd686d1bd", "value": "24576:eXGq9fNAehxNnn+MsgnUQ0+vgd9Ulk5R/+VKkccpScpuw72sEeh8Sx8y:PqVNxhxFVKQKHgk5RmVKG7dr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665488161, "uuid": "cad8ea9f-0053-418e-aa64-11f7483eddf0", "value": 1693184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665488161, "uuid": "ad450fc5-0d0f-41e2-b981-3b8db701021f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665488161, "uuid": "3cade09b-364d-4813-9a29-1fb677af95d1", "value": "2fcac397054c7cb891d7135125798e7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0fb156d-4963-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665492884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665492884, "uuid": "59440b43-ea10-4f1a-86e5-08da0c137c02", "comment": "Malware payload", "value": "b7ed1c8c63fac0688b2409a4621a98d1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665492884, "uuid": "2d2a8955-8ad0-4274-b863-6865dc82ea31", "comment": "Malware payload", "value": "703f7f528a2e1c2321c70f971a9d2bc6e924c1fe27fb52926f94a78c3138e4cd", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665492884, "uuid": "0c6ba4f8-3c4e-4555-b571-99cb7f512e4c", "comment": "Malware payload", "value": "90d0edc94e43e9d1d7671efb450be4832e811a5d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665492884, "uuid": "fbb02c5a-ea67-459d-b298-0494bea167d4", "comment": "Malware payload", "value": "430f1f7703b308a00578dc3e499b4659dd5ea643972f8bdca5e585678cdd4461622025a174975c7380823b65b2ab6825", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665492884, "uuid": "369c96ce-0e38-4708-86d6-e842821cde26", "value": "T1A8A2D0331F74D808E67BDD3E4B9FD12BCFA349EA2444F44F11A4A0891AA1A861D9B4A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665492884, "uuid": "d4f7d601-18af-4371-8ad0-881cc847d255", "value": "384:Bv2dRzcLbmZe6WkHZGYnHElNnh7/5t2K8lZNLnNXaJtbo9p+xJT6XRFOmg:dYRI4WkHZG+Hqt5EFNLNXaJtW+xp6+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665492884, "uuid": "2bc165e1-9011-4bd2-bc15-78f7bd9fe46d", "value": 22209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665492884, "uuid": "c1d6267b-3335-44b7-99d0-b2d0dbce9269", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665492884, "uuid": "86e342c4-8f1c-401c-abc0-7f30e00b2688", "value": "WMService_WMService.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48256372-4941-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1665478025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665478025, "uuid": "2d99b9f3-32ce-40be-b933-9663f41517cc", "comment": "Malware payload (Formbook)", "value": "97b4be8bec16eab5856d43f2754a41b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665478025, "uuid": "dd394699-6249-44b5-99d1-dcfe632cf87b", "comment": "Malware payload (Formbook)", "value": "709fadc9b117a1a600f71c727e8c2c879434d118f79e033f7a2aca969068c9cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665478025, "uuid": "7775363e-00b5-4d5f-ae48-3f2eaae3e218", "comment": "Malware payload (Formbook)", "value": "0432e9e85c4f678b32b367a1252053ef70fa9521", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665478025, "uuid": "59f019d0-65f3-4027-a349-7f7e7b9b56b8", "comment": "Malware payload (Formbook)", "value": "67d04a532b8644e3e0aabc4b604d1d2e5808cbc8a2271fbc8c25ac85a9d963c0a146e60d64b93f9496024fe3b5084f83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665478025, "uuid": "59323edf-8210-46c5-94ca-30774edf1efa", "value": "T1DB356B7E2A964907D8153131C497D1F32AFBAD50A062D2CB6AD72F5FBC412BF950338A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665478025, "uuid": "1770923f-d543-4919-9ebb-4be1f56e77d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665478025, "uuid": "81a1a284-4267-465b-b525-079b58b9afbd", "value": "12288:r+ADUsQOcn2Q9tsRG9FTjr53roLSa5MTAduFrPQEzC3/AJRAQSQy4AK:r+A+brqOjr530N5Pdg7Qx/aAtQy4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665478025, "uuid": "39190197-ab55-4615-8093-8bc228fb8a65", "value": 1071104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665478025, "uuid": "d172a516-ae73-4ab2-87bc-09c37b5ccd32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665478025, "uuid": "806b0c1a-8589-4433-9064-a9febc32b9de", "value": "Odeme havale bildirimi TL92160020040-R20221011518562707503.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d574fdd-4900-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665450143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665450143, "uuid": "7a66e0cc-a767-4814-a036-b72992cf573f", "comment": "Malware payload", "value": "4c6aae59678412209264a98c9cfa26ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665450143, "uuid": "d15b62ae-d389-476c-82f5-221d9bbb5b45", "comment": "Malware payload", "value": "718fe3548489900866639b9abd0b87cf1ee84eb9b7a0f850d2e527e6c958bd8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665450143, "uuid": "07470e8a-c34b-4320-9b98-091cb7865d1e", "comment": "Malware payload", "value": "e5008acc14e8b9c1907151ff266f0a7a5ec27ddf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665450143, "uuid": "1f91b908-5b5c-46f1-8e05-c847098d173a", "comment": "Malware payload", "value": "6d7aada5399310dc4a3e72a980e7efb0642ac385c77f8f82eb58721ebbe235041ed94a4cd8e9b9b45bd3b30063e82d2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665450143, "uuid": "abf41563-7510-4bb9-8c94-680622bf2998", "value": "T15B76331536D44CFFCA6E16705D590FC8B1DFF32E0E1C18B363CA06A8AEF9548E985698", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665450143, "uuid": "acdd4564-dd01-4afc-96ae-5754cf5adc5f", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665450143, "uuid": "846f95bf-a727-4452-82e2-3198ff01a87f", "value": "196608:91O/8a5/JSDVebkdJu+4xhICcMDnXgeWu3efueJBPnjZN:3Or5BSwCD4HICFnXgRfuGPnjZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665450143, "uuid": "eea4b59f-d155-47a5-b25a-1ca02f1a19d3", "value": 7647365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665450143, "uuid": "5265a82c-b255-459f-92c1-9b52598787b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665450143, "uuid": "39226a8f-7df0-4905-8220-1515025029cb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443f6314-493f-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1665477159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477159, "uuid": "15516ac9-d252-4c60-ba5c-405feb514dc2", "comment": "Malware payload (ArkeiStealer)", "value": "a156800b9afd9e30ffce8aa6e89d6cfb", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477159, "uuid": "8f6f27de-4f10-4a6e-bb4e-2d995767fc96", "comment": "Malware payload (ArkeiStealer)", "value": "72669ad28f1c57884d5267089a9fe18033a6a88fe15a9c8461be8c69ae61f426", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477159, "uuid": "acb6a252-4f8e-4eb5-b65f-285a70a9acd4", "comment": "Malware payload (ArkeiStealer)", "value": "7b0769c3164faf45d071a0da7e8fafe0eaf4fc82", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477159, "uuid": "f1b9ade6-6bc8-4ab9-9737-6890794835cb", "comment": "Malware payload (ArkeiStealer)", "value": "216696362028682b772e11e4f53b1af83201a1e8d9b317696c865a84e8baa7d93674ee72a38108fd34caa9e6853bb41e", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477159, "uuid": "6b2ce77e-4bd3-4fd6-a7b4-7abfeb47be22", "value": "T16924CF123690C472E2A216398C64C6B46FBBB8710B765AEB7BC4076D4F343D3AE35346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477159, "uuid": "8b809671-6401-429a-98ef-8010115c2eb9", "value": "f07757163332cdbf737bafdb4614222c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477159, "uuid": "b09bd775-fbba-42a0-8887-1d0f6db1f60a", "value": "3072:8IrFORTjcu77LpRZz0/RFJSMHC44D7Vl6lLCBm8GH6PbZwkFEaSvMO:8c6hPLpRZz0c4EvVlQLBMdF6TM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665477159, "uuid": "d068b0be-d672-429a-a738-39df52bea262", "value": 215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665477159, "uuid": "9acfa402-8725-4e99-8796-937850bea59c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477159, "uuid": "bde437eb-b7fc-4c6f-8ee5-53bb2d0d8f14", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bad35309-49a0-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665519019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665519019, "uuid": "4b08c61f-1481-4f67-af49-377954d23612", "comment": "Malware payload", "value": "7630029622a80a4a6563200a053ac39c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665519019, "uuid": "513f2a63-0925-41fa-9061-136d8a35db25", "comment": "Malware payload", "value": "7310fb74edb1596430ef2e68fd3d339df540ae79e78d74895697ac81a1533204", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665519019, "uuid": "b06be180-b99d-48f5-a40d-1ca989b5c3b0", "comment": "Malware payload", "value": "54bbc37e0fd0dfe0d23874c295e59fa303aac7ff", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665519019, "uuid": "eb910814-ec1b-40c6-bbed-6900a3ccb691", "comment": "Malware payload", "value": "dfb63ae2a9e3d5a2280f3f1a79f74df4e33a238ed1f12c3a38bffc635c5922348347f65eb321bbef581f98c83264099f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665519019, "uuid": "d8c0a225-6345-49a9-aad3-75654cca9de0", "value": "T150141003365DB04FB539BFB3F76FF792423F9AA27A0E659804C5018662E1884A5F7172", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665519019, "uuid": "149498c0-05d6-4d58-adfc-dbbac30d4276", "value": "96:dyYRYFYDnYHFLvTfJZf4UbbNhtF/Zldy2ILS8414NEWUvWZ1+AN1qHk:d9ua6Ay/ATm45ZJ1qE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665519019, "uuid": "887a9b65-3d59-4b37-b120-586e0e01e6f6", "value": 205904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665519019, "uuid": "78a0078d-19e0-40f7-9d7f-6897b30321e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665519019, "uuid": "5bc90164-f56f-4fb6-8351-5d12d07225d1", "value": "0025632547_Reportes_Certificados_20541874651198912310 De estar de acuerdo con la informacio\u0301n proporcionada, corresponde regularizarla presentando la declaracio\u0301n.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fd03966-4918-11ed-9266-42010a9c0072", "comment": "Malware payload (NominatusStorm)", "timestamp": 1665460482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460482, "uuid": "9bad8cca-bebc-43f0-833b-f7fe729b9529", "comment": "Malware payload (NominatusStorm)", "value": "da29a3febbcf2d1d9e77d2b7441bbb55", "object_relation": "md5", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460482, "uuid": "c5a0bf6e-8896-47bf-a535-81ba76f32d95", "comment": "Malware payload (NominatusStorm)", "value": "732b27c0cbe15ac421bdacc12475f89b5424860d4124165931526f498df53763", "object_relation": "sha256", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460482, "uuid": "e92d10e4-ef69-4f20-a977-4e39dfeee80c", "comment": "Malware payload (NominatusStorm)", "value": "432995a3cee8565c13bd55640cde8b59e69e8b85", "object_relation": "sha1", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460482, "uuid": "784cbccb-1810-4f09-82e9-bda93e985e52", "comment": "Malware payload (NominatusStorm)", "value": "3bd87cada4a8306f7410b8a408d8fd579aab1ec976b5328131a339d50aa82c4263d429b1d43370979e7af8b9f9c00674", "object_relation": "sha3-384", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460482, "uuid": "f15e7be7-9700-4830-82b4-5368540b54ed", "value": "T1BA957E963B92C12AC06E03350CA1D38B2172F86A9F1342D734D9B37E7DBEAC44A755B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460482, "uuid": "93d48195-33b1-4d76-bc29-5b557239cbe7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460482, "uuid": "72803398-d393-46fe-a499-0dd7ea5168a2", "value": "24576:lKKKKKKKKN7ChBWMQ+uSJJd3Dkd9+ZDd3vNSM0y9T+m5WNDV:yjLuSh3i+FtvkMzT+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665460482, "uuid": "81f50953-3d7c-47f3-9032-42117c3000f7", "value": 1889152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665460482, "uuid": "1fc03caf-56c1-48b9-9f6e-c8d8faed17f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460482, "uuid": "2188ad94-2700-43ed-b01c-e8f8ec53bd70", "value": "732b27c0cbe15ac421bdacc12475f89b5424860d4124165931526f498df53763", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7dba2eb-49ad-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665524678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524678, "uuid": "19a36baf-48ab-437e-9437-f1eea850bb0c", "comment": "Malware payload", "value": "4448083027bde42252a132ba5be0bd25", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524678, "uuid": "b179ac7c-3561-4b16-a36c-82303313242f", "comment": "Malware payload", "value": "733265d39b02ddae36cd52b1c6f6fd9f5fbae7bf0102e971fdb728bc0181e64a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524678, "uuid": "0333bdc2-ddb7-43b4-b0ad-730284f03e0c", "comment": "Malware payload", "value": "2637028e5bccda6f186f1f323e97bdd5858b90a3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524678, "uuid": "d6a55d4e-0671-4493-8cf0-928d28e782e9", "comment": "Malware payload", "value": "2ffbbd1d0c01d13759a5feccd1645e6173b97eed63fcd64ddc3d15c4d50b2ecb949e4b4c3d663c8e0cfa53c812e8ba09", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524678, "uuid": "ee356afc-ac71-4148-9f0a-3ff73725bbce", "value": "T14576BF4277D1C076C0AF03310876D35A6272F9668F2283D77694AB2E6D76BC08E72B75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524678, "uuid": "38f44795-c83f-4fc2-8288-b041d3039e3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524678, "uuid": "2523f8e6-be3f-436c-bb4b-d6c3e97d4bba", "value": "98304:FLu1g9ZGlWrfTZmHqXE9ssD/QjI+1ozfLu1TIRtUOVC:Fd9JTZksaJ+1orTRty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665524678, "uuid": "f68f112e-cc4d-4ccd-841c-9f0d04758678", "value": 7470080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665524678, "uuid": "e3c50aae-2e77-4138-afca-36673a64850c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524678, "uuid": "069078e9-2302-42e3-afbb-2d005c9b9167", "value": "733265d39b02ddae36cd52b1c6f6fd9f5fbae7bf0102e971fdb728bc0181e64a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd3b94e-492e-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665470167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470167, "uuid": "6ac97ca0-5220-48f7-abd0-e2a3ccda4d53", "comment": "Malware payload (SnakeKeylogger)", "value": "f7f1358c90087e2a14cbe57084db96ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ-Tender N\ufffdU", "colour": "#1537FC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470167, "uuid": "fcc04966-a85e-4de0-916f-b2a65e35df8d", "comment": "Malware payload (SnakeKeylogger)", "value": "747100a4eb5ab21b8410559e46ac1da8c2ed73ed4d3313d7ee5987a02a19e3f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ-Tender N\ufffdU", "colour": "#1537FC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470167, "uuid": "7634ac37-a3d2-44f3-b347-52b0678d2d9e", "comment": "Malware payload (SnakeKeylogger)", "value": "fc84a58f11bdab641230dd6280f5e55299fb7922", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ-Tender N\ufffdU", "colour": "#1537FC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470167, "uuid": "ff56376c-73be-4974-a356-d3bd538cae05", "comment": "Malware payload (SnakeKeylogger)", "value": "c1da27d0e8618cdc9e7347cb0dd184c0254614905fafa66b5d4a0ba727c0e094119c7c2fe4c28c5ae49a3649d942989a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ-Tender N\ufffdU", "colour": "#1537FC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470167, "uuid": "db295bdd-4ce9-47df-b6d1-5a7aaa617314", "value": "T1C3A25C487B9DD232DA7D413F0063434483B8E597BE52E63F9CE869AA5E9261C0AC17F4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470167, "uuid": "50cf3464-66b9-4b3a-b014-9debe500f52e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470167, "uuid": "2b4d2f92-d962-4ad8-9e25-51f56c91e3e6", "value": "384:nid4NJEYPkm/GCREg0wEw3hI5ZFijoVJ57yY+vGyox8u5/DpW+w:nI4NJEYPt/GXLwEw3KdJ5D+eyM8upi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665470167, "uuid": "563fd48d-6a99-4ef5-acad-e6496d087ace", "value": 21504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665470167, "uuid": "0a547bcc-c741-4b0d-8245-1df6c5012715", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470167, "uuid": "f2f95a27-d3be-4749-a13a-c8519019f6f6", "value": "RFQ-Tender N\ufffdU", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb2a2120-49bb-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665530643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665530643, "uuid": "12ef790c-0202-4265-a9e8-7365e1649b02", "comment": "Malware payload", "value": "4453cc4e28c4e70e4efa2d86dc7b55a0", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665530643, "uuid": "2377309c-9885-439a-9e1d-8135bafedcad", "comment": "Malware payload", "value": "7476444680acea7d3318904e85951546fc73e89ab0e983bef6a8445571942c39", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665530643, "uuid": "62f6c2e7-f5ad-4fe0-88d8-e16f004aae6e", "comment": "Malware payload", "value": "4fe0eae928bf3cd34879d8f77b645f43236ed374", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665530643, "uuid": "ac0700ee-f3d7-4d57-a66b-5c73d117b4f5", "comment": "Malware payload", "value": "68ac2a2cda971970d6637e9202263a4bcac3ca04c5bd696d92cdd955f6ad0e9d73a1cbbfa6e46780f9dcae2f7577c573", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665530643, "uuid": "87c6593b-f531-459a-ba5a-f47253740c7d", "value": "T1E925126F4DA2E9681EAC967D7EBB0478331664D8E1AC11DA9F81F0F2A7C183D414F48D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665530643, "uuid": "a3d10fb7-93cd-4e77-94b7-719f724299e2", "value": "12288:Yva4lvoW4BMget5PBPXwQay7OEbJWFTpjAbXGnGKsZ8nU2OrKl3t/GYJx60B+umW:x4loOgiD+y7a1QUdvU2Okgmo0gumH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665530643, "uuid": "31ceeb30-eae1-43e5-aabd-35871a339015", "value": 975635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665530643, "uuid": "b8449697-459e-4d60-b2b2-813a74e479a4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665530643, "uuid": "9ac53c6a-2a13-4cb8-9b18-b9e92f1412b8", "value": "RFSL_2288.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f340fa6d-49a7-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665522120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665522120, "uuid": "8a13dfc8-7fba-4dfe-a086-ebe40ba2d822", "comment": "Malware payload", "value": "e945e2ce5914092b99706ab6aab73f00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665522120, "uuid": "30707b87-5f43-4a7c-9dd4-6aaf8a206f30", "comment": "Malware payload", "value": "748ef4d47aee5ddadaf8ef3c6471c4072459126a1f747cae05cebc1f7f966230", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665522120, "uuid": "1ba92a2c-cab1-45cf-8c33-3a9c498f81ee", "comment": "Malware payload", "value": "21f431b0cd6304f6ae0f3c42de83cce6c34ba22a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665522120, "uuid": "5b1d6334-db35-4556-a2f9-e998eb906edd", "comment": "Malware payload", "value": "822449e714b05e54949ed51d92718d1bfd1b54411141ca0c4425865097db39197dee74ccdbea0485b440d6f9be138a04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665522120, "uuid": "09b78452-1f32-438f-b95a-99301e63745c", "value": "T1A676336130E0C9F2D30218B6DD691FC5F5BC966B0F2A8D53FFD35A1E4937AA6E022611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665522120, "uuid": "019a8bf8-0cc8-46cd-93aa-f0cd95ea3c71", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665522120, "uuid": "1771f1f3-a331-4d6c-9c1e-a37b5b81ddd9", "value": "196608:91OvaBoxQd05ELwCdlYoF1Iqjn3p5XQMB/:3OvtxybLtduo0m6MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665522120, "uuid": "17ae34b2-ec3d-42b5-b567-5c296b1af281", "value": 7623173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665522120, "uuid": "da506510-11c8-4330-bf0e-5258daedaaa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665522120, "uuid": "5e93a517-cdc8-4ee3-97dd-b49f5e811b63", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9543c02a-4913-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1665458397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665458397, "uuid": "07ee467c-1555-4c37-8c79-f91a3ec3c59a", "comment": "Malware payload (Smoke Loader)", "value": "552c1097b4a19b6f12343157e4e4116a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665458397, "uuid": "4a82b239-c940-4a1f-b4c2-046484d2a30a", "comment": "Malware payload (Smoke Loader)", "value": "7496ba82b39321475819b13919a9511c0a8ff4e5f752604cf29884b427eb5df0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665458397, "uuid": "bb27dc63-3698-4973-813a-dd57e2a9b48d", "comment": "Malware payload (Smoke Loader)", "value": "9cc8a32f4bc1807d2e61f6d81800be886011d64c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665458397, "uuid": "aa830f29-523a-4e6a-937a-6f5a8819cb62", "comment": "Malware payload (Smoke Loader)", "value": "04bc2ece71fec271b97766b170fb6ea5fbe23411cfffe09f1f5230f0e8e9f510c8926faea7abd60df0d47c5935f22244", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665458397, "uuid": "bb8a6846-d9a6-4441-bd22-3e046b3b70c1", "value": "T19524CE123690C472E66652348C65C6B06FBBBC715A39978B7FC81A6D4F322D29E35343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665458397, "uuid": "81a1b54c-6c7f-41c9-a7f4-1d105b9fe906", "value": "78ee95c35be8f9cbb7d14afcce7e80bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665458397, "uuid": "230d3717-e93b-4f31-8e9f-ac3639a37988", "value": "3072:01lo/XmZAnt2IsL5TqFPMRGNAW6eGPemV+oh/Fc5f2RcguzPicys9XrhWO:0jjgtEL5uFPOhemkohkeRP6PicvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665458397, "uuid": "57ecf540-0ace-46aa-8275-b06464c12cf3", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665458397, "uuid": "45a8a2bb-9b93-4f1b-847b-133333b0d2ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665458397, "uuid": "8ea6e908-e51d-44cc-a7e3-b6c889f27678", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49674017-4919-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1665460847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460847, "uuid": "6bdbbe44-870e-42e2-b685-6ad791699f74", "comment": "Malware payload (GCleaner)", "value": "79b70d86eccd3cce15321886a2d3ddcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460847, "uuid": "be2d8180-9dac-4333-ba6d-fae34d6dd682", "comment": "Malware payload (GCleaner)", "value": "74b17d15bae61dd6971a1917c534c5a30fabe0121d2b58c9bcfd8ba54aee4a17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460847, "uuid": "661525b6-219b-4dba-9cb1-63d397bfe85d", "comment": "Malware payload (GCleaner)", "value": "9ce5bf01f25478d5c6f503b3b2eaa76b3368b876", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460847, "uuid": "8f280146-4307-493e-a40d-1dcbbac81a31", "comment": "Malware payload (GCleaner)", "value": "49f9fad2e7a01c8cefdf706795c0b8b4ef6e27903d0fd8e3be14b838ab5dbb136995810042717783b1e1ce4d9547250e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460847, "uuid": "8513d5c5-9336-4f02-ad7b-84b14f0f3a1f", "value": "T13474E01239C5C832E66A7235CD75CA752ABBF86414315B877FE812AD0F326D29E343C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460847, "uuid": "ff813826-c2a8-400f-b362-d75dcfe6cebc", "value": "f07757163332cdbf737bafdb4614222c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460847, "uuid": "4640a8f0-ed74-4247-a825-5ed336e5a10f", "value": "6144:yEqfrfLqI1ip6EiLaSSFQD+YmFWq9MHEq2mheG2pSp:yJfrft1iyLaS7/gMHEq2mheG2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665460847, "uuid": "cf5bb365-7ca0-4c8d-bb68-346e0d5c6b8a", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665460847, "uuid": "d1ab9649-2180-44cb-8bea-026f561b55bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460847, "uuid": "12a15a14-97ef-4a0f-b6c6-11a1f6b2f249", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083ba034-493c-11ed-9266-42010a9c0072", "comment": "Malware payload (NominatusStorm)", "timestamp": 1665475770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475770, "uuid": "d0f8fcce-002a-4d52-9c2d-6e675db34f16", "comment": "Malware payload (NominatusStorm)", "value": "5a2fd76d2f0709c573ee1d58cb43df5b", "object_relation": "md5", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475770, "uuid": "edeb6a3d-629b-4198-abc1-c3661368ccfa", "comment": "Malware payload (NominatusStorm)", "value": "74f9997168c4b80ef633ca4fb5359cac15c09b4a437e02df44174b925561cedb", "object_relation": "sha256", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475770, "uuid": "a9f0363f-94f4-49c1-8a30-1f46939b4a78", "comment": "Malware payload (NominatusStorm)", "value": "c488244b6732554911079c6a15a577719bd20f72", "object_relation": "sha1", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475770, "uuid": "c0f0b9a5-3649-47a2-979a-aaaa05f4ddfb", "comment": "Malware payload (NominatusStorm)", "value": "d73515fe23596091a9546055c818e62866e3b3026cabbbc1b575c6cf0065dbce996483aba7b9e71d8cca8a46686be507", "object_relation": "sha3-384", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475770, "uuid": "7b9d8300-cd18-4235-b9d2-dedff3282ea8", "value": "T190D409B9D2B7CD20F06E4234582653042630F7B2B97BD66E328CB51EBF1CD506A92779", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475770, "uuid": "2ff4db92-3ae0-449c-ae6c-73bc080b61f0", "value": "12288:aWWWWWWWWWWWWWWWWWWWWW8sLOSqf98+wCkX04N:aWWWWWWWWWWWWWWWWWWWWW8sLwf9ZwCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665475770, "uuid": "228dfe47-df7e-4b62-ac5b-4a65a8b0b022", "value": 637805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665475770, "uuid": "1ee8fd43-3bc1-4c67-93dc-e3062038e4b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475770, "uuid": "619261ef-3051-4ce9-bce4-4351c77f4266", "value": "74f9997168c4b80ef633ca4fb5359cac15c09b4a437e02df44174b925561cedb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71294143-4904-11ed-9266-42010a9c0072", "comment": "Malware payload (Heodo)", "timestamp": 1665451894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665451894, "uuid": "4d940d11-a9f8-4c89-b12d-3fae03668c54", "comment": "Malware payload (Heodo)", "value": "530d6705a7211bee102be0489649b00e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665451894, "uuid": "b87793c8-16ad-4986-8f81-cfb0f8364f21", "comment": "Malware payload (Heodo)", "value": "758ced4a2733be114a39694f9bbe6931b3f1427d3d0ec9c8798062621b945428", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665451894, "uuid": "f7f83f9b-32c3-48da-8a1c-bd495077496d", "comment": "Malware payload (Heodo)", "value": "c5a2539456136ce245b90c271c3bbe40a8611993", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665451894, "uuid": "40c17c07-284d-48ea-b851-be1b1ee3b597", "comment": "Malware payload (Heodo)", "value": "83ad69aff2ccfa0a510d63e93799eb00ec024f5f443ad5cd0c471e5d07f938b3d864d1a874a1bef55121307a6ff9a35e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665451894, "uuid": "c285c7fe-50df-4930-ad0d-101d7ac5f97d", "value": "T1F824CF1235C1C072E66702788C69D6B06EBBB8751B3D568B7BC8066D8F362E3DE25347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665451894, "uuid": "192fd793-af47-471a-8a53-1549782dca0b", "value": "78ee95c35be8f9cbb7d14afcce7e80bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665451894, "uuid": "7ed31f64-4a35-4f05-abcb-8cdbd8359e4d", "value": "3072:+sCaMBPqGEo/XfDAhk50DLR3HmgBRGRYW7c1SnqcuEV/MN6xCiVU/O:+s6EWMkuLR3Hm0tUqcr1MN6xs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665451894, "uuid": "68c933b4-09a2-4f16-b25a-eac8ed8da0df", "value": 216576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665451894, "uuid": "23da850c-afe0-4e1e-bb25-7349c4961161", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665451894, "uuid": "3687887c-f859-4b18-ba5c-a045a6f21161", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad611e4-4925-11ed-9266-42010a9c0072", "comment": "Malware payload (TeamBot)", "timestamp": 1665466298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665466298, "uuid": "a5835e2d-124f-434d-bd11-d9628a2eb869", "comment": "Malware payload (TeamBot)", "value": "6a121b6da5d39ffc34002822d1618577", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665466298, "uuid": "d12274d6-8b68-4d91-9202-46daffb229a1", "comment": "Malware payload (TeamBot)", "value": "75baf7c913ad0591151749df8feca137c34bbf8abc961e6dbb0efed3c5e85dd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665466298, "uuid": "b0881e01-0f67-41c0-865c-95cee1c2803a", "comment": "Malware payload (TeamBot)", "value": "a19a8676327b2e88482c9c5ec954ea0bf08209b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665466298, "uuid": "76d935c0-f0c0-41bc-88f2-5ff16334490b", "comment": "Malware payload (TeamBot)", "value": "da2e13ae45a49fe181318c12ab07694a182fa9a0693b486b44486c215ff26c93b813117b8fa50e27b88839b3ae989cab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665466298, "uuid": "80c2d637-7f3c-4de2-bbf7-6f4734dc8d86", "value": "T18324CE1232D0C473D2A242798D65D6B06FBBB8351AB55A8B7BC8472D8F316D2BE34347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665466298, "uuid": "bf8e78a0-fd3e-4552-8287-163b78d87d5f", "value": "f07757163332cdbf737bafdb4614222c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665466298, "uuid": "79357e64-03f5-4129-8ed6-f1fb4ce5f7c1", "value": "3072:ZqcODHjkCTLTDwTRFd4R0HeUcpUTaxCWTovP3e37atcNikGxlK8O:ZSgGLTDwqRQTeTovPIWeNpkl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665466298, "uuid": "3f2da833-c8d1-4789-8925-4c38924c1d72", "value": 215040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665466298, "uuid": "ef5e10d7-893f-478b-a7d6-ca975761b061", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665466298, "uuid": "8c17aaf8-739f-4012-8d74-25d76232aa50", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f971e937-49ad-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665524708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524708, "uuid": "579fcce5-c86f-4a37-a681-037adc8a607e", "comment": "Malware payload", "value": "0acce440ab2341ee473ad5b54ef1cdec", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524708, "uuid": "151b5ae3-13e3-4db9-96ae-4935bd2bcb89", "comment": "Malware payload", "value": "75e5abc7093b5a847e1412f30b9e6b81865d9fdc8566e1e8b70d6b494b789260", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524708, "uuid": "f55f9b52-e5c0-40dc-bf05-49bbf906d2ce", "comment": "Malware payload", "value": "4b392e55bff5225fbc5fa26d58a763289eceb696", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524708, "uuid": "f8f6107b-37c3-4391-aa33-02602dcb21ad", "comment": "Malware payload", "value": "803f3f7bd73983068ce5d098de3a831e63399672931b14e6635adfdbce0c3d9eaf9d4145ccfc229dc9cb52a5e4a14b08", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524708, "uuid": "bf80a091-6d6a-4e6e-95fe-d75717e6267d", "value": "T1FF86BE4277D1C076D0AF03350876A34A2276F8658F3283DB7690AB6E6D76BC08D71B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524708, "uuid": "ef58f3b4-72c9-4d70-bd3a-a33b439ddfba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524708, "uuid": "45edfc32-458c-4568-af4c-588fb60c3bbc", "value": "98304:GLu1g9ZGlWrfTZmHqXE9ssD/QjI+1ozfLu1TIRtUOV5ZTOV5Z:Gd9JTZksaJ+1orTRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665524708, "uuid": "03689704-642b-4ecd-b5ae-9e60e1381e65", "value": 8345408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665524708, "uuid": "96d4cea5-de6b-4364-9f0f-77b7d56fc420", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524708, "uuid": "ea6a1e76-fc26-47b2-8434-a03fa5bc433b", "value": "75e5abc7093b5a847e1412f30b9e6b81865d9fdc8566e1e8b70d6b494b789260", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72c1a1e-49af-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665525563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665525563, "uuid": "891671a6-61a9-4028-9da3-f0bb56c9a0d4", "comment": "Malware payload", "value": "f1e197fef6b8d8ac16216b4c6b0d5f43", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665525563, "uuid": "44dc1822-b35b-4b7e-9381-7722dd515106", "comment": "Malware payload", "value": "762956a84a71379a8975b2061f05b096bfcd97e699f852fd7d0f56544a2bf601", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665525563, "uuid": "2ac8a1e0-31a3-436a-bdff-5344c635a4ae", "comment": "Malware payload", "value": "5c959393590bae7ccb776c336c544b4350a9f62c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665525563, "uuid": "d0fce667-a718-4a61-9a9b-5fad7588b5ef", "comment": "Malware payload", "value": "4e1cce933410b84bba2bbe15be0f9b3af7f02dd849e4ddb623266b6de20bf2c07bd0944f7e17ebd59014c6fd9b6b6ed4", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665525563, "uuid": "84344127-e21f-472e-a8a3-bbd9caf037e2", "value": "T184F52317F375816BC9F6D23325B82239643B9D28DB07AB4A3C0877BD24BBDC84B91594", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665525563, "uuid": "305e6488-73a6-492c-9b10-731ac59ec26e", "value": "49152:D/NUmSHe5UQtHy1fffEcy317sc1x7B3l0ZL7ZhJqZYrLEiZCJLV16ONDp8EYk9Jy:LqL6efffnRcj7jGPJqZ0ZCJ7bNvtyT99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665525563, "uuid": "2d9b8d82-1a17-40c9-9935-0a529daa235d", "value": 3634085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665525563, "uuid": "e56837e0-2e66-4d15-b9a1-623461d58895", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665525563, "uuid": "9a0fb580-d31f-434f-84ad-ea585fe9edd8", "value": "HubGame.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a569dcb1-4918-11ed-9266-42010a9c0072", "comment": "Malware payload (NominatusStorm)", "timestamp": 1665460572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460572, "uuid": "27a67ede-3562-4577-bfb3-2c57acff9ca2", "comment": "Malware payload (NominatusStorm)", "value": "6f0a3be3ce94847e60110278dcf6236d", "object_relation": "md5", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460572, "uuid": "cb553027-dbde-4542-be0c-e94ec176a971", "comment": "Malware payload (NominatusStorm)", "value": "767cebbb9f2e2b76e9dee9bfd7e78a9a6cbb68eaafbf98463279f5396745cd8b", "object_relation": "sha256", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460572, "uuid": "415266a1-45d1-4bd9-bede-02c7e7e27764", "comment": "Malware payload (NominatusStorm)", "value": "b3d14babba0f1c8908d44cb39bfd22ff292066ae", "object_relation": "sha1", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460572, "uuid": "d56f28f4-a7cf-47b6-a1f5-8ebbb56bd554", "comment": "Malware payload (NominatusStorm)", "value": "f668ef942b4043b18f502c59807575ade86498f74cf01aa584fe52d5a469e1ca50a45ea1493dc717a75e84f678892238", "object_relation": "sha3-384", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460572, "uuid": "81eb0d2a-b192-4fc8-bb66-dc4bc025897f", "value": "T18B957E963B92C12AC06E03350CA1D38B2172F86A9F1342D734D9B37E7DBEAC44A755B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460572, "uuid": "574f9840-311a-481d-8fb5-d077af6fa748", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460572, "uuid": "ac623569-892e-4eae-b5b5-ddcf3fd98e9d", "value": "24576:lKKKKKKKN7ChBWMQ+uSJJd3Dkd9+ZDd3vNSM0y9T+m5WNDV:djLuSh3i+FtvkMzT+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665460572, "uuid": "20fac130-55e3-4094-bbff-d72230d2f6e8", "value": 1878400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665460572, "uuid": "f006ab8c-6c44-494c-805a-f4ba53699199", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460572, "uuid": "d9bf157d-2de8-438e-8fe5-259c17616681", "value": "767cebbb9f2e2b76e9dee9bfd7e78a9a6cbb68eaafbf98463279f5396745cd8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1157788-493b-11ed-9266-42010a9c0072", "comment": "Malware payload (Chaos)", "timestamp": 1665475650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475650, "uuid": "88ec2fb5-30fe-4a9d-bd11-a0e6595fdf10", "comment": "Malware payload (Chaos)", "value": "36cb9fb76e6f946f75527a726d343c72", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475650, "uuid": "2807f4db-09df-4163-bb31-00e71b111f44", "comment": "Malware payload (Chaos)", "value": "76ec989254ca1fb81bd880b6f77b870f760e0f32c3878370afffbbd430abefc8", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475650, "uuid": "a9956422-d87c-4c93-bf9a-c3b6c6575645", "comment": "Malware payload (Chaos)", "value": "2c3af0c4cb91cd93f10b25c5e06feeaae01c0ac2", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475650, "uuid": "1ec08e86-25db-4892-b5db-543cc50edf36", "comment": "Malware payload (Chaos)", "value": "96f31f01269a154e8260d5f0d483213b11aa2348ff338dd46506f7a668b6e309ffa4c130044de09b2492a3843dde1716", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475650, "uuid": "75bdec71-c82b-48eb-9685-f9da3bfac034", "value": "T17BB2525EA7BB4D38F6FE1E3C997061107779FE22DC3AC62D19880449082EF58A9507F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475650, "uuid": "72fa4573-3f19-430e-ac5f-8dcff1e906be", "value": "384:tODNWmqnj7YZ9BvctyzwBGnUM7AW3zt9jjNEEJ2hr91C8Ep7b5jj:Aqj70DcWHjjp+r9hs7b1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665475650, "uuid": "8dbb13c7-42f8-4b05-9c03-a99ba7efea10", "value": 24061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665475650, "uuid": "507f66f6-ff99-45d4-848f-ed33aa3d0a07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475650, "uuid": "28a26bcd-491c-4905-88c0-1febb94215b0", "value": "76ec989254ca1fb81bd880b6f77b870f760e0f32c3878370afffbbd430abefc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf47c51d-494f-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1665484237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665484237, "uuid": "a97e6506-9680-4e8b-a602-5fe1acac5e10", "comment": "Malware payload (ArkeiStealer)", "value": "fd76a2d6b3edde0300d09a6143cbf883", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665484237, "uuid": "a86a6d9e-2c9a-4b0b-ba0a-1cd39e8b473d", "comment": "Malware payload (ArkeiStealer)", "value": "76f3e06c94c80fca536c4534b4163457a0cb8fc579d3f986054d5fe70554f659", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665484237, "uuid": "6455e1ad-54b4-4586-902c-989b4ebb60f3", "comment": "Malware payload (ArkeiStealer)", "value": "5b5fb81c75a8ffb50b6b29de69eb324818948aa6", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665484237, "uuid": "95281e02-b59e-4339-8e13-160befd893cf", "comment": "Malware payload (ArkeiStealer)", "value": "a1d623f1d822fa79fae4c82d7ea303272e386ff4bb3f4debad081b2ba0fe8b81260933e1746113d3e7cbdec8c2392007", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665484237, "uuid": "40fc98f3-0560-4341-9333-42ed6527a344", "value": "T15624CF2231D0C032E26616398C69D6B0AFBBF8311A75968B7BC9476D4F352D2EE35347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665484237, "uuid": "a3dc2354-a20f-4dca-b6e9-4c767f95750a", "value": "59de72f24710a4ab3ca7e4fa2f0a3bf4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665484237, "uuid": "17dfa367-8fb8-4e88-95fc-ecb0315998b7", "value": "3072:F3+eq/KeB7kg/CO8zLFZeXvPwMOtIMkTtka0qvtkL6jnYWabeQEhjbr+O:1+l/vBkLFZeXvW8pvG6zYWaSrb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665484237, "uuid": "66cb3b28-6525-46b4-b981-87c7451efaf1", "value": 215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665484237, "uuid": "6edc53f7-9313-40a6-9af6-e4cf01a82c71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665484237, "uuid": "83c37b90-9fdb-4d7f-a9af-2bedf7ab8d1f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a27655e-494e-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1665483692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483692, "uuid": "a7eb59fd-ce58-4159-a56a-f362b4204358", "comment": "Malware payload (Loki)", "value": "7a031efce9f6a77a44b2a016a8d613fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483692, "uuid": "1d08622e-a234-49fa-bf8e-6e62d7c6a458", "comment": "Malware payload (Loki)", "value": "775aac22a4158c70e6e457d13e637873d62eedb5602330b79746ed1499200b2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483692, "uuid": "bef9f049-aebd-4e6b-9bc5-1eed5c4d8923", "comment": "Malware payload (Loki)", "value": "fe009ac3db5231e09958c13bdeea6fcd360397ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483692, "uuid": "e29a3f27-7401-4220-83df-3d4e72779fea", "comment": "Malware payload (Loki)", "value": "3fd6d38aaf68d93854d1bd565d3b4d5d44d46ee66d878f71252a96d78d62bcbd4c067c1b04f48174f28fffe01e25ee26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483692, "uuid": "5433cbc4-cc0b-43ad-b978-5b971058ff2f", "value": "T17A0515B621818907EA653171CC53D1F32BFB6D686272D1DB7AD72F6FBC401BB9102286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483692, "uuid": "419e3b74-ff92-4159-aa8e-69f789124f4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483692, "uuid": "dd60b749-07f2-4e3e-9abb-6ea58de3b7b8", "value": "12288:LR53SNHy1dVx+FygD5qoQbF6S2Qbtd0kJ2u:VcH6dVx+FbD5a2vd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665483692, "uuid": "337eb8cb-ff73-4e23-9ffe-631c3c631fad", "value": 863232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665483692, "uuid": "a3bc43e8-d897-4cb6-9e48-3321e03b6bf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483692, "uuid": "337149d8-2aa4-40c3-8f4b-10c803c4d0cf", "value": "7a031efce9f6a77a44b2a016a8d613fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1b5679-496b-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1665496016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665496016, "uuid": "319c246a-fa4e-4a1f-b063-2c3256cb2f13", "comment": "Malware payload (AgentTesla)", "value": "b7552934a8e10d1e7344eb424871ffec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665496016, "uuid": "3cde62b1-94fa-4c97-ae36-3fe3d2ae0d9c", "comment": "Malware payload (AgentTesla)", "value": "779ad5765b7f4d510f0c5dcad9634ed3a4d800c8a0abe9804f33188f0a192a4e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665496016, "uuid": "1121917e-fb72-407c-9719-6bf7945c88db", "comment": "Malware payload (AgentTesla)", "value": "4c531ed84381a4da929760cf58134ddd872dd2fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665496016, "uuid": "71f27079-42f6-4f49-888d-8e5274a8f935", "comment": "Malware payload (AgentTesla)", "value": "7a716c901fb382a35186e12a51e0bb2be180058ef869bbb560ad84b54de2f92755e800a81fd0aa12c6665116ed7fb1bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665496016, "uuid": "7ce2a0b3-f470-434a-b0d6-fc6a4ae1cf89", "value": "T1DA95F0312F958B17E7AE17BBA470156057B0DC40F3A2EB0B9C6568F80F63B055DF229A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665496016, "uuid": "0e39755b-b3e9-446e-9b42-96e0b27cefee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665496016, "uuid": "b46b202e-0dc4-4248-8a70-019bedda5746", "value": "49152:p0De1Ynnwin4FEgZINDw0lJTEMpRXoYbPu+:uYYnnsDZOJlJYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665496016, "uuid": "9ce52877-bbf1-4857-adee-d8d7f6b3c528", "value": 1991680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665496016, "uuid": "373d5a3b-bfd4-424d-9209-c796e2a03a7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665496016, "uuid": "4311e945-48fd-425a-9c03-ccfe29027ee9", "value": "SecuriteInfo.com.Win32.PWSX-gen.27330.2412", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd37bdbc-496f-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1665498031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498031, "uuid": "1046e535-fc89-4523-9c1e-3b5cffda5b86", "comment": "Malware payload (Stop)", "value": "5564c4680da43fb5501cd028b43531f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498031, "uuid": "8ae773d4-20b3-4454-9b75-30eb083502d0", "comment": "Malware payload (Stop)", "value": "77f6a304c9f641f5c2bb23f1071a28518532f08ecf6aaf99133dfcc89491bcd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498031, "uuid": "31446a9c-e235-456a-95d3-f0628223ed03", "comment": "Malware payload (Stop)", "value": "0e11e3f578c5271423bb9ace237fb2bebe496444", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498031, "uuid": "a567c900-b045-4ab8-8594-90885f988037", "comment": "Malware payload (Stop)", "value": "8d52f4084219caf1d3f5d8c3b792b1694ca18057818d46e75a0a2e89b1d55b2d8f997438c2fba2b8d4e73e6e42ec4d0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498031, "uuid": "33228c46-ec8b-48d2-81bd-bf06c198fe3d", "value": "T1C1F4121232C1C473D26215328D24D6B5AA7AF92869B297873BCE12AD4F357C3BE35347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498031, "uuid": "1ebd3893-2012-440f-9384-8acd3ccc4f97", "value": "59de72f24710a4ab3ca7e4fa2f0a3bf4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498031, "uuid": "19921a3e-369e-4bba-ac3f-4d5b47e69d85", "value": "12288:r2V9envgvHStv9oN66C8trmyWq8NZ15kaf7y0ujTQfNcsWXjvQWuODDJ:r2GmStv9oNRPr9W3yVnQF6XjvQCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665498031, "uuid": "774902c9-1933-4d7a-9bef-a2008beb5f85", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665498031, "uuid": "ee8e9534-5a75-4aa0-9165-b53f4832bb5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498031, "uuid": "98a5dd6a-c465-41bb-b845-4bfa7d44fa24", "value": "5564c4680da43fb5501cd028b43531f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a932aca6-497c-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665503528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665503528, "uuid": "f37acff7-e03d-4758-b2c6-661896924411", "comment": "Malware payload", "value": "efb844ac2e9cfbef9863a56931aa7a7a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665503528, "uuid": "b022be8e-cd69-4ffd-b665-a78782a70804", "comment": "Malware payload", "value": "781275df853c0ecbb524995f6f8ec69e43fcd4e2b885f613582e7e0d6be7fd85", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665503528, "uuid": "a261cca7-971f-4e2c-9d8f-ffb924f89f2c", "comment": "Malware payload", "value": "3ae12cb9cd883eaefbdf9a3ecfb62f5177603f9b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665503528, "uuid": "21501dc3-db99-4eac-a176-895cc5215eb4", "comment": "Malware payload", "value": "5a85f52aca107d2190ee12c2ed971d352ef28d8787965409f4377213827f30441108223b1d39f6e92841f1e9cb58bd87", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665503528, "uuid": "d9be5388-f28f-49e8-8631-9731538f5b0e", "value": "T1D2755B2263EC112DF0F70B76EA39A611BA7AFDFE7D12D51E0454641D29B2B00CA6533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665503528, "uuid": "ad5f3ab1-4b04-4249-8043-aafbdb91dd84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665503528, "uuid": "fb26f898-9b6d-4e22-b1e9-da11c9efffa2", "value": "24576:lKKKKKKKKKKKK+8iCeUhWxcYO04XppcdzT3An6UIiHk7Inij2:9verO04TO3WIXyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665503528, "uuid": "c4ec2552-6836-4e75-a968-3dda188030fc", "value": 1655136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665503528, "uuid": "ed6159eb-dac9-40c9-9818-e3f7030f2fef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665503528, "uuid": "fbc895a8-7eb7-45a9-b40a-c357b102475c", "value": "781275df853c0ecbb524995f6f8ec69e43fcd4e2b885f613582e7e0d6be7fd85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d9ac3be-4966-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1665493952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665493952, "uuid": "84b651b4-7ff8-434f-91fd-6c90e71cfb7e", "comment": "Malware payload (GuLoader)", "value": "70d5e6525199070fb150b17347c6ffe0", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665493952, "uuid": "4a3fc2d9-bbf7-4c2e-a92e-0dd44a28a580", "comment": "Malware payload (GuLoader)", "value": "7891f7ddd4ee0a5ce865f6e05b17b295dcf933f77ef606676577187da01eb0a9", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665493952, "uuid": "6787f867-9fe6-40cc-8a9e-f2f38455fd66", "comment": "Malware payload (GuLoader)", "value": "62653a8480207ec1ca6e36b7fb66f3f1e9604925", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665493952, "uuid": "6ab32e42-d52d-4900-a587-97090ddeeaa4", "comment": "Malware payload (GuLoader)", "value": "8bad49bab8d8eba0c0a834dee3a84024f2febb31f670e1db5172eac209c9b3fe7aa575369627111030001d6af9dc9244", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665493952, "uuid": "1bee77ca-e391-4a45-915f-b0d765cb3c64", "value": "T12EC4E0D1DB1F0977C91427E95C8A0F061C700A79E02867D87EE0966E9249ADC252EFFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665493952, "uuid": "a2130fd7-6882-495c-9689-711a2b8878e1", "value": "12288:bK8NGPM+CC/lh/3TfwMPuQuD29XsWkwLishPnMqRBMpX6:VGUoXfo2NsWbXhPl0Z6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665493952, "uuid": "95329bb7-1157-4b38-ae46-bd473cfc82dd", "value": 563672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665493952, "uuid": "a9bb0b30-2d19-4d0c-a70a-e9eae727ebb9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665493952, "uuid": "8ce7b864-5537-4155-9ae2-1cd1c1fcc46e", "value": "FINDER ECHIPAMENTE srl ORDER no_6365377836553735234242637335363753363.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b018c675-48fc-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1665448564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665448564, "uuid": "25debf46-5e7e-4d0d-8ae4-ee4a67de4105", "comment": "Malware payload (RedLineStealer)", "value": "5de4c3f1b827c5297322478a4e0f0ea4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665448564, "uuid": "e14eb5ba-e3ae-4e8b-94c7-bb8383274d94", "comment": "Malware payload (RedLineStealer)", "value": "78e499d300ed458d79b9cfe6b29528f37c8ac68b42e3bb2e195bec2cbe7f49ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665448564, "uuid": "589d7e75-8852-45fa-b95e-66b1b7e7341b", "comment": "Malware payload (RedLineStealer)", "value": "21cbdb79d31c56a20df29df7261971530c7cf2e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665448564, "uuid": "f8ddf0f0-18b4-486e-b5df-364367e2ff97", "comment": "Malware payload (RedLineStealer)", "value": "155ef9e31f678e8128ba87ae2b54246e9946aa57b64fd806634a2dea735b1c1d42c4b611c6cb0b054ab62e23926b6c6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665448564, "uuid": "e7c97c0a-ff39-41eb-86b9-0dd6ae52dbf1", "value": "T110445B2439EA501AF1B3EF758BE8B596DAAFB7733707A45A105203870B13A41DEC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665448564, "uuid": "f6ef9261-4f20-485d-9470-4959d4d2129e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665448564, "uuid": "68844678-75aa-4780-bc99-c104e3ea979e", "value": "6144:x01+xmnptUoG2KtdtIiVNxZdEO+duhQlsBURt/zdP:4wgBGhdSuNxZdEvduhQlYURt/pP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665448564, "uuid": "bd7b5d72-7e7a-4c24-8467-ffa91250b0ef", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665448564, "uuid": "b8636d67-f151-4e4f-a532-8d114c5f333b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665448564, "uuid": "2df6fd0e-b159-426d-b26d-9f7b5e66ff7f", "value": "78E499D300ED458D79B9CFE6B29528F37C8AC68B42E3B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c193a0be-493e-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1665476940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476940, "uuid": "fecd2d63-aabf-448a-b45c-20701c697652", "comment": "Malware payload (AgentTesla)", "value": "9882a70f2dc27d3ab58703de561714a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476940, "uuid": "920b4537-05ac-46ed-ade7-ae2dfac8bb9c", "comment": "Malware payload (AgentTesla)", "value": "79455f0ef0d3e412e5bc4ab0a382247882dac70ec50882bc39cd8e6007e541b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476940, "uuid": "7053e319-c579-4fb2-ae0f-2ebd4e7b5d5d", "comment": "Malware payload (AgentTesla)", "value": "ca11465cd9cf1e62c684648c5e6d663a2d055da8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476940, "uuid": "ed8cd7af-d25b-4a87-af1b-bfed24804ac2", "comment": "Malware payload (AgentTesla)", "value": "2b65ba8ea4f9dfd9129d5bba5766816b95e7d70f2fdd9542f9e30c1b91622f8037bc05a7d365c4fa177249ba3a335a1b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476940, "uuid": "7f26c454-50dc-4abc-8212-7ac5208dbff3", "value": "T1FCC301671E1988D8F0271FFD67603EA66D541CC3EC2A9D0775407A160FBAB1B8E2770A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476940, "uuid": "3d5afc48-dba9-4f58-ae76-4cc73cf68bb1", "value": "3072:1dfh1mNoLmFK5I6Zv+T41OAzteRP2y5LGNEp:n5xmFK5I4lWtJC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665476940, "uuid": "066b13ea-a3a5-4b8c-a504-48274064c639", "value": 120200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665476940, "uuid": "4de128f8-c721-488c-b6b1-2d0cf890975e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476940, "uuid": "2b0bbe95-812f-44e3-8909-ff7042af4828", "value": "Purchase Order OS222000.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cfff4c7-4953-11ed-9266-42010a9c0072", "comment": "Malware payload (Quakbot)", "timestamp": 1665485710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665485710, "uuid": "c8eb4f49-d3f6-497a-89eb-c6ca0cf651bb", "comment": "Malware payload (Quakbot)", "value": "145a2fe0f191b819c40d909d04cc5b34", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665485710, "uuid": "50b911ed-0272-40d4-8923-ef23fe239e0d", "comment": "Malware payload (Quakbot)", "value": "796ff26db045085ec8162d414cc2deafb2836d3f0bffd8c58af4595ebb4261e9", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665485710, "uuid": "f6d0590a-67ff-4202-a019-27dce738da2d", "comment": "Malware payload (Quakbot)", "value": "429eb61b8b3c82fcb0289ff110b2988aa71ebf1b", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665485710, "uuid": "f8512aa1-964f-4bbb-abaf-ddaf1ab537f4", "comment": "Malware payload (Quakbot)", "value": "085222bd66cf98432bee866d4ea1271c202526352807fa9ef4adc0006fc1238e66d0f209820738e64309f41f1be345fa", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665485710, "uuid": "4a3a3801-486d-4c20-b697-cc640bd2bef9", "value": "T13D054A032284EA72C0760130277B5BD5D32DDC743725CD9A62D8B86DE7394A27636BEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665485710, "uuid": "7cb526b7-6428-47ec-bf90-30ae0571d7c5", "value": "6144:glDulxbcNzXEjchLTaZb+lJIwlD+Nb+lD1bXKHkI42r+a6dxSCoRSUtwRBLWONhC:7ZfZvgWr6RqSUtMLqPa9sbTGGAtt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665485710, "uuid": "97da8fe6-dd3e-4b1b-822c-aae5b2d5438a", "value": 835584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665485710, "uuid": "379b5e99-b6a5-4ff0-b239-eb7d108a94c7", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665485710, "uuid": "37c517bd-cc4e-445e-bb19-6f861f4838ed", "value": "Learn#7435.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f7518fd-49b0-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665525711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665525711, "uuid": "da0678c8-1a08-4c9f-a0d3-15a94a4e6e3c", "comment": "Malware payload", "value": "69f48dd4d1fcc2fae9363d970548dc29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665525711, "uuid": "3287ed95-4c7b-4edb-b685-7bbfd35c19d3", "comment": "Malware payload", "value": "798242c4dcecc89f03a0f3853f6d36c0d5b8f9bb99fec39ec6fd9776da77f964", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665525711, "uuid": "4ca05113-a3ca-495d-9be6-26bc316136c6", "comment": "Malware payload", "value": "545b56bd333ace158cf758a727fafe15a5bc1955", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665525711, "uuid": "9b40b6be-6ee7-4646-b430-f0b69d1d541d", "comment": "Malware payload", "value": "a8ba1dd86f7a7207babe80791dbc75c656176eedb14f227c792b928b6d0bc57b689ed5fb3ed1b958b733791805704917", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665525711, "uuid": "e115c6cd-d7f2-4843-a787-a7cf5b56ca37", "value": "T12424CF2235E0C072E25226768C65D6B51BBBFCB56A35568B3BC8576D8F313C2AE34703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665525711, "uuid": "6251d4c4-e9bc-4516-851c-4fe0b45f2b16", "value": "e680a2b40b54e6ebf1523763588728dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665525711, "uuid": "5794f415-f524-480c-a41c-ed404362569d", "value": "3072:RHUH2YC7gTOULkQYpvvGs21pgInYhKZ/mHO:FKH9xLkbpMPgInYcZ/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665525711, "uuid": "030051bd-193b-40f0-bb10-34fd2570b377", "value": 220672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665525711, "uuid": "353dc724-5bd7-4ecf-a303-3f83e636a297", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665525711, "uuid": "ec4b36a1-7e70-4bbb-a6bb-f1d05b2acbad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd69d218-493d-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1665476530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476530, "uuid": "d9138571-670d-417e-bdcd-d875079374c7", "comment": "Malware payload (AgentTesla)", "value": "c69e896394cec739f4d6485f4e3ed875", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476530, "uuid": "ab93517f-afbb-4293-8d26-5af41c3757c6", "comment": "Malware payload (AgentTesla)", "value": "79dc701b6bfde5f7a84a5beaaac83fd7c4913fb60421b8da848ec763b12a3857", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476530, "uuid": "6e4f0294-fee5-4d4c-a9d5-04ebc57bef8c", "comment": "Malware payload (AgentTesla)", "value": "ef2d6ebbfe1b5573d0fe4bfc0744bf060a284409", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476530, "uuid": "ebf53b2a-75c6-4102-b11a-3d2f7dcce223", "comment": "Malware payload (AgentTesla)", "value": "36e137b2952fb061e0a463470359d39186e1795bdebdc7c11839bf91da008e859dbdd2f6fc35ed2f88a61b47b156836b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476530, "uuid": "4d0c838e-2c44-44e3-8e74-b64d7d2c21a6", "value": "T172E48CAD761076DFC867D4768EA82C74FA6234BB431B5217E02761ADAE0C887DF540F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476530, "uuid": "fd6b600e-544c-44b6-a390-b4aed99546b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476530, "uuid": "3401d63e-6b2b-4e16-8c07-234cb73c0101", "value": "12288:Wdauu2iNaLrej3XUR9GaEt+t1AjF812J8LCkWqYqADqjJ5nf4s5qL7/htIATdnHK:luu1Q83X09M+tijw2JdkW8jrf4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665476530, "uuid": "8b6f7cbe-d5e8-4cce-93e8-0b8426e1984f", "value": 712192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665476530, "uuid": "d274545e-4db8-481c-9a2a-c10875dc7a36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476530, "uuid": "7273f7f8-bf01-4f6f-ae74-65a826819065", "value": "COMPLETE SALES CONTRACT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ba9e9a-4966-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665494177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665494177, "uuid": "d48615be-fe5b-4cd6-83bd-335212e56cec", "comment": "Malware payload (SnakeKeylogger)", "value": "3bf8a3455dedf32ee05dd375b6120eda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665494177, "uuid": "86b1389a-4cfc-4a1b-9e03-8c8f438ff6bd", "comment": "Malware payload (SnakeKeylogger)", "value": "7a15aa77b5dc57771aa96291278d39f2b65832f5d5eed95edf3cfebf80fab616", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665494177, "uuid": "e01509db-5279-4382-8265-a0c83fd1bbc1", "comment": "Malware payload (SnakeKeylogger)", "value": "efe7da2a94798d52efa6f0afa8ece8d5171a206c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665494177, "uuid": "9c09c132-82df-425f-b06c-ca4eb852452e", "comment": "Malware payload (SnakeKeylogger)", "value": "253a6a3abff77b1b72e980dee39b686b57a0ed0a33fcd8f7a87abf787b7f13972fa949095343f313cbd5b4b4f560a7ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665494177, "uuid": "38cb8cd9-14aa-4265-ba34-6a3380b1febd", "value": "T138255A7E259A4907D8143235C497D1F32AFB9E506062D2CB6AD72F2FBC512BF950338A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665494177, "uuid": "bd5bf0ff-031e-4b71-9921-82065eaa7818", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665494177, "uuid": "c76907ed-d0e3-4c1c-af44-ca6548a7c860", "value": "12288:D6vHDFUsEJfKuxAUv1+oXEWS9xOq8o/cLVpdI8RAQSQy4AZ:DwY9F+rT3OE/cLVJAtQy4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665494177, "uuid": "6b4f9b31-75a7-42cf-9065-4a86d1a5a9ee", "value": 1007616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665494177, "uuid": "481b5d91-a6c5-42dc-be34-724d7b0755dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665494177, "uuid": "9fa769ab-661f-46ca-86c2-ae75764c8f0e", "value": "RFQ-236600-ScanCopy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86e2872-491e-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665463288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665463288, "uuid": "9d899f8c-6a79-40ec-99dd-2a5ec7e5741a", "comment": "Malware payload", "value": "6761c7c71ecb4a5332e876df006287de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665463288, "uuid": "a719073c-793e-41f6-8176-b5006c8eb327", "comment": "Malware payload", "value": "7a20e31a7e7ee493b09241791fa78ee74eb456856fc75b9769405c26003b5179", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665463288, "uuid": "c7a38d92-df68-4bf3-82a3-47e221f8e948", "comment": "Malware payload", "value": "6af4b1ebc6aff2c7ac677ea32624907073148b2c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665463288, "uuid": "7fc73b99-9b07-4943-b7e1-338326b8feba", "comment": "Malware payload", "value": "72e4b04ef4bd21b4241729fcabd9d984b72e9e6cd8681d9b8ab93fee039779d7cb370d2e338963d055b48c5a1770ec55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665463288, "uuid": "f1cb7e84-8ed8-45ae-862e-54f050751e86", "value": "T1F934023075E09133C1F763748CB8DE652BBAB0225A6846CB3B58267E9E201D24B7F757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665463288, "uuid": "bc775b8f-aff0-456d-b6b6-4a58a867518d", "value": "1076d4eb9f464e21562d6629e831473b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665463288, "uuid": "b5daa012-f9a6-4aa4-ba6a-942210676c18", "value": "3072:RaPOUOVPlm5lqRQVNrXCRTK5pGexn2/UpprdvmGwgIRgMA6ZPaH7wWGBQQHs:bPlmfx5phRvrdvmHPRgqPabyBtM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665463288, "uuid": "fb14da41-5e4e-4c88-8279-036c9d4e533e", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665463288, "uuid": "ca9088a2-4a3f-4178-a597-d6e2b0477e4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665463288, "uuid": "75e49f84-7a5e-49b9-b69a-410e0fd0828b", "value": "6761c7c71ecb4a5332e876df006287de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88138e9e-4916-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1665459663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459663, "uuid": "48a2c126-6231-431e-b1ca-80c35b7fa7e6", "comment": "Malware payload (Formbook)", "value": "5717ec4b50c5f2c3c3adf7a739daa389", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459663, "uuid": "cc0688eb-6254-49da-9051-654009e69aaa", "comment": "Malware payload (Formbook)", "value": "7a61c229cc9d8607242df81167562e499ea2dd36624744bc871d535222367dc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459663, "uuid": "bed6f5dc-e6bd-46c7-8553-10ff5be0f47b", "comment": "Malware payload (Formbook)", "value": "17843bbac5539cfd467026a8991e3e75aff32b05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459663, "uuid": "c5638bf6-0c4e-427a-8c18-58c0117c9814", "comment": "Malware payload (Formbook)", "value": "3e8f373cc0ccfb99b2c98c64a04417cffce202e58e93732553ab82fe4d8ed73e757a8124d962d85ee7261f62da9277d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459663, "uuid": "dc83f2c2-f762-4bf4-b91e-222c3032638f", "value": "T134258C7E16994607E8193274C883E2F32AFBAD607061D1CB5AD72F6FBC542BF9502346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459663, "uuid": "3a8f43ba-a528-47a4-a397-c7cba4e6d178", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459663, "uuid": "2ddcb530-f113-4018-8209-7dcc75358e71", "value": "12288:Pvwz6PZnkeQTCOOdxBhcK+21SIpBP9TjJiU9FQcJmlWCVXAQSQy4AB:jZdQTBABhcwS2BP9Tt9SAmlvNAtQy4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665459663, "uuid": "e7b460bb-5d0f-4445-bbf6-6cad8dd63517", "value": 1013760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665459663, "uuid": "16e55636-3009-4815-a1db-af51894cf403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459663, "uuid": "f6ffcc37-aebb-4127-8aa1-b62e8d766cd1", "value": "SecuriteInfo.com.Win32.PWSX-gen.19873.11587", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59072e28-494e-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665483636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483636, "uuid": "3567dcd7-f7f4-453a-abbc-82e33dab1025", "comment": "Malware payload (SnakeKeylogger)", "value": "4a964b2729521d9aba6af3d4cf1d8996", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483636, "uuid": "5442c28e-089a-4c0c-8175-14ee86594d2b", "comment": "Malware payload (SnakeKeylogger)", "value": "7b3466885a3f5a38211cd4b6991a384b4a9d8747d5498f4762183e2a48a7fd23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483636, "uuid": "ef26955f-a44a-40e8-af19-592789804264", "comment": "Malware payload (SnakeKeylogger)", "value": "c150b0982f69ef03f97e69c5038f18441ba26c7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483636, "uuid": "3e44aaab-bd24-4b37-91b6-c5b101a5598c", "comment": "Malware payload (SnakeKeylogger)", "value": "aab7e524be8652da55857f8f0242f2a9b3b411ecc4954596b1a053702cae7fa4355fe4318b383f3d9f7478d346db6eb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483636, "uuid": "29296b1e-2398-4387-8bcf-dc5630ef379c", "value": "T164256B7E269A4907D8157235C483D1F32AFBAD506162D2CB6AC72F1FBC513BF950238A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483636, "uuid": "b051160d-9726-4b73-a16b-a804cc917f22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483636, "uuid": "c45a8aa6-dbe9-4ede-afff-23f0d7242db5", "value": "12288:tYLqU1UsmjsAvK2vXfDXW4OMChD3HtVsxIORFy/nRAQSQy4Ak:OLivDvDW4OMYubRFy5AtQy4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665483636, "uuid": "625f9107-dc0f-4667-8262-0638093b5ea4", "value": 1008640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665483636, "uuid": "580ce71e-e1ed-43b9-835e-56e2f8fe96c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483636, "uuid": "e6fbe8f1-c400-4fec-887d-bc5bf664d2c1", "value": "4a964b2729521d9aba6af3d4cf1d8996.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "306e2a58-4911-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665457369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665457369, "uuid": "c840ba62-6b62-4ec3-9302-fc771c428de7", "comment": "Malware payload", "value": "5dd3ec5530f2504a2288ca8d68bcc2a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665457369, "uuid": "775110d1-25b2-4123-97a3-af11628e3d0d", "comment": "Malware payload", "value": "7bdc5052caa606ab7983a6410cbaac2b15cafe2ef89bf9de4fdef15a99000ae8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665457369, "uuid": "352926bc-13c0-454d-8699-79bd00afb811", "comment": "Malware payload", "value": "03389347425ac734b85d672bf5ebf5a377c62070", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665457369, "uuid": "4651ddb7-5392-4fb1-a577-c94c79871f74", "comment": "Malware payload", "value": "8aaebfcf644c4abc0467b9d4b9dce6bad0e3e073f75e3862a44cb1ddca328d9bdc14486454758711b40842384773c993", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665457369, "uuid": "39836393-14cd-40db-ada6-d6b5cc5222a1", "value": "T14A763310BFC8C8B9E426263252F536C991FDE2089E7B4C9323635A5E5C39BC4C3959DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665457369, "uuid": "8c73270e-d2f4-461d-b119-62ae194a39af", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665457369, "uuid": "3ef24ff3-0822-4329-8c58-22bfe339b60a", "value": "196608:91O6iSXsew+Fp0hYALgdUNBnadH0gBFaN/3n/YjWAmlN:3OkXsefshYALgdwnPgBFC/3nwdmlN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665457369, "uuid": "c02c60ec-9097-4a80-b946-e4f75bdefed1", "value": 7644886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665457369, "uuid": "0f4e01d5-e15a-4496-a24e-c96aab20e57d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665457369, "uuid": "a6adb67b-6c31-45e3-90c9-8f045ad7d8ec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c85c048-4971-11ed-9266-42010a9c0072", "comment": "Malware payload (Quakbot)", "timestamp": 1665498648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498648, "uuid": "354c8902-7228-46ad-b683-1c0afc5de05c", "comment": "Malware payload (Quakbot)", "value": "525b39c23a5cc1b77320d254c1f7c6ed", "object_relation": "md5", "Tag": [ { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "pw L875", "colour": "#F7A178", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498648, "uuid": "e8e55e55-53f8-4319-8a05-35144868849a", "comment": "Malware payload (Quakbot)", "value": "7c39668e9562db3d335a1c9c04e87839f1be2d2e0005cf3e97e32237ccee1052", "object_relation": "sha256", "Tag": [ { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "pw L875", "colour": "#F7A178", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498648, "uuid": "9cc2c411-0a54-4015-8a2e-0e47d491d192", "comment": "Malware payload (Quakbot)", "value": "38796b28bdf34e6e5d8f8deaea8f5dd9b78fc155", "object_relation": "sha1", "Tag": [ { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "pw L875", "colour": "#F7A178", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498648, "uuid": "18e87f69-4cab-46f4-9627-7b70e056d1ac", "comment": "Malware payload (Quakbot)", "value": "b165b12fc196fc2f7acc170e81fde36f585664a850309b3ff10488a3e343e7abc2c5048296f6b4e978a7d3ffb5ae8320", "object_relation": "sha3-384", "Tag": [ { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "pw L875", "colour": "#F7A178", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498648, "uuid": "d81072b6-67ac-4654-bc3f-78d0b8be7443", "value": "T10AB4235B168C6E19621E5F8F9C4A4BE1E0C65297CC792DF2EE593AD1CB0CE7130276C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498648, "uuid": "9dd91a78-de86-4df5-8f3b-f92105225784", "value": "12288:ChfsnhOLTGOXKJlBIpR+Lhtq0cg0iipTt4hx/fF2OcBNZIZbzMiZB0:u0hOfGiK7BIpRGhtCLpGhxgDfwbzN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665498648, "uuid": "1d76afe6-2384-45df-9b79-4517afa8e578", "value": 520338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665498648, "uuid": "605392a0-141f-4af3-b126-d45df0ae49b7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498648, "uuid": "6a74543c-d87e-42ca-91dd-33daf12ecad8", "value": "Co2024739980.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f3aa465-4936-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1665473205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473205, "uuid": "8c793b17-73b3-479e-9174-ea4fb234e32e", "comment": "Malware payload (Formbook)", "value": "a87e3929810d8589fad2cf8fe684b53a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473205, "uuid": "58633497-6bdf-4173-9a87-79142848fb01", "comment": "Malware payload (Formbook)", "value": "7c600c9301a4d8a294c6b3b02eac412060c406137556ee4cface3e090939a316", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473205, "uuid": "618e9106-bee5-48e4-9fe8-16b25e2ff807", "comment": "Malware payload (Formbook)", "value": "1587fb73ae08d515045b0e3767bc35eca4dd0ca4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473205, "uuid": "8dbd9af8-bb34-4afd-9727-0799ca51611b", "comment": "Malware payload (Formbook)", "value": "0108869796c365e4cad49c95ee10a2b40e642e413f8f7415679db0678dbf712fd02fba49bae7d4655adbc6d6cc3e9496", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473205, "uuid": "4399adff-1694-402b-b3ed-72467d3cf6f7", "value": "T1A205E0270BEE4B0BD115B7B884D1D2F6E3E9DD01E427C28B2BCA5C1FF08A665D660356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473205, "uuid": "cc30ba65-5549-433d-871c-ae2f7c01d035", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473205, "uuid": "4e04c54e-1dfc-4397-b294-95ed1b9a29bb", "value": "12288:cAE2iNqpD1GzELmB6SjQS0TvKxd6wpBom/YcPTHPCdc3d8:K1G4zcAfQS0LWw8/YcLv3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665473205, "uuid": "23d5f570-01ae-466e-bc13-4a777ffb470b", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665473205, "uuid": "6aa3e144-fd63-4374-8c99-fe36bc976760", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473205, "uuid": "5fbd6122-4102-4b6a-85e9-e4857f52f3c8", "value": "7c600c9301a4d8a294c6b3b02eac412060c406137556ee4cface3e090939a316", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f3ed8dd-4951-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1665484908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665484908, "uuid": "5bad904c-42c8-496a-8393-26323887f3d9", "comment": "Malware payload (GuLoader)", "value": "15f464f9989137160b14e74ef4550985", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665484908, "uuid": "dd2237c2-130c-4b4e-a975-dd2bab33b583", "comment": "Malware payload (GuLoader)", "value": "7c9e88afcdeebca3c1f07c6a2c571d2fd51260c6dba7fdf0d2d10999ba23836d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665484908, "uuid": "37731e71-ca0c-40c8-aa43-5a9b78b0cd49", "comment": "Malware payload (GuLoader)", "value": "29b389e7bdb84ebf310f5524a78147b39ebb7224", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665484908, "uuid": "d56e2c8d-6baa-4671-8598-849ea211bdbe", "comment": "Malware payload (GuLoader)", "value": "492f26cf0917ca296d95113e96d7b95609b944c299523c29629afd87c6112864bc53d37eb7c236682d924bccaeb7af3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665484908, "uuid": "cf265f04-1a33-4607-9934-988efa1037f0", "value": "T1BA053386FF50E7E7E85D22F1460F226CEBDDAA5710A5678B83952F0B3C05561C32B392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665484908, "uuid": "c35c6c19-d57f-4ba9-a519-5c47534551ea", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665484908, "uuid": "b4393804-049f-42df-a4a6-2d347a81ba13", "value": "12288:XAMrP3fXxRw2VaduraNqUi5gPmZ3Zf2dqHhuztgXdAhVXQr/20jZ6C0WVZTqow96:QgPXxRwmhfUlmLf2G0sdAPQjjNcMG96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665484908, "uuid": "5ddaa336-47d2-4a26-84db-de958026ba84", "value": 838995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665484908, "uuid": "fc264a8e-9fe9-466d-a5f8-6677cdc026d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665484908, "uuid": "eebbefda-aa6c-4e50-9e05-f7ab526a2ec3", "value": "PO-EP3141802303 -42804009_83276378283989393872376532893293009783763.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fed2026-496c-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665496613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665496613, "uuid": "5be1b7de-f8b1-4fd3-933f-f741cccfb069", "comment": "Malware payload", "value": "75234d60de5d1b86b8bb241b7db10add", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665496613, "uuid": "ba4bef42-ace5-4444-bd54-046c5d837924", "comment": "Malware payload", "value": "7d0c864acd8ce3394383312405f3413a8e2eaff42d13e0fb2b4434d95c2f7dce", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665496613, "uuid": "59b7685f-6370-484b-944e-b8a59813806a", "comment": "Malware payload", "value": "88b44765aa4520bd5ffa71b9af3abccc7d8c53e6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665496613, "uuid": "404711e0-f894-4641-bf55-fee2efc50cd9", "comment": "Malware payload", "value": "5b40bad5a5f843b3045e581a3e704ea72758bc83c9a99bc65b8422cef8831d001e3b03284d9064b8ad799f0e610ac16e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665496613, "uuid": "01f91900-a7a3-4ad1-8765-acb5cd9934da", "value": "T151E29EE27E09C4F6C18A2A3100A63C9BD7A95F309872DD4B43917CAEB43E46CF56534A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665496613, "uuid": "d5c91732-6fdc-4119-8bb0-b4c5b7e25c8c", "value": "768:NOZ+lWecqfm9uPQx+VrGaxbbPrvhaU5YOFgzum64WDG9xzbPr:8+lXcqfLU+VrnrhaqYN1WDG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665496613, "uuid": "fc4d374b-4ea2-4fb5-be2a-c3d179f94415", "value": 31744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665496613, "uuid": "b742c25d-832d-42f0-a4c3-66cddc64fbc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665496613, "uuid": "df23f93f-5d3e-407c-96ce-212649b29bff", "value": "7d0c864acd8ce3394383312405f3413a8e2eaff42d13e0fb2b4434d95c2f7dce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "944e7084-494b-11ed-9266-42010a9c0072", "comment": "Malware payload (Vjw0rm)", "timestamp": 1665482447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665482447, "uuid": "ac01973e-5d09-47e5-96f9-ae5f1da4fc3d", "comment": "Malware payload (Vjw0rm)", "value": "0fb3b259e28c68d4feaa3867efda1693", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665482447, "uuid": "0e5093bb-60d9-41c3-95d1-f79763a0d37b", "comment": "Malware payload (Vjw0rm)", "value": "7e1ed337ec4e995f496a39056b84fd9ef91d81118fca9a17f058aed250ea2503", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665482447, "uuid": "24ecbd84-e8a8-4b64-a91e-ff9d98abbfb5", "comment": "Malware payload (Vjw0rm)", "value": "7b189404e5d6d43a03ae0b1ec6bb5967d7aac0ce", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665482447, "uuid": "9dfabcd7-6fb2-4f6b-aace-eaff6f1381ba", "comment": "Malware payload (Vjw0rm)", "value": "081c43b43d6a4616d4b45839eaad00b723370dd40cbcee5116dc550fc60c5ba0bbe147a33d81e7a857b77a492cd36801", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665482447, "uuid": "551a6b96-b71d-4268-a504-22e904f0d2db", "value": "T1BE035C46F95656538B140B063FB8CD789F69ECDDA1F0982F3606A48C035906DA2EE3BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665482447, "uuid": "0d4d3666-bf84-4afb-b2a3-aa1f68f76a45", "value": "768:l3dqDIvHMDKKAANnu4h+hgSgz4mxi1IdRdq56sfmAx:l3dHMDKW04h+hc85w+56sfb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665482447, "uuid": "b24f3043-ce7b-4487-a9e3-2876e6fe972f", "value": 39427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665482447, "uuid": "c707dea3-ebc1-4793-8045-52b20a130322", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665482447, "uuid": "c6664358-be30-4e3d-aacd-0a15323ebe61", "value": "invoice and supporting document.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63e548e-4965-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1665493725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665493725, "uuid": "3dfa8b5b-ce11-4181-98e9-e5254647bff0", "comment": "Malware payload (GuLoader)", "value": "eabb7e57445830599e27a48082c587ef", "object_relation": "md5", "Tag": [ { "name": "BoredFluff", "colour": "#F93A09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665493725, "uuid": "87a66390-db51-465f-99f0-a570e5d3908a", "comment": "Malware payload (GuLoader)", "value": "7e8b3427abc01508fd3e680139b34147c0ad975aa558cf29a0a77b24af86e9a6", "object_relation": "sha256", "Tag": [ { "name": "BoredFluff", "colour": "#F93A09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665493725, "uuid": "a729133b-3d0c-414a-b4d7-266c5ce63e12", "comment": "Malware payload (GuLoader)", "value": "f761aa122f7bb853334b23cbf1fde3c472924c64", "object_relation": "sha1", "Tag": [ { "name": "BoredFluff", "colour": "#F93A09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665493725, "uuid": "cc0d5e91-91de-4991-8080-9362879bc97a", "comment": "Malware payload (GuLoader)", "value": "6c01cf084c60b605ad3c6b068ce3a3efc416f6c9120c4e7553402827e206ffddf7cf81b3b72323b3fdd0f42ce4374732", "object_relation": "sha3-384", "Tag": [ { "name": "BoredFluff", "colour": "#F93A09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665493725, "uuid": "5ce62409-22f8-450c-968b-3e99666f2a4c", "value": "T17CD3F1A27E90C5F7C8610630963A6F2A5F67ED1921C45B8B8B643F5E7C731124B0EE72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665493725, "uuid": "1bd7b01e-9726-4f19-ac21-0b6c32b15d67", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665493725, "uuid": "7557b828-814b-410d-9379-127c1cd4c61d", "value": "3072:UYrClLswbDkrctAJMBdEb3SXdHrYUhU1HBqSSewOc9twpf/UstfSF:U7ewAT8LrChqt98fcNF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665493725, "uuid": "73c9a926-f0b9-4231-ac33-f7a7454a7f01", "value": 135152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665493725, "uuid": "8250b3c5-53f6-451c-b5fd-f9e451242f81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665493725, "uuid": "48f3381a-27a7-481c-84a0-a9195a8c5365", "value": "bored_again.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c09dad75-4907-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1665453316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665453316, "uuid": "864c521f-4533-479c-9714-2b00a451e028", "comment": "Malware payload (ArkeiStealer)", "value": "973567b5fe2edd9f6e0e8da3faf84ec6", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665453316, "uuid": "ebf1abda-ee0e-45bb-afb4-226e60e0283a", "comment": "Malware payload (ArkeiStealer)", "value": "80917ea4973991824e65f2f20ac1ecea5ff98a926f23234919079040f6c6af28", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665453316, "uuid": "eb171b2b-29ec-40d3-a357-aa2e191860da", "comment": "Malware payload (ArkeiStealer)", "value": "9fe580182827a16c21cb30e07d31b51262d3a8c9", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665453316, "uuid": "f3dcb2d7-8c53-4e12-8ca0-f61c2f115a14", "comment": "Malware payload (ArkeiStealer)", "value": "1b4d28d9689ddfce0898f90b4c3db52c0c774ce9ddf6630e296824971dc98069f62c73f23680694a39f36aea81e64543", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665453316, "uuid": "388bd2e6-fcf6-4b29-8d8b-528a099dcb06", "value": "T1C2647C20AB90C037F5B212F446669278B9297EA19B2C54CBD2D53EEE57386F0ED31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665453316, "uuid": "3b577f06-c891-422c-9a9c-54ad66494454", "value": "027f8148b5a9a5b0d04d7197ae184994", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665453316, "uuid": "d5ca965c-3312-413b-8c1b-49def1c12ce3", "value": "6144:WTfWIscFWDHymWlHGyuDdhbZ6MU9kERRRGCH7:WT+skS1lHGyuD7Z6MKkwP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665453316, "uuid": "9ad82eda-3edb-46d7-8e60-cd9f6d9e3390", "value": 324096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665453316, "uuid": "c96db0d2-4ddc-4214-9102-b105b9bcc3a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665453316, "uuid": "5543c790-20da-4bce-8a75-2ba1069471d8", "value": "80917EA4973991824E65F2F20AC1ECEA5FF98A926F232.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77dbc1ad-492e-11ed-9266-42010a9c0072", "comment": "Malware payload (Phobos)", "timestamp": 1665469944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469944, "uuid": "1894c3f6-92e0-4e54-8967-412d2f2f82d1", "comment": "Malware payload (Phobos)", "value": "7378712fa2b8cfa0b87ef80ca12e3ebd", "object_relation": "md5", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469944, "uuid": "2e506097-09cd-4727-a772-4d80ce4156f5", "comment": "Malware payload (Phobos)", "value": "81a5ac22ffef8e50131f663708e5f579e1d74c0464994a909cd3426be6887a4a", "object_relation": "sha256", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469944, "uuid": "5f842497-23c3-4566-869a-9edaa9df398a", "comment": "Malware payload (Phobos)", "value": "89371ab9c5f1882b2d6b97ceb8aca143a4276b07", "object_relation": "sha1", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469944, "uuid": "6e738e2f-527e-4e77-879f-ccad69350b80", "comment": "Malware payload (Phobos)", "value": "fb74775e83770d24cc90da67d90a2e49498ee138c1e3d36d840832ec54cfc7486085f7d63bcd7ef06c9ae45fc71b72df", "object_relation": "sha3-384", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469944, "uuid": "52840550-67f6-4c8b-ac11-75879118a56d", "value": "T15643B00674A980B2CEB58670253A6F5F4FFE6108407448974F394D9B3EE5137EB2A37A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469944, "uuid": "e258c395-3870-4af4-9b9d-6e5235a9718e", "value": "851a0ba8fbb71710075bdfe6dcef92eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469944, "uuid": "a43d10b0-3f0a-4215-9b06-4605b84389bb", "value": "1536:ZNeRBl5PT/rx1mzwRMSTdLpJypY95ybbkh94+:ZQRrmzwR5Jya5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665469944, "uuid": "17df114e-3e02-4e3b-8567-60a84172f62e", "value": 56832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665469944, "uuid": "eb308479-1ac3-41c0-b1b9-da27d5f0b8b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469944, "uuid": "2e1cb4c2-f3a8-4165-9060-16cc7179b9f1", "value": "81a5ac22ffef8e50131f663708e5f579e1d74c0464994a909cd3426be6887a4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f8f3b9-493d-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1665476437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476437, "uuid": "eb578e00-13ce-4847-8967-02e980a03cb3", "comment": "Malware payload (Smoke Loader)", "value": "762d276b402209a5ce78d9a9258f1bd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476437, "uuid": "8ffd5d64-90cf-4507-bece-c23a75b11953", "comment": "Malware payload (Smoke Loader)", "value": "82361af8f5303de90ff5757d8dbba87b8fc00fc0ea7b6fb922517c8078e71bdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476437, "uuid": "16c726d0-b7c7-4dca-afd7-014bc01bf01a", "comment": "Malware payload (Smoke Loader)", "value": "b09930f39b658639f06c83a6111be4c93ef712f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476437, "uuid": "650423e7-2047-4661-8d45-a76aabae949c", "comment": "Malware payload (Smoke Loader)", "value": "97741848c34466dcd65ed25ff9de861c221672f9b60251126c9b6f3cd61052b2bdde41bd446506a267257f4fbc3d233f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476437, "uuid": "154120c0-0a6d-45d7-b5df-98b300daa0ae", "value": "T1AC540A8173948457F8975A304E93C7AAD728FC82AA30765B2360F74F4A3BED26F64705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476437, "uuid": "8339dc91-888e-4ef8-86c7-61b324628a9e", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476437, "uuid": "90ce8446-0a81-4595-a61d-fa8642552082", "value": "1536:kI47GyTGCwiSnmQUt0LB1Qk7s5gMbwo1pv+uiR7UutEseagS:kvGyYiSDnt1Qx5so1Yv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665476437, "uuid": "9c53b593-32cc-4ece-9d53-c6ce492064d6", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665476437, "uuid": "fb54ce7f-67ff-417a-8221-c4f47d1cded8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476437, "uuid": "81317be1-f443-4607-9a03-68b1374083b8", "value": "762d276b402209a5ce78d9a9258f1bd3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e96804d-493c-11ed-9266-42010a9c0072", "comment": "Malware payload (NominatusStorm)", "timestamp": 1665475780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475780, "uuid": "915690d9-339c-481f-a757-f7e2e304fe64", "comment": "Malware payload (NominatusStorm)", "value": "4cdeaf639470d5a4b0293297eaa44476", "object_relation": "md5", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475780, "uuid": "ad72bf76-6dcf-4099-b7b7-870aba38cc79", "comment": "Malware payload (NominatusStorm)", "value": "82827e9b07fd5dd51e58060ff0976d0ffb7b9ca02e55eed2ecad26b866c87a93", "object_relation": "sha256", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475780, "uuid": "58b60126-5b89-4165-a4bc-1cdab4f3add8", "comment": "Malware payload (NominatusStorm)", "value": "82ceced19669b068a77b20657cdfa0246cf06044", "object_relation": "sha1", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475780, "uuid": "fbc8aafc-b21c-47cc-83b0-ded26d645171", "comment": "Malware payload (NominatusStorm)", "value": "10fd7af9406f8bbeacb7231d7ad95ace4515f5defe003c61b5485054a059414805af91fa1b64bad4299310d34a98f8da", "object_relation": "sha3-384", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475780, "uuid": "1e83e876-c002-4952-bd3a-c63bb1b25596", "value": "T12325837EE1E78E25F82DB8322C1563052380F9A5B73ED63E429E7499EB0DDD05A00E75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475780, "uuid": "96b4d46c-9cdf-4db7-8b8f-59cf54a71e5c", "value": "24576:aWWWWWWWWWWWWWWWWWWWWWLQ+ZoO+o+BPrKjE8f6TaIs:ZQ+Zoxo+BKjE8fWaIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665475780, "uuid": "4b9d2634-2894-43cf-b5e6-a3acaaddd2b0", "value": 1014145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665475780, "uuid": "bdb47277-f655-4cc2-8f71-36023a9826f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475780, "uuid": "a5297b42-8277-41b5-8416-61b47feeca30", "value": "82827e9b07fd5dd51e58060ff0976d0ffb7b9ca02e55eed2ecad26b866c87a93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26294b55-4991-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665512327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665512327, "uuid": "fb555a9f-cf74-40e3-9c24-c59b3f095a52", "comment": "Malware payload (SnakeKeylogger)", "value": "7e760e5843c87da09e42d782ec8917f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665512327, "uuid": "67303131-dde5-4352-90d3-f0083f2e2ff1", "comment": "Malware payload (SnakeKeylogger)", "value": "82fc274736d5f4e6fefd8a01f3b2557b242918db92d8f3a479ab087b3fdfc66f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665512327, "uuid": "21779bca-ca8b-4109-b23a-e6ac6530d09d", "comment": "Malware payload (SnakeKeylogger)", "value": "ee963befdf3116b78126d03db5dc49307da29ce8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665512327, "uuid": "5a0d9fc3-a3c9-4e34-94d4-1b49b59d7774", "comment": "Malware payload (SnakeKeylogger)", "value": "d8596019f0524f7bb2853311fbb5b0b982d27502e47a2a279630b845ff4058391b7c322eb957e08f35da0f6c8813d45d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665512327, "uuid": "e8169c2e-097f-4643-be33-bc643ffb38f9", "value": "T165056A7A21D54607E8197275C893E2F32AFBAD206061D2CB1AD77F6FBC401BF9612346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665512327, "uuid": "b5280205-368d-4435-8ed0-f00b77e58afe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665512327, "uuid": "808cca40-0ed1-4b43-b4d5-e4bb4a2a7802", "value": "12288:/7K8uqWOu5wQKlg4qDQYHam937YrX4QL1myZ576yzeFYZr:/sf5wFa4WQY6m9UfU055e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665512327, "uuid": "1a49b107-ecd8-49c4-8422-3b4e3d945bfa", "value": 856064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665512327, "uuid": "4e4717b1-c3ca-450b-a105-c77b6343af4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665512327, "uuid": "89baef18-9118-4e71-894d-9f88edbbaf8e", "value": "Shipment Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffdd0419-492f-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1665470602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470602, "uuid": "5a21ed93-345b-48a5-a09a-389d212dc6c3", "comment": "Malware payload (GuLoader)", "value": "34b8204c12c6ef849f36707e1c822683", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470602, "uuid": "860a5b1d-cd36-428a-8c74-9de45e2eb982", "comment": "Malware payload (GuLoader)", "value": "83d19178c1e302605e02a9d7d2d371ad03d7585337b221bda7b14786490ec104", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470602, "uuid": "fccc3bf9-b10f-40ed-afcf-07060892596f", "comment": "Malware payload (GuLoader)", "value": "292fd09dd061fa8303150ebf367b35397f9451db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470602, "uuid": "1d6a854e-2fd8-455c-91f4-01477844917c", "comment": "Malware payload (GuLoader)", "value": "2e820a6f60ca69eb42f8f6f63114ecd1978117f987ef79ba76ee01fa84856157b72dd7040371bfd86289dc792f1af30c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470602, "uuid": "1886e47a-55b8-430a-b759-b79150d1816c", "value": "T15FE30215B230C4B7D17A43B00C76A76AEFEBD15921952687AF501F8A3E637C1872E24E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470602, "uuid": "407ba4e2-d53e-4f63-bd88-4ae98c71498f", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470602, "uuid": "acc0d3d7-8cd2-41ea-8942-6a50994c00ce", "value": "3072:mkBGWOsTIJgIDU5A/cmubBG5dMlJSfgM1DPj5hREByX8klH7aVSe3QcL+U9Bw/GM:m1ssjQAdMbBM1DVhR0yX8kR7M3QcL+Uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665470602, "uuid": "867eaaf0-cfc7-404b-b0c9-f632f1357441", "value": 144056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665470602, "uuid": "d5a879c3-9881-4da4-993e-26e246500998", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470602, "uuid": "785337c8-3b31-49af-adab-cb1181760bbd", "value": "doc0095100920221110.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac751c28-4936-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1665473468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473468, "uuid": "b3f59404-6499-4f7c-8283-f9837ebd6f9e", "comment": "Malware payload (Smoke Loader)", "value": "1d950359e37ee92b4a48bf34fc7b2791", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473468, "uuid": "5e9ac13f-6ee0-4ffb-bb59-e95e82003c9f", "comment": "Malware payload (Smoke Loader)", "value": "83d305db39a0295764fc0709ce411bacaf90259dd176443025379b000c5fc81e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473468, "uuid": "d3fc47d5-b370-4de6-94a4-2e6b711619e2", "comment": "Malware payload (Smoke Loader)", "value": "ed3d6cd088506efee4433d8066c7843a2bf1a76c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473468, "uuid": "5b395021-a59f-4428-b51d-87b8f612a5f0", "comment": "Malware payload (Smoke Loader)", "value": "a74cfb90db0ef0f4a7298f0d493987e1a51cb8fbc157d86d09cf54aa83ba4bb764fb71be1a69db65422ef354059841d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473468, "uuid": "0bcc359a-9809-4256-ae60-f423e3e24b42", "value": "T15424CF2136D0C472E2625A798C68D6B46BBBBC312975568B7BD4072C4F353F39E21387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473468, "uuid": "9aae6ceb-f8a7-4989-9e18-1bd0026dbb56", "value": "f07757163332cdbf737bafdb4614222c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473468, "uuid": "ccb1f391-91a7-4202-b453-39ecc37a8d61", "value": "3072:aWu8OSHj4ADLStTMjmRFbT3sdgrfK0Cw3WIzTQTi8ZAFjuTChpaX2XO:aruswLStQjc7Mgr6ddAITop9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665473468, "uuid": "799825db-feb3-47cc-9d3b-28865ff2127e", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665473468, "uuid": "a4bc67b2-cc15-45aa-bf91-eb7e0642aaca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473468, "uuid": "e42711fa-f612-4c57-83e3-174fca538c2f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "903f50a0-4966-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1665494037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665494037, "uuid": "952f7a3e-443f-414c-a6ed-b2b81218e47a", "comment": "Malware payload (AgentTesla)", "value": "13621d7a90ee1aab6a089c410cab89cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665494037, "uuid": "830994e3-22df-4dde-b52c-28ca034c35bf", "comment": "Malware payload (AgentTesla)", "value": "8404cd018dfe143307ba3eb7da568b7e7738a8c1beff142abd2323ff23cff09b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665494037, "uuid": "857c0b9e-e544-480b-94f7-9b4df3b54777", "comment": "Malware payload (AgentTesla)", "value": "d97903d4af4cfa7d74624bbf0bcca0272103af48", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665494037, "uuid": "0f69f4bf-b8b4-4593-b487-f3d6f5cd90b5", "comment": "Malware payload (AgentTesla)", "value": "120623fdb59d3b3e0702259c132919befac56626500b124af1eda21f28f2243362143bda4a6af739204410de7dd63a37", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665494037, "uuid": "e9bcb08d-a02f-4589-a1ab-03a3ace6e792", "value": "T1BA356B7E26964907D8193135C487D1F32AFBAE506162D2CB6AD72F1FFC412BF950238A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665494037, "uuid": "5cd71233-f0ea-4b92-97bc-cc713bf0d7fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665494037, "uuid": "df60088d-164f-425f-8b8c-8b0782e9a28b", "value": "24576:bp7VDO2lQQjlfSxrvCUYbiNtYzAtQy4A:lVQQebCjbiNtY2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665494037, "uuid": "971c2c7d-5c3b-4c26-b81f-0d2a12ec13ec", "value": 1100288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665494037, "uuid": "c79fdbfe-604d-4dad-b147-ac449e212312", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665494037, "uuid": "10f46448-c516-44ed-a77a-1941f1327780", "value": "Request Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8753d399-4916-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1665459662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459662, "uuid": "bb278cd7-06c4-49be-94f5-a50cdced5ee8", "comment": "Malware payload (Formbook)", "value": "aa88d810ec2c9acbd204e4eb7916c3b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459662, "uuid": "b66ab2d6-f124-4e35-bcb1-3bf7bf6f781c", "comment": "Malware payload (Formbook)", "value": "8495fabded88dfe472377e57138c0cc02818633148db0eb10339d490899d19ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459662, "uuid": "9d0e9ce0-ccaa-458d-b681-d02bf8643042", "comment": "Malware payload (Formbook)", "value": "a1db2b39e91c49fdb5a7cf609cd96a3e2f43d399", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459662, "uuid": "111c97f1-c844-4685-b48c-e0b044e46c3a", "comment": "Malware payload (Formbook)", "value": "fb598aa775340de15a44307674af1a9e9e718a18a88ac250a7da638dab0e430bc465ccdb8546d066cfda6e3e9dacf9d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459662, "uuid": "d2491c40-553c-4ae3-9bdc-d3457a72a549", "value": "T162738E46C7D10423D96A8E73B0D396C71BB0B20D5DD14AA794CDB01A0E8F38A799BBDD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459662, "uuid": "a23e52a7-26f3-46a5-80c3-2f3e065e7a39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459662, "uuid": "9a14a7e3-9618-45b4-a7b0-587f30fc3bb3", "value": "1536:cgNS8UV49vIH4pga/eHUTQQQQQQQBdBgN6b5/2kWSC6WLrxtDvas:lS86OIYpga/eHUTQQQQQQkdBft/2YWL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665459662, "uuid": "41b170be-571d-4fee-8f8a-b025cd0f34da", "value": 74592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665459662, "uuid": "e7eb2f4f-2229-459c-a089-0e68c307b179", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459662, "uuid": "02ab3ea5-e1fd-4321-90a9-b54ef9312ff3", "value": "SecuriteInfo.com.Trojan.DownloaderNET.346.2603.24761", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0d6efd-49bc-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665531101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665531101, "uuid": "0a3aec6e-94f4-4eb3-87ec-111fe13cf15f", "comment": "Malware payload", "value": "6f727c1e50b14ebc54cccfa2224b6993", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665531101, "uuid": "96886889-25fe-4883-960b-5ffda3fbbe1a", "comment": "Malware payload", "value": "84a91534959263c4e5fa3f107cc97de758b2a8cfd8067a59c1d97039a06c9f0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665531101, "uuid": "17373428-0eef-41eb-a5d4-b0eee1bf6264", "comment": "Malware payload", "value": "fa6607ad2061f3c166f34683805bf932a5f5c5f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665531101, "uuid": "f1aef0ba-82be-4d31-8446-49383fae682e", "comment": "Malware payload", "value": "a275a9b3b87944b795d3f30b837bcd2cd8ac43a148f77d79fa8ddcf7d0d5b68781258b9ddf2fa6a50c2b5ac848b6d1f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665531101, "uuid": "303612a4-7fd3-4979-87e9-2009f245409e", "value": "T13854D020B682C8B2C00521748819DFE06BBEED354875895F3B59AB7D6E733805A7B35F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665531101, "uuid": "b2418b0b-b4f7-4a88-a397-8ccd873f5b3a", "value": "f86972b0b9fc89569bd497bebfd6a497", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665531101, "uuid": "dc94f934-1e5b-4dde-a4c4-73e774176bb3", "value": "6144:Xc7qtWbirmiRIGUH6OO9F3hbrwVfquS/:MPbniRIGp9FRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665531101, "uuid": "0c7edbc8-8980-473c-824b-ba947ab15e66", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665531101, "uuid": "12374922-baad-494f-ad60-070a7cda1da8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665531101, "uuid": "20a3fdb1-7542-4783-be4d-a845f16280b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf31935-499b-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665516984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665516984, "uuid": "48398855-7aa6-4543-bc33-37607581a63c", "comment": "Malware payload", "value": "7acfd520a11ff066c5554189d52d080a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665516984, "uuid": "b116e27d-f026-44d7-a3b9-1dbb2aa16bb8", "comment": "Malware payload", "value": "85fcfca51a30525feefa12252866ed9d72a7f778515f39b3539f487e8b70c2bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665516984, "uuid": "daebbcc0-00ff-4aa3-8f53-b01116a707c4", "comment": "Malware payload", "value": "9cd22f607d1eaf8dbf01cee50f6ceb07f4251c2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665516984, "uuid": "2fa0874d-7dab-4625-a497-0b7eb33bf9f9", "comment": "Malware payload", "value": "1a3532d50179f7b513390d3cb5542cfb7a8726615280a9795162ffedc97fe43a793fdfb874325d3f59e4ba2fdabae214", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665516984, "uuid": "9da7798c-c603-42f9-8bb3-11b59e8a49f8", "value": "T19753C3F5E81D44C2F338C0BBAF827369B2B4F33ED2556C88F15A692D18D22355684B6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665516984, "uuid": "00aa7036-2673-4b10-ba96-588680c89693", "value": "082f8c5beaac2dc92f43b820de36dfb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665516984, "uuid": "abef03df-84d5-4d14-b0b7-d61e6456642f", "value": "1536:N2nMecKnHiJRwV9MrHfFyacQ8joiVomNsVM0gV:N2nMeJnkzrfF5CjVZsVM02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665516984, "uuid": "0c64501b-27cc-4af0-aac2-ddd82ea76f1e", "value": 66560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665516984, "uuid": "531ec7f5-0fa6-4ba7-add4-a6564f7083c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665516984, "uuid": "b8e038d8-b1a9-4c94-a009-6325c1a68b8b", "value": "AIRLINE.DAT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da6a5f45-496f-11ed-9266-42010a9c0072", "comment": "Malware payload (Stop)", "timestamp": 1665498027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498027, "uuid": "4a6734bb-4b70-43a6-af7b-24bc96ad7f56", "comment": "Malware payload (Stop)", "value": "89259c54c606cd981a4009df679b4f7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498027, "uuid": "f32bffae-e181-4bac-8418-0680220ea19f", "comment": "Malware payload (Stop)", "value": "86991719c854f9ee191c5212aa100155dc8a34df4ba6812e082368f5d64d07b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498027, "uuid": "d5d8a9d4-d99f-404d-a1ba-21a8e536bcae", "comment": "Malware payload (Stop)", "value": "8214aec5f70da8e9a6e0790ff1589f09ccbc4f13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498027, "uuid": "b6a079a7-712d-49b6-9650-64bc063d4969", "comment": "Malware payload (Stop)", "value": "2e1069206804cef74d7d698020e1e92f55fb25bc836a3a8350a5a4213497b2d5064685e1c0f1dc0fe757949b009ea9fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498027, "uuid": "f5f7af37-f70e-493e-a10d-5118ab3ca745", "value": "T1A2F4122134C0C872E1B30535CE24C6B5AFBFB8755979638B3B9456AD4F32AE39E24346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498027, "uuid": "22a90dcc-2fb0-4bbb-a5a5-8ad654e7dcf4", "value": "4db5fa00d6d53e828ab0bf90238303f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498027, "uuid": "8649ca67-553c-4517-9f65-e4a776c4414e", "value": "12288:DB4v06RgABssb+rVB2MLJgdjvo0Io9O7yPpOVu1eh4wNhmc1C+uzO3tG9F6/0:DaBvBr65XlJxog2PwVu1eh4wu0CnzB9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665498027, "uuid": "b0112844-ca5f-440a-8d1b-f9d71cd00ebb", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665498027, "uuid": "bc0a3774-8096-4653-bf38-5d3119da1d4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498027, "uuid": "5bf16501-2750-4bb0-8c39-7fca1ed5f7d0", "value": "89259c54c606cd981a4009df679b4f7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0c8a6c-4918-11ed-9266-42010a9c0072", "comment": "Malware payload (BlackCat)", "timestamp": 1665460611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460611, "uuid": "346cd308-e73d-419b-a03a-b70a94ebd816", "comment": "Malware payload (BlackCat)", "value": "9ca7bea6e8a1af2dd7e60f78364dad90", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460611, "uuid": "7fda6641-2ac3-463f-9ee0-1e5774cf24b0", "comment": "Malware payload (BlackCat)", "value": "86ccc74375405ef5a86bb26071ec345d3d800438d1e0caa4a6d0cb43bd8562df", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460611, "uuid": "6bace930-1bca-4f1f-96ae-1368ecc9972a", "comment": "Malware payload (BlackCat)", "value": "9e293b3957af96e385ce15e256879c6b02c51901", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460611, "uuid": "7df55960-8bc6-4092-99ff-fc989fefa204", "comment": "Malware payload (BlackCat)", "value": "79e9b08f40fe9f97666d316b2226840ac9b71d96f48a29d50b22ab98c9dcd1b70048225a3136557751562e6ada209d57", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460611, "uuid": "aa4aa3b7-8b61-4e58-9617-d28b53b63193", "value": "T10FE5AE16FAA356EACDE71570385EB33AD7304A28001D8EA3D7D49E6CBD7E7201D8861D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460611, "uuid": "f5cbd339-fb87-4822-b539-fe3265cfe7b5", "value": "b9247c9e8d968989696a85c3451cc615", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460611, "uuid": "af90a4a5-05c9-4025-b20e-291e5564bbbc", "value": "49152:skKSYoAZCTE3TUzwkATt0uFZmcg9Bsle+iE7YCANkHZ/ebWQsqmq7c+:sk5YoAZCgDG8T9pYBsVMA/yWQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665460611, "uuid": "533869ea-21cd-4d80-8614-f44ce46b650a", "value": 3149824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665460611, "uuid": "016ccb92-0e0d-41b2-97a4-7de999f3eba6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460611, "uuid": "bed2b291-0312-432d-9487-a82ef6c6ad14", "value": "86ccc74375405ef5a86bb26071ec345d3d800438d1e0caa4a6d0cb43bd8562df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6180b3b1-4961-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665491811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491811, "uuid": "7064921f-0715-4329-b3ff-f95b79006a2d", "comment": "Malware payload", "value": "aff3c15aa27dab3a7c75c8248ea9312a", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491811, "uuid": "b6f88e12-c267-43bb-9d71-169ff2cf9a6d", "comment": "Malware payload", "value": "8841ba3ed786859bec6ad31a96b7f3cc99c6056c9c750618beb3710528f8c873", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491811, "uuid": "a1ff03e2-d83d-4c87-9dba-dab0f0c2c446", "comment": "Malware payload", "value": "58563eee4c808cdcf55183eb4c91ada778b8f22b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491811, "uuid": "c995495f-42b3-478f-a574-983308c0d46e", "comment": "Malware payload", "value": "2d86f91bb1d4e51569b359a776a8765bc0b1f0c14d0f1607908c7f4dbf2567c8c297e38ba50519bf1e1eafee1dc4f619", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491811, "uuid": "3020de5d-4019-4611-8b12-7c43e7e0994a", "value": "T15A876B9573ACEE21CC765932850C6636975A2E34AE82D3D71808378D7CF3DF48A19BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491811, "uuid": "de9c4724-cfc3-4ebc-afdb-dd7a49ed0500", "value": "196608:XiZExLEJp/LEb1v0d/6ZExLn8L5F6qjgkrkK31vHvy:XFxYJ1LEYtxq5FPjrvHvy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665491811, "uuid": "a2b2d860-e100-42b6-a481-5b4231b18d08", "value": 39336969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665491811, "uuid": "754a2cf9-41a0-48b3-89f6-6c164e9511f2", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491811, "uuid": "ce9ece98-b5c9-4508-92af-561873ec386d", "value": "System_Android_framework-res.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cba15dc-496e-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1665497494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665497494, "uuid": "38755843-6be9-4944-ab7e-fe2432ffb310", "comment": "Malware payload (GuLoader)", "value": "68d6e43ad003e769f8107a98b109eb4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665497494, "uuid": "e5ea0e13-9e8a-4ebf-b089-91b1abc1ae11", "comment": "Malware payload (GuLoader)", "value": "889a4438087185a1fde0f03e7cd63429784cb000b31ec1121155528eb8213892", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665497494, "uuid": "d1b568d2-3a81-4466-bcd2-4d26c251c046", "comment": "Malware payload (GuLoader)", "value": "15901b9eb1e65627e55c3265fc80930126736f02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665497494, "uuid": "8cd19b6f-44a0-4ecf-9978-f6ad2c30955d", "comment": "Malware payload (GuLoader)", "value": "122e83dfcb174f6f030d7987019a80ac374f69accb2ba632625f9b91819b4fd8c6532a2cf63dc450e546e1986e23f647", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665497494, "uuid": "80a7e786-5210-402b-9713-07f9ed900cd5", "value": "T1A3A3F10A67D0DCBBF9F207B1067AFB7BF379A6811650520B9F148E733E006935A661D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665497494, "uuid": "0135ece5-902b-4d7d-8bab-765da979c201", "value": "b40f29cd171eb54c01b1dd2683c9c26b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665497494, "uuid": "37b6ed46-be58-4948-b84f-7c46b152f05f", "value": "3072:bsBD6HJfcDDXJ8vzUUu+WgRFx4KHjfw1H7Q+yoAxh:bPpKCgU7ZhfIm+yo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665497494, "uuid": "23d4106d-1e3a-4278-b60a-85abf8889339", "value": 107248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665497494, "uuid": "95144b8d-ce34-4136-8c77-6b6f7f351dea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665497494, "uuid": "d1726f12-0d8e-45a5-b759-b1d43f77ad36", "value": "new order- PO098432.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b6cdf3-4983-11ed-9266-42010a9c0072", "comment": "Malware payload (njrat)", "timestamp": 1665506471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665506471, "uuid": "7a4b7a23-1303-49dc-9eaa-fb3c96958125", "comment": "Malware payload (njrat)", "value": "021710a99ae4be346f2cd0b2f8d6b4eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665506471, "uuid": "7acece87-e7c6-4063-8b11-c2bfd6215548", "comment": "Malware payload (njrat)", "value": "89abd7081183319056f21b720285ff5bcf1d4c29c239a01f994c2aad77b8e1a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665506471, "uuid": "bcf7fce4-0fbe-442c-a02e-4e60907da31f", "comment": "Malware payload (njrat)", "value": "08805af81cf7ab6378194ea7ffd2f5f73c7cca1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665506471, "uuid": "6d8445d2-00b5-4471-bc1e-d3b9516bc12f", "comment": "Malware payload (njrat)", "value": "5cca6633980e95b958b5a3d015555f5f9672d63196e94b9bf21c305de8b95e763fb9bf3a4bc4648e831c98e92a8c55ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665506471, "uuid": "c52d6c84-3c86-4546-81fa-79be8fc3931f", "value": "T18F033A4D7FE18568C4FD067B06B2D41207BBE00B6E23DD0E9EE564AA37636C18B50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665506471, "uuid": "d31ad314-96c4-449e-a401-2ff888be44d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665506471, "uuid": "3b8c4750-d9b5-425a-ab46-fbc2541a074f", "value": "384:O7IvVSikmj0NVtv/Vey0bkmflcs+SvkrAF+rMRTyN/0L+EcoinblneHQM3epzX4d:C4nO1VV0bkmmVS8rM+rMRa8NuOft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665506471, "uuid": "5a122102-499a-4fcb-8ebd-02c071615c85", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665506471, "uuid": "76210d0e-61fa-40cd-9301-46177568631a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665506471, "uuid": "adaedd1c-f24e-43f1-b1e0-5b1e5bc2bbd5", "value": "free_donate_mod.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b1737e-4971-11ed-9266-42010a9c0072", "comment": "Malware payload (Quakbot)", "timestamp": 1665498656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498656, "uuid": "b3ceaeae-04de-4bf5-a926-b489934c65bb", "comment": "Malware payload (Quakbot)", "value": "159d64248945493b8505bdf3b188d12a", "object_relation": "md5", "Tag": [ { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498656, "uuid": "bdd07731-4784-473c-8dfa-0f217c979848", "comment": "Malware payload (Quakbot)", "value": "89c9b6a2fe32eab840d88b13ab5e11961a949c3a01261f10fb9e0a28fd67dfbe", "object_relation": "sha256", "Tag": [ { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498656, "uuid": "0195007d-7458-472e-b3d5-2589f155235b", "comment": "Malware payload (Quakbot)", "value": "41f78b36df9b030398e97021b065023cfc5b0b07", "object_relation": "sha1", "Tag": [ { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498656, "uuid": "045e768f-7b2d-407a-9902-02dfae13816d", "comment": "Malware payload (Quakbot)", "value": "580f3e17435faa79c4d200e68edff55ce68de525456c4b56dcb8ca9c630657a6848d7ca365a5cd9a0d4044924ab72ddc", "object_relation": "sha3-384", "Tag": [ { "name": "BB", "colour": "#2AAAD7", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498656, "uuid": "2abb6e18-8796-483b-aa5a-450681370b46", "value": "T17F359E33A3800373C16706347E7F67D5A729B8343B34D51629E9890D2B26CB16B7B6E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498656, "uuid": "f1aee4a8-1c7e-4204-a676-352141c5bbb1", "value": "24576:01DXjmtjVD3cygICZwSJo6q6qZXJM5T//9QTdWTFXEzBUXU2:uDjMBsmbh5MUBUFXEzB+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665498656, "uuid": "05b8d95a-98fb-4fd8-b53a-ace677213367", "value": 1150976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665498656, "uuid": "91ce3ba8-6fb3-4064-86f2-20d1c4643ee6", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498656, "uuid": "abda9d48-1fbb-4280-a657-ff8a8f91b73a", "value": "LP#1158.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd7340b-4929-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1665467912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665467912, "uuid": "03590a59-56b1-4de0-982b-3949599235b0", "comment": "Malware payload (RemcosRAT)", "value": "b45f67ab79b0599f4bcf550c7ca525e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665467912, "uuid": "cf8fac40-9e10-4ebe-a056-58f36d067c5a", "comment": "Malware payload (RemcosRAT)", "value": "8c2653e4d9998668579383d87f291afe6ba5740ec3bc6d8f44618c0f9af77189", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665467912, "uuid": "5d5b033d-7560-489b-87a8-42c04884be54", "comment": "Malware payload (RemcosRAT)", "value": "694f29ce817edce396bc0fcb48f0168fd8321f12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665467912, "uuid": "4ef4a5ab-2a52-4d1a-8185-c465aeebcebb", "comment": "Malware payload (RemcosRAT)", "value": "a68f97d90782d4e2d016461ecd571274d6ea70c0738940e5099647427df50490021c8fb485974f7dd534cea6646b8fb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665467912, "uuid": "7d075060-b6a0-4dca-bf37-fe66d8c46652", "value": "T171B423A4C0A5C127E9E703732E7F15B64EE74B1212AC4B4B1370BD0979B64E64B06F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665467912, "uuid": "bb32a6a8-ee9c-4a5b-bd1b-e618156e142a", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665467912, "uuid": "eb4443d9-495e-478b-9b9c-7acba55b7902", "value": "12288:lNZz5C5hrGs69BVRbePbRH3OKy39L1NOtUlK+bY5QlMWjpyI2:lNZzojSTHzItUPbwkrjpj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665467912, "uuid": "bc7f0e56-0824-45a8-bacf-a5fc8bbb0a8b", "value": 520281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665467912, "uuid": "66af62fb-39cb-4ea4-8f78-de66704f6262", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665467912, "uuid": "0b914ad7-0d5f-4f3b-8847-98de488242c9", "value": "RFQ ENGENTECH 11-10-2022113015.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f92e13b-490b-11ed-9266-42010a9c0072", "comment": "Malware payload (DCRat)", "timestamp": 1665454844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665454844, "uuid": "8db70c40-d0bc-4651-86ff-b8c1d19b38db", "comment": "Malware payload (DCRat)", "value": "a07762926413974d6a5e39c3a5a467cf", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665454844, "uuid": "3997bd2e-b3d8-4e50-8f4d-672407df6571", "comment": "Malware payload (DCRat)", "value": "8c7e227bdb4c0b55dfd41b29614bd1b852132c65ec90a564ebf67230d421abc8", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665454844, "uuid": "bfd99a3a-f04d-47dd-9097-b44d411e0587", "comment": "Malware payload (DCRat)", "value": "990342a8b43de620c0a6baee95994e3b873d385b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665454844, "uuid": "1f9e974e-0665-4dbe-8c6d-062c9b4f87d9", "comment": "Malware payload (DCRat)", "value": "ac6f4e7b4dcc031faeb77e6de4a167a30ca8b3965073a811b921c8ae60ee9e229d5c8588e9bebd99beb388dd43c845d9", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665454844, "uuid": "449971d5-7430-4635-9080-9b81fc9bbe6a", "value": "T176F53379C19E9BABD532BEFC15FDC590B89947E41B7AAD9A9CB060408F10CE764C43C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665454844, "uuid": "9abb7200-5a3c-4cb2-b6ca-3d08907961dd", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665454844, "uuid": "f9bd13d2-3007-4b00-9def-c14df87fc87f", "value": "98304:NTXOzoDogs+olWgAS/mPl1GdNtLnWbmJ3x3CAzEyU4eC:NT92rp/mPn6tybm2q2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665454844, "uuid": "c0767b6d-148b-4723-9925-b07d65e35c8b", "value": 3355776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665454844, "uuid": "1a399cee-f343-4646-ab2e-432c0833fa29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665454844, "uuid": "c1b75370-b789-4dda-a117-718a031c08f2", "value": "a07762926413974d6a5e39c3a5a467cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5778a7c-495f-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1665491066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491066, "uuid": "90cc9416-43b6-4174-aaef-d667abdd88cf", "comment": "Malware payload (GuLoader)", "value": "2bf982f48f69b9a243f8d215fbfa49be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491066, "uuid": "a75f72c3-2403-4c47-848a-fa4c200f3319", "comment": "Malware payload (GuLoader)", "value": "8d4b6402a6c425fd43bcafdcdf6e08033daef3980e25fe7edf457d030736f602", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491066, "uuid": "fc73ecd2-bdc7-466b-ba7b-3b50a6a13216", "comment": "Malware payload (GuLoader)", "value": "2eadefbd3e29b17b937ff73b2d6a9f63cccd6c61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491066, "uuid": "02054ed5-e347-41a7-96e3-a14af62c2327", "comment": "Malware payload (GuLoader)", "value": "aae2f18688c54a710e261f24517c3d59b2467b9513e6363844a35272687cf36c5e40865b7da3038a98ed228ea0316c16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491066, "uuid": "26f2cb23-fc6f-4d00-a593-8f35123828bc", "value": "T124052385FB50F7E6DC5C16B0160F369DEBAC8E5B10A2578787C52F0F2C055A1D22B39A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491066, "uuid": "e0a0b1ba-5e13-4354-984e-211bba045006", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491066, "uuid": "af3ec739-fe19-4c5a-9a8f-c1b730ab3f11", "value": "24576:QUwoZKXxRwmhaxUUlmLf2G0sdAPQjjNcMG96:ZZAxRfUQQGmEjGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665491066, "uuid": "cc5b5519-ff90-4c6b-9cf1-1c8bf4c237a9", "value": 838204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665491066, "uuid": "0828f20e-c93a-4a8d-9a69-73f908a555e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491066, "uuid": "121de8cc-60ca-44d6-979c-eecb6ab5c4e4", "value": "SecuriteInfo.com.NSIS.InjectorX-gen.12248.18354", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a0e17c-4915-11ed-9266-42010a9c0072", "comment": "Malware payload (DCRat)", "timestamp": 1665459339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459339, "uuid": "12f1b9db-b1dd-4b1d-abb9-cbc4913407bd", "comment": "Malware payload (DCRat)", "value": "a43c4d118518a0444d8c3d3992b07a51", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459339, "uuid": "f363e34a-9ef9-45fa-ae2d-488a4737786b", "comment": "Malware payload (DCRat)", "value": "8e3cd32e04ddb267e89e62ae49648224db6a29e9e1df3f63da898b08c3cb639b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459339, "uuid": "e6bb7dd4-74db-4810-b562-d120271643ff", "comment": "Malware payload (DCRat)", "value": "9c8ba3fad5ca493891e803098ee1460fabf637b8", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459339, "uuid": "6f2b2824-e42b-44f9-9070-46b90fb922ae", "comment": "Malware payload (DCRat)", "value": "426667337de80592ea6b754d6ad0c8739dfa40d937cf2cef757eb54b3276f611248d3e2c70b62bd558707b427e9b7918", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459339, "uuid": "9df35a58-b5a2-4bd8-8b26-43a5807343f1", "value": "T14B66332311A020C6E2F5C83D5637BEE472F703AECA04D878A9F7DAC11A669D6D513E47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459339, "uuid": "911e5628-8de1-45b1-8f57-931bc4cfd706", "value": "c628ea34d4c8d513317049fd9025fadf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459339, "uuid": "11afdd61-0d6a-4b18-9f00-047df5ab2356", "value": "196608:SK5O5xCHk9s7KFEnO/Uo2QRgLFPdjyImzpFWE:T5OHzuMEnwYFPdPmzpcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665459339, "uuid": "fb8b3814-1f37-4f0b-ba0c-1d3c4e1d63cb", "value": 6489600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665459339, "uuid": "aa421b90-edcd-41ef-bee5-9fe06b9befc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459339, "uuid": "4903bee1-2c7a-4b88-935d-652ed4d25773", "value": "a43c4d118518a0444d8c3d3992b07a51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0fbce7c-495a-11ed-9266-42010a9c0072", "comment": "Malware payload (NominatusStorm)", "timestamp": 1665488911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665488911, "uuid": "7f1eb046-2b59-4569-90c6-90bfe7d7f757", "comment": "Malware payload (NominatusStorm)", "value": "0a4a0c1fa4c369ee559b56b0b14730f9", "object_relation": "md5", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665488911, "uuid": "6eb99636-7f32-459f-9d1a-301f5051be42", "comment": "Malware payload (NominatusStorm)", "value": "8e730e174796ecd19d12c42953f2f8e62d526e4aa3eba3a559ee5da8cf9702bc", "object_relation": "sha256", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665488911, "uuid": "f1e5fd3f-2c30-4c5d-8441-1958231a31a9", "comment": "Malware payload (NominatusStorm)", "value": "0d1527a2481b6703119db306f70611d0784a95a5", "object_relation": "sha1", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665488911, "uuid": "78015253-23cc-4a78-a5cd-63719e2d85b9", "comment": "Malware payload (NominatusStorm)", "value": "9a7aa7f418b9ad75e91fa8287bc6aa9607f7b3e4b8345712518aae1bae96c736f6e1ecfd893e21ed221d2f1e3910e7de", "object_relation": "sha3-384", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665488911, "uuid": "1cf5a57f-6f5f-45c6-bdf4-64321ef924b1", "value": "T1328628BBC26BCD29F47D18312014160A3720F6A5B9ABD79E334FB55DAC2EC4879513B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665488911, "uuid": "b182b3eb-de8b-4eed-96f5-32fb715c1aa3", "value": "196608:pf7ZEJhYzD3BiExsDuGAvuiYV351yIsJHf7ZHk3N1gz:pf7ZEJezD3BiExsDuGAvuiYV351yIsJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665488911, "uuid": "1232292e-1107-47db-8136-cb6584c9b6f9", "value": 7840687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665488911, "uuid": "6b3d0e6f-0caa-4d62-a230-6ed8ae42c9fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665488911, "uuid": "973aa009-c3fa-4724-a783-e3182f9968ec", "value": "8e730e174796ecd19d12c42953f2f8e62d526e4aa3eba3a559ee5da8cf9702bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5865428b-4935-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1665472898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472898, "uuid": "44748f9b-2ff2-4ebd-992f-fcfa3877a6e3", "comment": "Malware payload (Smoke Loader)", "value": "882708b1fac0254108c38b27b8a3b24f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472898, "uuid": "ecc9eb80-b47a-4393-b962-da66070c6c6f", "comment": "Malware payload (Smoke Loader)", "value": "8f0166741c86696be663ce0cc82579d608915b792603ea12f6a1b69116882792", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472898, "uuid": "3f56f9a8-9aa9-41e2-a576-1f0f94f77f7b", "comment": "Malware payload (Smoke Loader)", "value": "d3d6b3d77142a3b5538d0c9056d66b8ff36dad04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472898, "uuid": "bb722bbb-803b-45b1-88a0-8aebeec10a12", "comment": "Malware payload (Smoke Loader)", "value": "07c5dadca7addc4dfa41fbfd0c5261386693758d33ef9b473cfc022243776f62d66c1defeec00cafa21d58f4d42ca004", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472898, "uuid": "06b4ba31-6ec9-4cbe-940b-bb75e7782e96", "value": "T14224CF2132C0C472E66651788C65D6B06FBBBC315A76978F7BC8066D4F363E2AE35342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472898, "uuid": "a06081f7-9f35-483b-868d-5ac252e4be52", "value": "f07757163332cdbf737bafdb4614222c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472898, "uuid": "8de35805-eb21-444f-a559-7fc078621bc2", "value": "3072:6yPOjHjmSjxLuGAnRFlpDCJnMxLckX4RWhBdcm/XLKxbHrRWotazO:6vSGLuGASJnMxLckIUWWKFWotU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665472898, "uuid": "4ad15cd8-a7e5-489d-821b-5c7a393e60ea", "value": 215040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665472898, "uuid": "2c5ba971-3a96-4791-bfe7-e8ac49b365c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472898, "uuid": "4c22ed28-f679-4e60-a50d-8ff0f6a14411", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee33f28d-493d-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1665476585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476585, "uuid": "a52bba56-bb6b-448b-b465-bd68fb6579d7", "comment": "Malware payload (Loki)", "value": "9ebf9dac8f3ecf36d77d3f39d77ee04a", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476585, "uuid": "0360c516-453f-4c07-9b7d-ed73728d2d5e", "comment": "Malware payload (Loki)", "value": "90fb2b064ec4353d02ec3a9d15540cf70dccb7d7a6d10bfe4be8bb73012ab52e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476585, "uuid": "98b4b340-e433-4c1b-9861-91130bb67cf5", "comment": "Malware payload (Loki)", "value": "4da2c44aeabbd7f0bff0a04de6e75aa9338af109", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476585, "uuid": "d077aff2-55e2-42af-96cc-6085dc6ac321", "comment": "Malware payload (Loki)", "value": "416ed5f6c8a9702fcf52fe280878ca5c36af48dcdd3b7d761c12cbe2c5e0635234fa309550080e3b904820083dab191c", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476585, "uuid": "ede8ff9c-316e-4b02-a324-527f1adc275c", "value": "T118326DBCBB885EEDDB8D73A42727B688016F3E3573C050C908B867572D661BDB709428", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476585, "uuid": "a976b51e-49e0-4168-9959-fab9c358cc09", "value": "192:dIRbZgSmBSqyPrSMcKxXZLKv12gxce4qQYlSWSmTMzxHCC+TU1PlAg2KT:yRVgS7PrCWJLKvPcgnBSmTkwtY1j2KT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665476585, "uuid": "3eb4795d-f520-4016-b108-ebbe287fb9fd", "value": 11510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665476585, "uuid": "e83347d4-94d3-43a3-8e06-4e58c4a639d4", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476585, "uuid": "1cbdb788-0bdc-432e-896c-c7b78d5c6b96", "value": "products category and purchase order.doc__.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f487aa2c-493a-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1665475307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475307, "uuid": "8256b136-1e5d-4493-bce1-4ebe396e2c3a", "comment": "Malware payload (Smoke Loader)", "value": "4a8cef940dbcaaab17be40229f8f09e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475307, "uuid": "2bb12f9f-e145-4631-89a0-62ea6bdb5d31", "comment": "Malware payload (Smoke Loader)", "value": "912fca5a89ade2c9f9a69620198f7827959f64a175f117a28afe9fd48ac9c4c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475307, "uuid": "ac71a6ba-0d9f-46e5-a677-063b5d22a14a", "comment": "Malware payload (Smoke Loader)", "value": "fbccf3ef94809dae33000b6a15f7780db9bb3925", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475307, "uuid": "39d987bc-83c6-4acf-86de-34104f943bef", "comment": "Malware payload (Smoke Loader)", "value": "0df79e324ac1b5b74c37cf3e9bb3c49355ba342b3ca5b563e4ac77da75b300ac331a3d56c0c72c8e4213652ee90143d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475307, "uuid": "02a1a5e7-7437-442c-bd3a-f32e42cbb1c5", "value": "T16124CE1232C0C872F2666A748C64C6B56BBBF8745A36568B3BC8076D8F357D29E34347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475307, "uuid": "3e602590-3147-4dd1-b72f-8f401221ffd5", "value": "f07757163332cdbf737bafdb4614222c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475307, "uuid": "1668251f-08d9-45c5-9747-7d984de9139b", "value": "3072:XtYOv3jP6PTLAta3LRF2wADyD31NGnpRpdAZQX6iFa65tMkrXWO:XJebLAta3qwgm10Liilw6LMkzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665475307, "uuid": "351deeb8-8bfb-4a09-87d7-0c818892323c", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665475307, "uuid": "0f7fff7b-4b3a-4eee-84b1-994cc1229f07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475307, "uuid": "49e1c873-753b-4b50-b594-169a8e7c1908", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e453e4f-495b-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665489175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665489175, "uuid": "cabc77cb-28b3-44f0-8947-83e70676ff39", "comment": "Malware payload", "value": "668c1ef4ab40beaba3404907d01f570a", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665489175, "uuid": "45e75dcd-0f2d-4cc1-b867-4f5660b8a7d0", "comment": "Malware payload", "value": "91bbeb187c359460b0a94dab5b3f957ddeaeff4cf6ec0ef4e070624b406a34d6", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665489175, "uuid": "f58e0637-3aad-4700-af8a-24ecc88d180b", "comment": "Malware payload", "value": "1fb136dffc6a9a22a8606c506362f3f63d0b8a65", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665489175, "uuid": "db2ceaa3-0207-4e00-8ac5-a80ee8d8cf64", "comment": "Malware payload", "value": "b446d26e2b05f13859404c1970f0a328ed6717e959ebccd7413de2ce92b617ba195eeba6122693f4994a5c8c3243784a", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665489175, "uuid": "f22a83f2-11eb-42dc-b61d-fd174f486ada", "value": "T1CB251207ACCB9615C460E5DFC7B9711FE34A8C161D903E041282193329C6A9DE7BFA86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665489175, "uuid": "5b9363e2-4eb3-414a-a551-387f64564af2", "value": "384:l33333333333333333333333333333333333333333333333333333333333333O:E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665489175, "uuid": "ee29bb3e-7d04-407f-8053-96f501f3eb29", "value": 1053944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665489175, "uuid": "d512c911-3465-4bd0-8681-85541de547d5", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665489175, "uuid": "2933d49c-0824-4f46-95c5-25ea121e6c6a", "value": "1c4O8e1j4.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9fa4a8-496d-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665497061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665497061, "uuid": "4a8dcb34-7d88-49ca-a21b-b91647d24288", "comment": "Malware payload", "value": "ae89b3829440b6bcdeba91a9472204fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665497061, "uuid": "f4669aef-ed2b-44ed-b54a-3eeb9d93a330", "comment": "Malware payload", "value": "91c4abd856a7f0709e8b14ce66db2455017f338d32a713846d6a226ec73a6e0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665497061, "uuid": "08765e22-e2f9-4dd4-90ec-d2a48df36481", "comment": "Malware payload", "value": "2fb3a721f0c2b4f159530ea5ff8532e873b1398f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665497061, "uuid": "cca51052-37f3-4cf2-a3ed-3d50b2a99ff5", "comment": "Malware payload", "value": "8fa4515487d1b316338baa52074bbd11940d6e86d9561454c9430dff2e1b8ff473c272130dae157bdbc88e2f0f2d2c08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665497061, "uuid": "0f5e05b9-c7bd-41de-9705-a8a3ead071e0", "value": "T11676331170E7C8BFF1C94137E8642FE192B8D1A00F614853B78A0E5EAFBD1F691E2959", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665497061, "uuid": "997004a4-18ce-4b2e-9f15-590a0bca27b8", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665497061, "uuid": "b2ec0360-a6a1-462b-86f8-52f2d24ef915", "value": "98304:91OuFS/9j1Sni+WqRX6jOGqtjU9Wo1JrnaliThn1pnyZ5ZDfbT2Q3FbjuiEJbMgY:91OuFujIrLjYxjrMan1py7ZV39ui/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665497061, "uuid": "2843da12-e56e-4149-ab37-86a4a3c996f1", "value": 7605422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665497061, "uuid": "fb9f3f76-eb47-4a61-a11c-218169d3f8b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665497061, "uuid": "b1e58af0-a043-4ef9-8898-3155636b3e38", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe20114-496f-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1665498029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498029, "uuid": "0dccb360-c1b5-4187-abd0-47d241ce7c48", "comment": "Malware payload (Smoke Loader)", "value": "64ecdd196481c225305317d79d1d1d1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498029, "uuid": "fa5a88c3-930b-465c-b7d4-4f48497a5651", "comment": "Malware payload (Smoke Loader)", "value": "928377073c45f7fb59591af49620d5afc581ce27c4727f7aa77fd23af85b0145", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498029, "uuid": "c3134001-4544-44b9-b1cd-4aaa52a1022b", "comment": "Malware payload (Smoke Loader)", "value": "abe2876f09bed10a73df4b285bf89ded3835fc2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498029, "uuid": "e2c3b9de-4eb7-4c2e-aff4-ad9261f95305", "comment": "Malware payload (Smoke Loader)", "value": "597f5959082c60edfaafecf862ece4099f4aae39605b089126d337685fdae6c671b7e8a9ab751e740b988a177721f259", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498029, "uuid": "6fbb98a5-03b0-4e5d-a18e-bae206ff3ea7", "value": "T1C224CF2236D0C072D2531276AD68D6B47BBBB8314A75978B3BC84A6D4F352D3AE34347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498029, "uuid": "7900e20a-fa2b-466d-8258-0eff82359134", "value": "4db5fa00d6d53e828ab0bf90238303f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498029, "uuid": "c1e281dd-3b36-47ce-b143-90006a97825c", "value": "3072:iFj38fX4VupDLdQa2t82mh0On1+8u7sosjuduPvzgNnUzUplp00dO:iN2J1LdQaumLI+7bnCUzUplpDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665498029, "uuid": "882356aa-cbad-49eb-87ec-287863ebf276", "value": 216576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665498029, "uuid": "3819f4ba-7e91-4225-9c8f-eb33bd7a7aa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498029, "uuid": "8a2b3a32-16e6-4d60-8673-5dd3190fb52d", "value": "928377073c45f7fb59591af49620d5afc581ce27c4727.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a7e0daa-49ae-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665524736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524736, "uuid": "8ca9d01a-d998-42c0-be95-27b50320a1bd", "comment": "Malware payload", "value": "ee85076d4bf249279d017ac2671185d9", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524736, "uuid": "edd76fdd-e5b6-4022-95fc-8f82f43cef25", "comment": "Malware payload", "value": "935cb5a5078af3b14b69ab24f707e6fe40793320d1d3d6b8f9f84b9dd06467f4", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524736, "uuid": "c01b1f3c-5021-4b21-a01e-ffd1040868c6", "comment": "Malware payload", "value": "8fa1f8c99a7cfbc1f496c44f25fbf79c502afb84", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524736, "uuid": "f1595d83-1f3e-4ce8-99c4-adf03d6a36aa", "comment": "Malware payload", "value": "8da864a512ad72551f1729d51f1415659000037fc9c7dbf7f0939b724f77465323fb06e8095a1b33da1f2b2a1ce9ba9f", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524736, "uuid": "2aa949f2-47dd-498a-a9e1-852b884b74e6", "value": "T18FF52323F272955AC8F6D33721B85638907B9D29CB03B7862C59B3BD24BB9DC47856C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524736, "uuid": "9193a1f3-652d-47cb-860d-e5f3c3485b8c", "value": "98304:Pqi6efffnRcj7jGPJqFkRfgey2gOAWkAV7iNmqxkod:PZXcXgektyVO7H+Nmqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665524736, "uuid": "28733ec7-c0da-4a38-88ac-dde78ca31e0e", "value": 3634085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665524736, "uuid": "48131146-8045-443a-83ab-0142c9e474af", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524736, "uuid": "9d08cb02-0206-478a-bac9-6a587cd3cdbd", "value": "Game.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d34404-4924-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665465832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665465832, "uuid": "31c71bbe-b56b-4a6a-b1a5-632059b7a5c4", "comment": "Malware payload", "value": "7d15213539eb08a9d8631fda186fb312", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665465832, "uuid": "bfba7d71-ca9f-4e7e-a3a8-9b1e7d7d3bbb", "comment": "Malware payload", "value": "939b14d8cc356374061cda0c8bb0587be1a065bae4c961f1f9fa1d9a82a9efd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665465832, "uuid": "2604458f-f1e8-4088-9057-cec1bfaee286", "comment": "Malware payload", "value": "159a0ffec3963d80670f806df75cae6eb8dda5af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665465832, "uuid": "4b0e5919-9608-44ff-bca7-855bc0f741e5", "comment": "Malware payload", "value": "10ef65208f659d5a3f913751b2a487d82a9941040beea3c9e9fda8cfbe64ae9dc1cc5488ff0f3027509c4e1cba7c1e26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665465832, "uuid": "73b1f42d-619b-4262-ae68-23a111102875", "value": "T1BF7633403DC488F9C1827A3295900FE5F6E681530B3671DBAB95382D3B6E94D865FFCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665465832, "uuid": "5f0c2a49-f903-4101-8c9e-4d2a91c45c11", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665465832, "uuid": "969ed819-8895-4ae0-9022-5cdab602436f", "value": "196608:91Ox3/AnvaXhjziFBT7sVsWbfoN1aKbikxtcd2Eki:3OxQ+1uWbfu1aIvBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665465832, "uuid": "60a45422-3a6a-488d-b19e-f05974261848", "value": 7597169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665465832, "uuid": "944f34b9-4bd9-43ff-b256-c264f5ef320a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665465832, "uuid": "a863414b-0631-43fd-b89f-678d67639e06", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c26e7cc0-4964-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665493262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665493262, "uuid": "213fe35e-302c-45c0-b30a-67f495e98670", "comment": "Malware payload", "value": "0088bf8a92d2cd0c2e3350d1b7d94db6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665493262, "uuid": "f6926405-4d5a-46b3-9272-12f55e762d93", "comment": "Malware payload", "value": "93da010fb0150e7aefe2e21a722b1616a9b106232b09c44b3bfabdce041b836e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665493262, "uuid": "20bdd41e-da6d-4b9b-8a3d-770e56b8b56c", "comment": "Malware payload", "value": "97dd32ba9e00ad59f1042601683be6b18f12a417", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665493262, "uuid": "ea6e33da-0256-4f2c-8740-ee491b52b373", "comment": "Malware payload", "value": "ace78cd62a86e245659a703c3145c5cd79da51f26ca8c39d7b2cac13b10de4c555d4b036768119c71caee97c3d3ac8c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665493262, "uuid": "b22ee515-760f-4da9-bc4e-880869e591f9", "value": "T1BC76335578DA4634C86340739D7076ECB5B5AA2E0B31193B1B4C5ACD1B29EA3D233E3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665493262, "uuid": "c096f3d3-bf8b-4c15-aa3b-fccefacc27f4", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665493262, "uuid": "64cb862b-c3a2-46c3-b595-73817c9b2f88", "value": "196608:91O2baAkgblqpA5mxonKJbEKchW7vQjWmgmgmaTPdPJx9:3OoaAkgMGVKJbEU7vQWmczPJx9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665493262, "uuid": "f24e9249-4fc2-4d37-8588-eefa1eeb7726", "value": 7631551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665493262, "uuid": "e5ffc95e-230f-426b-aa0a-36d98c41c354", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665493262, "uuid": "54cc6baf-1ccd-42ea-9faa-6b7e12abd7de", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e69e3672-4933-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665472277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472277, "uuid": "bbe8217d-2b00-4594-9dfb-07a16ba6dd2c", "comment": "Malware payload", "value": "d5a64f9ce087dd94472bb3d10a297cad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake outbyte drive rupdater", "colour": "#AD1756", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472277, "uuid": "0e98f491-7321-4903-ac6c-89c04a23a944", "comment": "Malware payload", "value": "93daa3b47aa1687df62325009bd1623d4efd2b0144d359d39ea261af8bc8f775", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake outbyte drive rupdater", "colour": "#AD1756", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472277, "uuid": "b65bf719-9394-4854-a7f7-bd93d477562f", "comment": "Malware payload", "value": "a64254cd00c5b0560fc6a26443a02740550a7465", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake outbyte drive rupdater", "colour": "#AD1756", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472277, "uuid": "ec63fbd3-1ca1-4e2a-82e8-1e82db2e9427", "comment": "Malware payload", "value": "9aa4d1a2d14aa33155c1f585b8a89d84599c08d4b8ea4f5780007a035a44bdca1af8b09ad0fd010a5f4eda613f16d4be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake outbyte drive rupdater", "colour": "#AD1756", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472277, "uuid": "0cccbeae-60bf-4637-8520-689cf090bdd6", "value": "T1C966122222694151D181073A6EEEEC8062B27F2CB572B5F620D779F663720A47F17E1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472277, "uuid": "340a0592-fe61-489d-9bc8-38cc7492437c", "value": "e871971dbce9dc9a10b7f81b64b2af30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472277, "uuid": "89ee4ec7-63a5-41e8-bd9b-8a536dc34420", "value": "98304:yp4c6qZH3CS4TlgABe6Sx98FVZcSsyG+FLHAXtZPVg2YiWQEJE/VtCa:yx6qVoBe6b2bIhcPy2YiWOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665472277, "uuid": "a2f37d62-4c03-4437-9d36-2509bd5f0828", "value": 6790144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665472277, "uuid": "5deee7fe-b74d-44b5-8345-c4eb6f125745", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472277, "uuid": "c3069c29-e8b5-4baf-a6e3-3f00d49237e6", "value": "93daa3b47aa1687df62325009bd1623d4efd2b0144d359d39ea261af8bc8f775", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6549705-4940-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665477887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477887, "uuid": "e3bab4da-1f55-4d1c-a4e2-8f8583e6d9a1", "comment": "Malware payload (SnakeKeylogger)", "value": "6d5e7ac5b3462d15138ad209ed176bc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477887, "uuid": "bb862e27-8d08-43c9-9258-cec18407c9d3", "comment": "Malware payload (SnakeKeylogger)", "value": "93e390a0b385cbe75e53b89b22f597e9cbb339c33fccebba1a7c1d3a05b48cf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477887, "uuid": "03bc4e4c-2be4-4d9d-9686-5314c9f31ef6", "comment": "Malware payload (SnakeKeylogger)", "value": "0d3cd791cee32dd07a9a87062dee398cc3510c9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477887, "uuid": "7ada779e-babd-40ca-9dd5-3f2645c1483d", "comment": "Malware payload (SnakeKeylogger)", "value": "f737d200c720783cd1e26aadf0b0ef49fe34eac324e12fd56b915d06e042462a563c8a6ad755fbc484417421260ee6b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477887, "uuid": "24c91562-8c44-4a39-b99f-a921ed0a9759", "value": "T106355A7E26964906D9193131C483D5B32AFB6D906062D1CB6AD73F2FFC322BF951234A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477887, "uuid": "ee27676f-d4ad-47b2-b59e-88db0c7122ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477887, "uuid": "b4496415-8cd2-4b89-a915-3263a6b03be8", "value": "12288:w4/AC/UssDsO4//cLxOVSYoI6SclbcdEJauzZyrttieuXBRAQSQy4A/cLBY:z5qPIL9IbWEnQrtyAtQy4AUdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665477887, "uuid": "4f365701-0d43-4129-883a-128d1b070c52", "value": 1095168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665477887, "uuid": "caee46b8-4c2e-4d1e-ac96-e241d40b6f17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477887, "uuid": "af139099-ec78-405b-bffa-d04a382cd958", "value": "854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00404077-4937-11ed-9266-42010a9c0072", "comment": "Malware payload (BluStealer)", "timestamp": 1665473609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473609, "uuid": "54ac7de2-d87c-4a2c-829b-63558cd6481a", "comment": "Malware payload (BluStealer)", "value": "b5fd23befad62c4df5d8ecc9090177c6", "object_relation": "md5", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473609, "uuid": "aeb83ae6-ac38-416a-b1ab-d890dce0f5fe", "comment": "Malware payload (BluStealer)", "value": "94fd32f92feb6bcd27b92783b47fe1fa56530e44614c21f738f92d4697e6f753", "object_relation": "sha256", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473609, "uuid": "9d1d47ea-c40c-4214-8277-701cacf9552d", "comment": "Malware payload (BluStealer)", "value": "bf0890f651624c12ca1ae3962ed1500dc6dd7df8", "object_relation": "sha1", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473609, "uuid": "a9dc6d46-78b0-41d9-af47-49f54de6da1f", "comment": "Malware payload (BluStealer)", "value": "a76f406304b5b79de67917958da26b32296bb6d755972cfebabfed27a0a6c9162b91238033f0ac9153b5991a4caaf7d9", "object_relation": "sha3-384", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473609, "uuid": "6b8586e7-db22-48a5-bc72-6bff052bfa62", "value": "T135536D42C6D20453D96A9AB3B0D386C31BB0B14D6CE04AE795DDF01A0ECF34A759BADD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473609, "uuid": "bf780147-4b0e-4047-ad58-b23dd49b6eb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473609, "uuid": "ccbd946f-060d-4ef0-bbf8-803b38c338dc", "value": "1536:Cs4yfCpga/eHUTQQQQQQQBdBgN6b5/2kWSC6WLr1BDvas:Cb4Cpga/eHUTQQQQQQkdBft/2YWLr1Bf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665473609, "uuid": "590c1a71-49a5-4719-bdcb-0d86d33d8500", "value": 64352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665473609, "uuid": "bea59d96-2a12-475f-91c2-1b74c214b0d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473609, "uuid": "3ab87132-cca1-4083-9ef2-ddd46e1076b0", "value": "PEDIDO_CONSULTA_11102022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc3ee56-4928-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1665467380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665467380, "uuid": "73e582d2-7319-4c97-9959-663bfcd2bcc4", "comment": "Malware payload (Formbook)", "value": "b873e0441c0ed5a134eb54f1fa7615fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665467380, "uuid": "107df76c-095e-4dc8-9d2a-5d6708e9a7c1", "comment": "Malware payload (Formbook)", "value": "959b7b3c7962cbd8e88c0f342f370258244ab2a396ebd6abf26389020baf9a4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665467380, "uuid": "f9d8b1b4-09aa-4fcc-9d78-f52bb2b1c204", "comment": "Malware payload (Formbook)", "value": "728296c91b19720e6b1d2a848e4172632ac88b08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665467380, "uuid": "9f8116d2-da19-4b99-b4e8-d660a58f5463", "comment": "Malware payload (Formbook)", "value": "f4fc5e5452371ce88761931f90dfdab875541474c5dfec08373da5105f6f2699ae5c9b01dac8b3b7a85748585b3e7eca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665467380, "uuid": "9d16fceb-7425-4f64-8013-6c0c12b41f7e", "value": "T1B5458C7925994247E8283271D887E2B326FA6D54A051D1CF2AC77F6FBC613BF810734A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665467380, "uuid": "c05fd579-4eab-46b5-982b-8ee1e5d3560b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665467380, "uuid": "36832547-26f5-4318-83ab-96dabead248a", "value": "12288:9KwfSzSu4B1aOYLryG3Azk8pmLSlgZq+iDtBEnTJAAQSQy4AHlyAKp:KGfHZUynuq1DtBYSAtQy4AHlWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665467380, "uuid": "114e0255-fd46-4c88-a048-d3a8babac33a", "value": 1210880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665467380, "uuid": "9bde93c2-c03c-4097-bea5-db22fbd914fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665467380, "uuid": "5a7635bb-6469-494f-9c70-cb8bdc204684", "value": "SecuriteInfo.com.Win32.PWSX-gen.21822.21708", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44cf20e3-4943-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665478878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665478878, "uuid": "48cb36df-f570-4b8a-bf48-3ef29ed52cd0", "comment": "Malware payload", "value": "b43fb439f6146f701419baaa49803b28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665478878, "uuid": "69452261-8a54-40c7-9436-022531d9f490", "comment": "Malware payload", "value": "9601e819abfa7f2d391952296ab06f7db679a668672d495c382bc9e9e7dc935a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665478878, "uuid": "747a50a6-af80-45e8-a3c0-d28606d33701", "comment": "Malware payload", "value": "9a8779b0039079a9ad2a0b7a0cacc6f3bc4b5f3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665478878, "uuid": "0c3770f3-0833-48e3-b602-e3591a4ff81b", "comment": "Malware payload", "value": "a0e40a0c4b04a344f2025adcd5bb33b5e12216d1c04d0d5aa43a4b9f24ac8350a97e396251f51c289e535417786f8b98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665478878, "uuid": "8db0ee44-833f-41a4-8866-dd9a59acfc75", "value": "T18A7633253CB1C973CF625F72870A9B68E1B2D12A4A29C9335FD503215F3CBA452BD798", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665478878, "uuid": "3bf5e449-80eb-4d0b-a859-04cf372700a4", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665478878, "uuid": "e4801d9c-19a2-4d62-b93b-7d3fde4add7f", "value": "196608:91OSVBcGG4LmkdnNhC4145GS8zgSTiuoGKaXo:3OSVBa4l914kS7G/Xo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665478878, "uuid": "ba768a85-74a6-49af-9f9f-8b5a1221238e", "value": 7615697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665478878, "uuid": "7c4fa712-d3b4-4c4f-be3d-e599d923b45c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665478878, "uuid": "6503f245-82c0-49c6-ab05-95004856c47a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41347117-493c-11ed-9266-42010a9c0072", "comment": "Malware payload (Chaos)", "timestamp": 1665475865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475865, "uuid": "3afac348-d13b-42e2-b3a6-bbbbf77fffde", "comment": "Malware payload (Chaos)", "value": "56ba33930c8583767eb1de24b5fcca53", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475865, "uuid": "e3ff5dff-80d1-40c9-9357-a381149934fb", "comment": "Malware payload (Chaos)", "value": "965514ea483e43649c09c32e5d79c66ff4f55ae63ac8319def8f58401fa30f17", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475865, "uuid": "cc2c452e-5375-4cf7-8562-2a07cf47edd4", "comment": "Malware payload (Chaos)", "value": "bc56450217115867fb48ac546c238ef52cc80b7b", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475865, "uuid": "7bd709cf-3787-445a-9dc3-3140d173956d", "comment": "Malware payload (Chaos)", "value": "962fa412baa3ca2f6926d4e7da290688fda0ab904eae04c8e97ed8baf6a341ccfff9cccf3658617322a7b6b89ae554c0", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475865, "uuid": "204b9273-ef1b-4676-9faf-735fb8f63d51", "value": "T154D44FE8F9EA5008F073AFF58BD4B8DBBD6EB6E22A035059134D3F0A4612D81DD91539", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475865, "uuid": "552f69fb-fa8b-4fea-bc7a-d3e3e0e81522", "value": "12288:kidHp0JjCp0FSoqJxQu+MfPjQRgJjDjAkW:kFjCqFSTfLjAk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665475865, "uuid": "0c0c55f3-d4d6-4a32-b9c0-319242eba534", "value": 637192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665475865, "uuid": "a7e9e728-b3c4-47ce-bf9e-1e8a846c1f18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475865, "uuid": "c87cd334-c5b9-4066-82f2-c7d008f74dcd", "value": "965514ea483e43649c09c32e5d79c66ff4f55ae63ac8319def8f58401fa30f17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ba7f06-4961-11ed-9266-42010a9c0072", "comment": "Malware payload (AsyncRAT)", "timestamp": 1665491798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491798, "uuid": "24c0b9b4-5772-47a4-b8b5-242a82e920b8", "comment": "Malware payload (AsyncRAT)", "value": "0930b477703d6a03eb120ad3543513d8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491798, "uuid": "ba25f681-490a-41a3-afef-d449136860fb", "comment": "Malware payload (AsyncRAT)", "value": "9699022b7bd45a72cf29614bdd131400dbee0ab5d6a5c2e03ed1c13e7cf0eca0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491798, "uuid": "fb19ac36-5ada-4af6-80c8-d190869cef1f", "comment": "Malware payload (AsyncRAT)", "value": "7bc33a9595ffd5f5bacb6843ee1dfcd86df74fa1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491798, "uuid": "99fc5b73-0460-43f0-87a6-e1b3d80b0703", "comment": "Malware payload (AsyncRAT)", "value": "2a3a43087ba233d4f19706ffb01a4849f1884224503beeb52e0e53c9213bd077c8508025f8f776c47ac6887df87df769", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491798, "uuid": "9bf3b4ac-3efd-49a8-9726-e223044cb010", "value": "T16493D05976505B9BE0A35BB62AC71A5D7DB7BC388713C60014E2F62E203F7118E9722B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491798, "uuid": "440af7c9-df98-4def-a0bb-ef89bd3c57fd", "value": "5efd333698985e0c33bc01c25c971347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491798, "uuid": "6faf4e6a-9354-43a1-8585-9d3b008f508c", "value": "1536:XRzdezMTHOFP5WKcyRm1YGl/KVzFeS6Bqt/pr2sQOIkbrPsNI:WzMDKwKx8Yl1FKqtRFYsrPV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665491798, "uuid": "66472d5f-d844-4b63-8643-a7aa7eb28bb2", "value": 93607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665491798, "uuid": "d8a8035f-ed88-49ed-8d82-223647430881", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491798, "uuid": "9368fd34-7983-4b12-91eb-029d0fa08afe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf07253f-4918-11ed-9266-42010a9c0072", "comment": "Malware payload (WannaCry)", "timestamp": 1665460641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460641, "uuid": "ba34ba0c-4614-4737-ba9d-f90d0c6c63f9", "comment": "Malware payload (WannaCry)", "value": "326087bfa4af473444f6bcdd1a7c75bd", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460641, "uuid": "558c9d40-47f6-4c76-a4aa-381d926f7118", "comment": "Malware payload (WannaCry)", "value": "969c152d24d3fa9fd347e717949d60bd99daf5c3234df5c6ff9b759b30daae95", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460641, "uuid": "6b382d1e-cc19-46bd-940e-5650d5914e62", "comment": "Malware payload (WannaCry)", "value": "899478c4ada21f1337b905133a3d95d89a45658a", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460641, "uuid": "9519c77e-36e6-42f0-8961-1f94f6bb36ae", "comment": "Malware payload (WannaCry)", "value": "528ab60ff23890f4e1b8874b7973e43b5ca7d42fd3b7efc7684bfbd03c2763b0d2ff6ea9be3ed871d1be4424a2936fb1", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460641, "uuid": "b7556ead-9b27-43fc-bc40-e06a484f4292", "value": "T11394F11A67ACC1BCC42A4131A8634A76DBB77C5952789B0F5B58CB650E23390BFB4F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460641, "uuid": "3a5fab71-b04a-48f2-9613-7ace08053a83", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460641, "uuid": "0fb95a47-bef1-448f-8cb9-dac7f8885348", "value": "6144:yE9l9yUqIYVTH5DgSg8ajldktM0XXrP2QhMV9qbBLIwYQuy8DLq1ez:yvbLgPlu+QhMbaIMu7L5z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665460641, "uuid": "05e8f0a7-0e29-426e-973e-bdbabf2af6c6", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665460641, "uuid": "e0e203ff-1285-4eef-b035-a87583914782", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460641, "uuid": "20607e8c-69c2-4021-b3cb-ab1351368504", "value": "969c152d24d3fa9fd347e717949d60bd99daf5c3234df5c6ff9b759b30daae95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14386386-4945-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1665479655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665479655, "uuid": "aabfe8e7-805d-4911-b2f2-dc86e1da608c", "comment": "Malware payload (AgentTesla)", "value": "b9bd30a5d0f8adbdf7c174a56b16992e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665479655, "uuid": "82a630e0-0448-473b-b716-4edc1b13e1ea", "comment": "Malware payload (AgentTesla)", "value": "96adb400e925b819bcd0df29be093012b0ddeda0a631f6b4753e8bff2602a446", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665479655, "uuid": "0fda8efe-75e0-496c-8cec-d3bb4819ddb6", "comment": "Malware payload (AgentTesla)", "value": "5162a02a1dd43866b2eaf280db17cce3a94e095c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665479655, "uuid": "88cfedb8-de06-453a-a1af-4ea759637ddd", "comment": "Malware payload (AgentTesla)", "value": "44b8f2f0ed07d65dd4bdc6249e4c0fae44b31e0f164e2756a8e6a8d29f008c1f4566a81ebd32cce682926efa47142d86", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665479655, "uuid": "54ee39ac-fe8c-443f-90e7-cf51a112d52d", "value": "T112356B7E25D64907D9153131D883D1B32AFBAE50A061D2CB6AC77F1FBC612BF9902386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665479655, "uuid": "88e13d7e-29ae-4b6e-bcd2-b7ce7fcfcec8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665479655, "uuid": "69c5e61d-19f1-4b6b-b913-3393ccb03a2c", "value": "24576:ltmZqqB6YRRI1K00YIN6OGkIRbgVJhAtQy4A:HCz0JwRINgVeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665479655, "uuid": "673438eb-aa55-4592-beae-c8893a28346b", "value": 1110528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665479655, "uuid": "2678ed13-1467-4d55-896c-543959fcf972", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665479655, "uuid": "b1863c5d-146d-4986-97bf-13dba0475673", "value": "AWB NO72538341..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e64cfef4-49ad-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665524676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524676, "uuid": "6707c55f-3a0b-439c-9567-d70b73a09435", "comment": "Malware payload", "value": "3ed281c0f0adeffb616fca6735551e1e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524676, "uuid": "087adaac-0249-402c-9e0e-bd4af6749c6a", "comment": "Malware payload", "value": "976a093afe0e464e9e9908b56ec236785b7d772f5015d98fe8c66b65636663d7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524676, "uuid": "cc1f7ccd-fd5f-4c48-b6be-acf5a022c44e", "comment": "Malware payload", "value": "3aeb6bec53c90c005fd1a01e0a0548d662cc031d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524676, "uuid": "0369aa5c-c23e-46f4-9e58-5a7d3abd46af", "comment": "Malware payload", "value": "4961b1ae2f0879b4f6ee2c9206d6eac4f2e2ac1c6df4a3a5ee806634de08fe891fb6d1a9689262c408b84b3412835a66", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524676, "uuid": "59387fc5-4290-439d-af48-3110412b9d0e", "value": "T1BCF46C0977F8C032C03B16755826C34D9A74FAD2C877C2A736CEB26E6F10A518E53AE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524676, "uuid": "16d1cf21-c1ca-4b33-962c-0b7b05f79d11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524676, "uuid": "a71d0d49-29f5-4975-a1e3-cb998068e303", "value": "12288:lKKKKKKKKKKKKKuC0i1esXq4cQmmTsG0OzSDWeVJ6unXqZkVQ7hZER/+n1fI7+b:lKKKKKKKKKKKKKsxr4cQFTj0OZeVJ6us", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665524676, "uuid": "1034d5b7-021a-449c-badb-46384573254c", "value": 768136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665524676, "uuid": "6fadf905-3dd6-420a-8fe8-2e08a815b97c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524676, "uuid": "9614e962-6e36-457a-b083-8eb41089117f", "value": "976a093afe0e464e9e9908b56ec236785b7d772f5015d98fe8c66b65636663d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "643e7af9-4918-11ed-9266-42010a9c0072", "comment": "Malware payload (NominatusStorm)", "timestamp": 1665460462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460462, "uuid": "865eb9bb-2596-4812-a92e-cf01ade7f2d8", "comment": "Malware payload (NominatusStorm)", "value": "b36324b823c0f1ad73516adf87f3510a", "object_relation": "md5", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460462, "uuid": "b6ce9956-63ff-4141-9975-d14cdff74621", "comment": "Malware payload (NominatusStorm)", "value": "987295760f1b88340069dd29be05a5f7ec5053d9bde81e981f058827ed2639ac", "object_relation": "sha256", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460462, "uuid": "7cf9a467-fd32-4db2-b351-c958048276b1", "comment": "Malware payload (NominatusStorm)", "value": "ac21d1858e44e840fbb41d2a3e610288b3641a99", "object_relation": "sha1", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460462, "uuid": "ea97dfc1-ba0d-4f38-8e82-3177450b63fd", "comment": "Malware payload (NominatusStorm)", "value": "afc66b487ff9acf009452c1d6b7b0e1410cbf5023a3b633ff7e03e1d509bd6e107939196a196928d38912202bf9c2b22", "object_relation": "sha3-384", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460462, "uuid": "496934df-2255-4a70-b810-2fbf4eac6bd0", "value": "T1C2740705B7D4D532D5BF47364E63D3881671F9A3DC63422B30E4AB6E7E302904D92BAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460462, "uuid": "b073c2c5-ed8f-4236-a914-24e8961e77e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460462, "uuid": "ae940e2c-0e65-4222-9009-ec78fcb80fac", "value": "6144:e98L598L598L598L598L598L598L598L598L598L598L598L598L598L598L598N:lKKKKKKKKKKKKKKKut89TsmYFZ2qrO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665460462, "uuid": "dead9f17-0a27-4961-acbe-c8ce242fb779", "value": 367120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665460462, "uuid": "57138208-121c-42b0-8fed-4cc3377326d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460462, "uuid": "c86c7d03-69d4-47e2-a889-107fcd6abbbf", "value": "987295760f1b88340069dd29be05a5f7ec5053d9bde81e981f058827ed2639ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec238682-49ad-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665524685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524685, "uuid": "eba8acbb-dee4-4b90-9a59-471b1e5ca962", "comment": "Malware payload", "value": "0c64140375a393a5ba5471338d72ed86", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524685, "uuid": "075ed2aa-fae9-4a0b-900c-2aad882c2f89", "comment": "Malware payload", "value": "995c78c7ca364c72182f68d02f4ebb2aa0eb6177488dccae151178bbe0995dc1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524685, "uuid": "c9f592a5-6a59-44df-bb1b-19ce333ba533", "comment": "Malware payload", "value": "4df64bbce9c5a56d5461b9f30b5e5d777c4bd7e7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524685, "uuid": "f9f112cc-b398-490f-89b9-ce2e694fe435", "comment": "Malware payload", "value": "e2b2d9c66ee3bc467f8f649ff506c2711cdbd3b44595cf1399e7195baaaf6a0eb12f5e1cc53f9338012173a3c4bfc36a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524685, "uuid": "8ac90972-3b23-448b-b21b-08ffdc55e2ea", "value": "T10AE44B09BBE0C032D06F42394D6BE3486671F4939E23459735DCA3AD6F712D14E62BBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524685, "uuid": "e35bc194-c6e8-4755-adfd-bd9b16d6233f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524685, "uuid": "65d4e05a-f622-4a06-bed9-b45ae2e86844", "value": "12288:lKKKKKKKKKKKKKuC0i1esXq4cQmmTsG0OzSDWeVJBY+P/9:lKKKKKKKKKKKKKsxr4cQFTj0OZeVJBTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665524685, "uuid": "10fd3a60-4090-4bc5-87ea-00ac7e4ad2ea", "value": 713552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665524685, "uuid": "25601941-3a38-45c2-aacc-71f270e46775", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524685, "uuid": "f1c65832-2457-4dac-b17f-5bd993e7a176", "value": "995c78c7ca364c72182f68d02f4ebb2aa0eb6177488dccae151178bbe0995dc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df261450-4967-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665494599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665494599, "uuid": "ad306f42-ac6b-420a-b2df-a2755ed03d4c", "comment": "Malware payload", "value": "17264f1dc2d88def5e0b62accbc58a11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665494599, "uuid": "b17df2ae-6aa6-4c18-bf09-ce259ae32f14", "comment": "Malware payload", "value": "9a29192a18b0112a260fa164a9612fe745fdbe0485cec734bf59cc3335ff8943", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665494599, "uuid": "e428c639-528d-4b51-9b98-31ced6a690ea", "comment": "Malware payload", "value": "7cb32269c9f34249bc8949cbc098bc13638350ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665494599, "uuid": "1f5c7656-dcf7-421d-852f-0964122f2623", "comment": "Malware payload", "value": "dbadc734bcbac545dbcc761a1c63dfab175888b909427836b7419725829ce35d4050e94b973efc49646636f7eade55ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665494599, "uuid": "86b10011-3349-4a0a-9f2b-61937e818b04", "value": "T1A3357B7E2A9A8907D8153135C487D1F326FBAD506062D1CB6AD72F6FBC413BF950238A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665494599, "uuid": "89ed2858-ee98-4518-a505-dc3c8378593f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665494599, "uuid": "cb8f1c59-26a2-4901-ae54-f5f8b18b515c", "value": "12288:3W5NAcUsQ6A6oTxAwf+CMVd/3StpX76DrEXVz9Zka88O7pZRAQSQy4AF:t6H8Nf6Vd/i36GVz9ZT88ep/AtQy4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665494599, "uuid": "ae09945e-3f40-4c31-836e-8ed363ea6192", "value": 1092608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665494599, "uuid": "bf78a916-a91f-498d-86fc-4eb4230ef6bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665494599, "uuid": "4961ce94-4521-453d-893c-ae732953f78e", "value": "ABCV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0dd49fc-4964-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1665493233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665493233, "uuid": "a5a346c9-2901-4f54-8838-893a7e730995", "comment": "Malware payload (RedLineStealer)", "value": "05bb77267d95753a68dabc5ae85957bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665493233, "uuid": "d72b2d88-eb14-4b5d-a749-85ac6c198635", "comment": "Malware payload (RedLineStealer)", "value": "9a7820f2d1ed7044c6f2892f2a1e6ce377f3bce1837601c8f9f499c7cde4670d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665493233, "uuid": "405db98c-fb55-4f60-a741-a6c694221bb6", "comment": "Malware payload (RedLineStealer)", "value": "9fdd56aa751b603dedfa069c0f32e673cc1d807f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665493233, "uuid": "ce3f3c42-5c97-4b81-bdce-89465383fae0", "comment": "Malware payload (RedLineStealer)", "value": "f453facf354be5b8c70060d99ea2f5adfb52ff33f7241b124d09a8b7722616fc6b33de024c19b5325b015cbda5a65299", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665493233, "uuid": "119d7725-f793-4e88-82b4-65fbca4fdb92", "value": "T1D844AEF076AAD8B3D1A715B3C4649FA01A3BB8325574B04B2714125E0D72ECCBAF631E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665493233, "uuid": "566de748-d10f-48f6-bc2d-664a68c3d751", "value": "bcdcde9a8dd5ae0f93f0322efa1dbf4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665493233, "uuid": "26b34cc9-dfbb-49fd-8d94-0e6b3a48f122", "value": "3072:uXIruYzGk/qKvqN2x517+fBIJ7TZYX21Wrxpzbgqru/pnawnbjpZa9uD6VdyhkUN:2FRKvq3pIXf1uzbgwu/pzwVfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665493233, "uuid": "f68315d2-9047-488e-844f-997442edd184", "value": 273408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665493233, "uuid": "b065cc67-1b0f-4e6b-8f5a-bb18b132c51a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665493233, "uuid": "9a01d294-6170-4ed0-b0cb-a7fe03bcd850", "value": "05bb77267d95753a68dabc5ae85957bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7510c73-4938-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1665474399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665474399, "uuid": "cabaf8ec-18ef-4a91-8b09-27ee63a9f787", "comment": "Malware payload (AgentTesla)", "value": "b76f20ca6994450dc61f0a15f1f106dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665474399, "uuid": "174d9e6a-2a3f-45a9-b90c-98f1f5bf6389", "comment": "Malware payload (AgentTesla)", "value": "9a8a59cfcd9d13a3db4704158e31640295a774e1a7a21a8b5d2badcd5e5f8ba7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665474399, "uuid": "9ffada80-14ec-4808-9192-ecc045474db4", "comment": "Malware payload (AgentTesla)", "value": "9e719f4a0d16f9edc79afa82c3c548aeccaab0ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665474399, "uuid": "f05ffb64-409d-401a-ba53-7e30aba5abfd", "comment": "Malware payload (AgentTesla)", "value": "97939683d666a047347228e10b62d8efefc8efbeb859744f383983c6af53a2965f9d3a2d500e610bcc5ee7f33ca4c2d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665474399, "uuid": "fc012b20-a2da-4383-9d9b-5330e483bd73", "value": "T1C605E0271BEA4B0BD015B6B894E1C3F2E3E9DD11E57BC3876BCA9C1FF04A5658260361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665474399, "uuid": "6686eac3-03b9-46dd-9bfa-117506b99484", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665474399, "uuid": "999c90ae-fbe7-4977-9cc7-a40396611a8c", "value": "12288:tA+2iNDI3qahGzfhx5fa1B066AEJx/n9jM5ZYZxcM9tCCxDUGo/rV:V1KGjJ5n9M5Z89fFxtQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665474399, "uuid": "ba0f7204-4535-46aa-ad33-749dc8d5509b", "value": 818688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665474399, "uuid": "73e5973c-1ee6-4fcd-8bcc-137418036b49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665474399, "uuid": "d0348a38-8b00-45af-a7b2-05661ff0deb3", "value": "9a8a59cfcd9d13a3db4704158e31640295a774e1a7a21a8b5d2badcd5e5f8ba7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca9bf738-4918-11ed-9266-42010a9c0072", "comment": "Malware payload (WannaCry)", "timestamp": 1665460634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460634, "uuid": "c3804834-080f-4ee5-92af-c0558b989cbb", "comment": "Malware payload (WannaCry)", "value": "2fca5b13e15f025de261853c65969e2e", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460634, "uuid": "72280326-32eb-42cb-a12c-47240ae110cb", "comment": "Malware payload (WannaCry)", "value": "9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460634, "uuid": "70e688da-e8c6-441f-bcef-6e61459f8290", "comment": "Malware payload (WannaCry)", "value": "ba989508bb7621478aa835eb6222ab5cebf5419f", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460634, "uuid": "5831ad36-b241-40b7-b85e-8e56032f07fd", "comment": "Malware payload (WannaCry)", "value": "7b233c93a647e1f88a87db9f9c3c7bd42229ff1b87b4aa52e0608b24ffa9ef0e03f252cd1fdee4c6165b0fe64b14a863", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460634, "uuid": "649f5912-ab0c-4adc-b4ef-73e2fa7a1f99", "value": "T11B36D00A3B5CC0BDC066423598634A35DBB7BC5A5278DA0F5B58CB660E63390BBB5F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460634, "uuid": "037c342e-9953-414e-b832-6ce04579b9b5", "value": "9ecee117164e0b870a53dd187cdd7174", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460634, "uuid": "3472d9b5-7ab9-4aed-968e-d95c6af85da9", "value": "6144:GE9l9yUqIYVTH5DgSg8ajldktM0XXrP2QhMV9qbB:GvbLgPlu+QhMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665460634, "uuid": "4baeb0d2-068e-4294-864d-efa2bdaad1b5", "value": 5242876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665460634, "uuid": "2662da7b-befb-45e1-b770-fc599323f17d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460634, "uuid": "59b8635b-824a-4e65-bd99-186be3a95dd0", "value": "9b4a17bb43644b40651948c85c766625fc850789690a94a582f72594c44766d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f07fbb0-495a-11ed-9266-42010a9c0072", "comment": "Malware payload (NominatusStorm)", "timestamp": 1665488908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665488908, "uuid": "f239e643-c813-4d71-b194-e18c47a6a490", "comment": "Malware payload (NominatusStorm)", "value": "85df6ec9a89ab0413a2ee82dc72bc279", "object_relation": "md5", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665488908, "uuid": "9b16fd58-ce1d-4b20-8edf-fcea4537a3f4", "comment": "Malware payload (NominatusStorm)", "value": "9b6a2cbf8f4bb57502bdcbcfeeb25aacd023d66065ce11c38aa7020979b03da5", "object_relation": "sha256", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665488908, "uuid": "b93d8eef-d93e-4abb-b29e-6f15ed37dd20", "comment": "Malware payload (NominatusStorm)", "value": "c8808c136585cb5bdcbdc22e6593a60e67d5cc89", "object_relation": "sha1", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665488908, "uuid": "cace29f7-7e54-4227-91d7-3d17ca559dc0", "comment": "Malware payload (NominatusStorm)", "value": "5d67ba6c7feb25cb4fadb7be974ecdf0392476dbfb82b3025b1e3deefbda63ff25c72619ba9ed4fbe787ca80609dd6f1", "object_relation": "sha3-384", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665488908, "uuid": "6935d90c-56b6-41d8-944e-f928d0946611", "value": "T1A7F6BF1377D1E171C05B42784967B3A616BAFF325B21978BA2007A1D7DB36C0DA39B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665488908, "uuid": "06932ccf-05b2-4fa1-b387-b63e4d00c275", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665488908, "uuid": "a28705b5-6560-4fb4-beac-10ccc831edbf", "value": "196608:Gd9JTZksaJ+1orTRtLxuPGpb9wDLaoyU/vZMZH31EZCOZHrc7:GDJTQTRv7JwD2nOMI9ZHA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665488908, "uuid": "bd542be9-70b9-4bd7-aade-d78fc89b9149", "value": 15913784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665488908, "uuid": "4d268205-b4ed-4d0f-9b08-6aad119e2b82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665488908, "uuid": "8785d66c-64b3-4722-8638-2d6c4a3634c0", "value": "9b6a2cbf8f4bb57502bdcbcfeeb25aacd023d66065ce11c38aa7020979b03da5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65295f7d-4940-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665477644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477644, "uuid": "1afb6fcc-b386-4fd2-94d7-fcd670d90863", "comment": "Malware payload", "value": "ef238d7097784d65bef908d7e6758342", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477644, "uuid": "4bbce369-0c09-41be-81cc-a08e4bc9b8af", "comment": "Malware payload", "value": "9d5d8db27209b97a221a975134e8ba92eaa8b88e298b602bad49d385b8ce2066", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477644, "uuid": "0ce8329d-c4df-47e7-87aa-87e6dfdaeafc", "comment": "Malware payload", "value": "a54910f3c5a1a13c5e8ffbf109bc974ec9371b73", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477644, "uuid": "3ea596a5-38ba-4ccf-b031-0f51691dfa0f", "comment": "Malware payload", "value": "11471eadc560a473558ec676be4acf9579e36333cbca363b759438b0b5d386ff8a43e8a821b47fe0be60d546538e79e0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477644, "uuid": "86a0510c-9e05-4358-8e5d-f6bc652a010a", "value": "T1823492617F026974C1511A73458AB9E423BD6C33AE8452E53FBAF38A1DB8788EC57343", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477644, "uuid": "15639da7-edcd-4fee-a5d1-e6be88046354", "value": "768:IYq8bw8aILCEk6G9gknIdeclnlpc66j2XdchXLpIYuTXMRwd+K5Pt:Imbw8DLCXt7IBxXZoLpkxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665477644, "uuid": "192f19db-d24b-4653-b8dc-939e4168fcd0", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665477644, "uuid": "4290af77-886d-4a2d-beb7-f994a83a32eb", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477644, "uuid": "7ad182e5-82bc-47c6-b1ec-0677be972ee9", "value": "payment.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c0e1c07-492e-11ed-9266-42010a9c0072", "comment": "Malware payload (Xorist)", "timestamp": 1665469898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469898, "uuid": "a068848b-c3b1-4389-97df-093c1ddcfb1f", "comment": "Malware payload (Xorist)", "value": "4ff1701c87bbe196868574a141261708", "object_relation": "md5", "Tag": [ { "name": "Xorist", "colour": "#EB0FB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469898, "uuid": "98ae6b1e-61d7-4418-b4e1-190e8ec02e55", "comment": "Malware payload (Xorist)", "value": "9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a", "object_relation": "sha256", "Tag": [ { "name": "Xorist", "colour": "#EB0FB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469898, "uuid": "a2a2afb0-4a3b-4d68-9d73-33f432d6e160", "comment": "Malware payload (Xorist)", "value": "c17fb32dac1680e324f4fde436281927aedb10d5", "object_relation": "sha1", "Tag": [ { "name": "Xorist", "colour": "#EB0FB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469898, "uuid": "df882172-e60d-4e50-81fc-f5fafd6812be", "comment": "Malware payload (Xorist)", "value": "0330603060dffed21cf8510bf5ee0753865de4e72cef29e60d34b5ecd2fc611712cba1e0b47f0354bdac5bafca2dd775", "object_relation": "sha3-384", "Tag": [ { "name": "Xorist", "colour": "#EB0FB2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469898, "uuid": "a282a592-1674-4102-9ae3-45a349d67092", "value": "T104D4A7D4DFD6080BD8288F36542CBB9E891D577137678A7B62AAD0C907CD6D2FA0D09C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469898, "uuid": "49860290-1ac6-481a-a72b-f194c8992cd5", "value": "d9d5609df8f39c7ce06f045defa2e1ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469898, "uuid": "070d5c0a-5934-4d47-af35-6b6f5a8ad3f3", "value": "6144:+rZSYomWS//JmcZiWE58TR45SYomWS//JmcZiWE58TR4u:dYomWS//JmcE2YomWS//JmcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665469898, "uuid": "df06151d-619a-492e-80c7-e4a20930302c", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665469898, "uuid": "396aa576-8b8e-4cdf-9d66-448491b9ce00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469898, "uuid": "99406699-3596-4a1f-b39d-392c836f9e97", "value": "9d9afba0fc3a930a117b8905b4ee4821bb5e922794306aac084a1b1e51b0391a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5dfdd4d-4902-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1665451204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665451204, "uuid": "cda9a1d1-750b-4d56-88e6-7afa3972d053", "comment": "Malware payload (GCleaner)", "value": "3d194612acd141806cfebf0fc65ed2d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665451204, "uuid": "66fc4628-1533-41fd-8fc1-e08844df65af", "comment": "Malware payload (GCleaner)", "value": "9dd0ea1fbd0d1c61a4c1ddf0cc122bd06cce3ce18ef722409a78e59b2efd2b48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665451204, "uuid": "3ee102df-5866-44ab-bc51-576d846d308d", "comment": "Malware payload (GCleaner)", "value": "ee01f42995debae003baa0c430faca64fd29a1db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665451204, "uuid": "31c783ce-4878-4684-ad4c-b0e39f4d3f2a", "comment": "Malware payload (GCleaner)", "value": "dad91f5515bbb87a3da29c1351f397195263b81e6aad199844c81b449c063e19fae61e430ce83307046cdc56cba8d983", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665451204, "uuid": "7499251b-cc65-4371-ae60-1e4e3a4b5cde", "value": "T16B74E12139C1C472E57A3230CD72D6B16FBBF86419759A8B77E4069C4F36AD29E30386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665451204, "uuid": "76fb3d20-bb7f-4c5f-aeae-287db1046b1e", "value": "78ee95c35be8f9cbb7d14afcce7e80bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665451204, "uuid": "c1fdbf37-6d90-4453-8dbf-a0a198a31fe0", "value": "6144:Msnz1mILDHCsWv3JAy+X1W1buQKeW1I2r82+DfpiiI/jpuuJs+cN/9:Lz1mIXCsWOy+XAbTK9KnBi5L0uG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665451204, "uuid": "4373f635-a52d-4edf-9a3b-214b12f6c3f2", "value": 348672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665451204, "uuid": "51b275d2-0245-49c2-b40f-fc0a729b8fe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665451204, "uuid": "d37cc0e3-1658-45d7-b4c1-ea15a29c3f65", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b10e77-4958-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665487894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665487894, "uuid": "30ec2305-4a7a-4fb6-a6c5-3601102b3021", "comment": "Malware payload", "value": "54d780001fb006cdb32561440665a26d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665487894, "uuid": "ebe80522-2b76-4111-bae1-3a01441d46a2", "comment": "Malware payload", "value": "9de5871ad6f83b429005977b33f8a6eda90dc8ae2b543080f3eb54eb0176a9b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665487894, "uuid": "1ab74518-4c73-4d5e-ac99-ee24d470e86c", "comment": "Malware payload", "value": "a234241eb13236d66b69c62ee888e9c5086efa1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665487894, "uuid": "8fe6d68f-1122-40a6-8775-161579f04c19", "comment": "Malware payload", "value": "f4246db03d39bf609520b57b72eb61fce5572a098dcfb3d4066732399984a704db99bd6fbd06bef58ea106118ccfd4f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665487894, "uuid": "2a1652e5-f16a-4981-8ef4-6391fde3e813", "value": "T19A14913EF11FF546C6C4B578EAC5420902ABAD9C3C0CB5A47468EA21E1B6D487B43F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665487894, "uuid": "8f8a7078-1c0c-4238-b817-5895fc516a91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665487894, "uuid": "4620c7fa-bd5f-4d11-bfeb-89fd410dd695", "value": "3072:PRNZ6hAIyNDuWv4LQmEwuxNqs4UjCEqIfCYGLcayz1mB3imqQO4C0gym6:pb6hAIyNDuo4Lhim3I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665487894, "uuid": "48591bdb-613d-410d-9dda-6e1ac21a1268", "value": 208104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665487894, "uuid": "846f15c6-c7e0-4e9a-b829-e13d0ba3cf47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665487894, "uuid": "79ab4746-b766-49ca-9e9a-1922a506e357", "value": "9de5871ad6f83b429005977b33f8a6eda90dc8ae2b543080f3eb54eb0176a9b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8571505a-49bf-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665532244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665532244, "uuid": "5b02b7fa-8652-472c-a2d9-e32e331e3f64", "comment": "Malware payload", "value": "25d8d740a5611fb6ab2e6df583c24a00", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665532244, "uuid": "b17bbd45-00ef-4dd8-8487-1b7f4bfa2e35", "comment": "Malware payload", "value": "9ebb684f13367a8b7817b787a5374f9072f9338d657c255403d991f50f6ce80c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665532244, "uuid": "57aea2af-a3b1-4763-b4a1-f7e62cd0e4b3", "comment": "Malware payload", "value": "41142c72f3f37fad22b01c6bd9eaf572551ff465", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665532244, "uuid": "14d7788e-5569-40e7-a7b1-e15895fb1e49", "comment": "Malware payload", "value": "bad84ef2275064c2672e21fb87d8e4cd7d1b6475f2972119f5c9ef32b5cf153aecf88f834411557bda78a084293f3cde", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665532244, "uuid": "a133c641-59e3-4699-9016-57dbfaced226", "value": "T153F48E33B1D084B7D12A1E78BD7B9268482A7D206F74A94B2BE41E4D4F399C13E752D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665532244, "uuid": "d57bd961-6793-4fc5-a04b-d0f240530629", "value": "dc4e58cc3b4290a5b1fb2b2659f5959d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665532244, "uuid": "4a20f4ff-c8dd-49e8-9deb-c89e3ed158f4", "value": "12288:e+4QHixeljmtjVFJcPp+cygICZoxlSr9p6q6xMZXJMeGbX//7OT:5DXjmtjVD3cygICZwSJp6q6yZXJM5T/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665532244, "uuid": "b9cfb46e-18b9-4a5a-bb17-680d77b5a40a", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665532244, "uuid": "3d0b3c92-f401-4e53-9d06-8276f7a70018", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665532244, "uuid": "eda390ff-5b92-4512-833d-1e68ebf4043a", "value": "cossacks.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "186d20a2-4970-11ed-9266-42010a9c0072", "comment": "Malware payload (Quakbot)", "timestamp": 1665498131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498131, "uuid": "7feb9e82-c77e-41f0-9beb-32af927cfa86", "comment": "Malware payload (Quakbot)", "value": "f6f4f1bbe873a35bdfffffc0c00b61af", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498131, "uuid": "fbc3fdee-4071-4760-983e-0b35fee81995", "comment": "Malware payload (Quakbot)", "value": "9ef5f5a55db078bbcf60cb9750349ab35f3ef88e8c5574f23fb77a485d0ba603", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498131, "uuid": "c5305f03-c0fd-4e57-9368-e67b07ac6f50", "comment": "Malware payload (Quakbot)", "value": "7d831da7bd7aa594b4efa0f07ea9ee0748fdb9cb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498131, "uuid": "bda7daa6-3150-4246-b013-ebaa058412b9", "comment": "Malware payload (Quakbot)", "value": "f25be21f3cf35308bb54fc7b76ee9c276837f573907707d58f11555170717fb9f49f965ada6b43a49f16f05b8c433f8d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498131, "uuid": "af53f890-8d9e-4b58-8a3d-8ddddc3057e7", "value": "T17D842C87ED54DFBBC6BD81B9AA5E069F821242167F4336EB621D4190B58374333E638C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498131, "uuid": "c92d9787-d165-49ce-ba49-9b4c83340b8d", "value": "3c85ad0d25a101f6044357c668da2423", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498131, "uuid": "7a8a07cd-9c7e-4cf3-b307-32259ae65147", "value": "6144:XtgTFlqteWTBa5WsoUReNsyLK998WqniKS9jyA9yjHHXsBcfmL/p+LIORL6qYFYM:d8z4TU5WsoURzN92tniPHlQEFYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665498131, "uuid": "fa0c4203-e321-4739-910e-8ca245e6bdc4", "value": 395776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665498131, "uuid": "7a0def14-f120-4005-8f76-3e453dbf9902", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498131, "uuid": "bb5c1a1d-1106-4a1b-bc2d-5d10ccabdcde", "value": "9e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc9b0e42-493e-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665476985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476985, "uuid": "d53503b2-4689-4bc9-8b2e-3a5dc66d8dbe", "comment": "Malware payload (SnakeKeylogger)", "value": "72ffbe0718eeae21580b00f73c5215b3", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476985, "uuid": "cb6aaa96-8788-42c1-ab29-80d00eeba0b5", "comment": "Malware payload (SnakeKeylogger)", "value": "9ff6d6370927b5526f3ca9a7b7561641d23cc9cdf85d32705db64ec91c4156a6", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476985, "uuid": "e8da0760-7744-45c7-8d1d-f9e0f7473690", "comment": "Malware payload (SnakeKeylogger)", "value": "1a9daaa12c72f963a85660f63f9af6bb9203c307", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476985, "uuid": "64562b40-84ee-46f0-882f-51ee762ae114", "comment": "Malware payload (SnakeKeylogger)", "value": "873766f15d59ff963c12477ce3006e79a6009599dcde9071d9c0a17108cdaa74c76b60892fdf8670b1e86099568eef70", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476985, "uuid": "9162a319-25ce-45a2-b6d9-fa7c2a6ab5cf", "value": "T162C30114BB73C7D9D6F40FB3AC286D06D3944E058E63D7514D8B3BD32B3E4A0A822659", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476985, "uuid": "43701284-97e4-4970-8e83-03e1894f676c", "value": "3072:hZHEffJ+8CSHBQYrxoWtwa2iAaV7vkmfQLRCOU:Pqx5CpTZhUV7LfYRCD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665476985, "uuid": "8c49c7b6-8bdb-4c2e-b37d-7bd4c9dc099b", "value": 119720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665476985, "uuid": "980e5ffd-039d-41e0-9c2b-02cbbd1d5071", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476985, "uuid": "6b2b7de3-7fa9-4c70-acde-ad7f26477ef3", "value": "Revised....xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "006668a0-4941-11ed-9266-42010a9c0072", "comment": "Malware payload (STRRAT)", "timestamp": 1665477904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477904, "uuid": "ed53f9b6-3a12-401e-bc02-8de6bedfefb4", "comment": "Malware payload (STRRAT)", "value": "786fa7176633d3524fe016cfea6b6d84", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477904, "uuid": "19683ba7-1dc5-46bc-8535-d726ebb4bbcd", "comment": "Malware payload (STRRAT)", "value": "a05c06e0ee4c306780cfcf09298876941d5a94b4fdae679df4ff1f1404f8672b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477904, "uuid": "7eef753b-bd1b-4d7f-8d1e-349a83a970f8", "comment": "Malware payload (STRRAT)", "value": "960bd108a55450cfdebd25fe37400be418631f71", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477904, "uuid": "984a37b7-0e4c-430f-88d0-98549c05569e", "comment": "Malware payload (STRRAT)", "value": "22bf08d305ca63cd4616da0f9ee9bb71e816ee82de0df2cf5be08f12b337e77366de34943523b4b478d95cb074b6d207", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477904, "uuid": "04d9c1ff-6356-4f9a-bd0e-371bafa0e11e", "value": "T15EA3CFAFBCEF91B2D40360726454A273BA4C50E8C659E01FE6FD146B5F34C1A5B12ACE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477904, "uuid": "7828d1b6-933e-470b-96e5-27a4cb940c88", "value": "3072:h5Q4yEIxEydGlPNFyFNFQyCDaYIQo/YIn:g1jKyd4PfISarQ2p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665477904, "uuid": "71aa1b55-ade0-4afb-92fa-00b777714c9c", "value": 102374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665477904, "uuid": "ebbb0816-88e6-4f2f-adf6-3805408399c7", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477904, "uuid": "9dc6b84d-508d-4e9e-8abe-32e54a1ed1b9", "value": "shipment inv docs.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81506800-490c-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1665455357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665455357, "uuid": "568ce7ea-0f84-4e8d-b148-7d77e4ff3ae3", "comment": "Malware payload (Smoke Loader)", "value": "4b2b356a14e338e77abc7a8b877cb55b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665455357, "uuid": "585fca43-b37e-4b6d-8890-51a146fe7f0c", "comment": "Malware payload (Smoke Loader)", "value": "a109db9901dceab6abe903df8723c63c818181e3f792256b283fee8bd0c6060d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665455357, "uuid": "b222b8bf-33cc-4dad-a949-0cb43a27f124", "comment": "Malware payload (Smoke Loader)", "value": "6f1c0118a39e97f30a57fcc046a16b9e5ba4391d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665455357, "uuid": "e9fbbcbf-0b2e-4845-81ff-19e0f25196c6", "comment": "Malware payload (Smoke Loader)", "value": "4e12557d4c772c23ae611d14845b3f52b6dacc0a162ad45e31eaffc03087c59ec25ab56129a77461e60b289edc9b35ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665455357, "uuid": "961f1421-f9dd-46d9-963c-6d88e075c8f8", "value": "T11224CF2236D1E572E26716388C25C3B46AFBB8751A35878B7BC8076C8F352D3DE25706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665455357, "uuid": "55383ca1-c3a1-4b17-80aa-7dd67821b81c", "value": "78ee95c35be8f9cbb7d14afcce7e80bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665455357, "uuid": "b9358e5e-1d27-4370-95db-bda94774eb37", "value": "3072:H7Ho/X/DA+KheDLg+XmLRG6Pplja7gzS1TZfP+C3DyIAhB02IvKlO:H72NKgLg+Xmnja8zQh+mq02ISl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665455357, "uuid": "5bf7f344-13ab-4202-aec3-42411a764428", "value": 216576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665455357, "uuid": "96c9d862-ca4e-4c7f-86a0-d5e06a40a78e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665455357, "uuid": "0ad8d842-4aa5-4ffc-96da-d633ddd21305", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a66e46-49a4-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665520453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665520453, "uuid": "39a03296-798a-44ad-9f24-e918991f7cdb", "comment": "Malware payload", "value": "b756386670984583b420d81a546e6b8e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665520453, "uuid": "9b1bbe41-ed7a-463c-90bc-0532f9493d29", "comment": "Malware payload", "value": "a195ee80d1f41d5b736d6da3d35381e2e64b560d23ec1229f3b1877a9547472f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665520453, "uuid": "b5fdf9c7-5e78-4d52-946e-688fa101fc0b", "comment": "Malware payload", "value": "b620c7cbf83a49a021a212dded967344f5ea2f18", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665520453, "uuid": "4fd22b7c-f3d6-4eb2-8288-8215ac4a14c4", "comment": "Malware payload", "value": "fde0cc885ec0e019142ba59598a52f19e6d34a69b9cb76afa8292943992001998c845ae3cbc72a6e67c099efd756130c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665520453, "uuid": "56ef7dbe-e254-41a0-8a8c-3ba62ac18616", "value": "T14F26CF5237D1C135C07E13354976E35822B2F8678E23869B35B0B76E3D766C08972ABB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665520453, "uuid": "78b933e2-daa3-4732-a2e0-475b59799dbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665520453, "uuid": "8459ecf7-da1f-49be-818a-75986ce459cc", "value": "49152:ejLuSh3i+FtvkMzT+YiYUHVmlF8mskG+Vghm7I2IV+tpBi97UFcBCnvtlg:iLu1Yi/HoF2SHpcBsPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665520453, "uuid": "101997e6-c19b-48cc-b076-5707d44adb0b", "value": 4640000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665520453, "uuid": "a430ed3d-8d3d-4351-84e7-83a1e2338b25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665520453, "uuid": "479f8a17-46f1-4777-b6f6-e54e4d30255e", "value": "a195ee80d1f41d5b736d6da3d35381e2e64b560d23ec1229f3b1877a9547472f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dce9260-495c-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1665489657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665489657, "uuid": "bdef050f-fd20-4e04-890d-74882490ffbe", "comment": "Malware payload (RedLineStealer)", "value": "b39224ee8508f4ec162de7c84647817e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665489657, "uuid": "2e8764a9-4bb5-4057-9047-70fb40694c43", "comment": "Malware payload (RedLineStealer)", "value": "a1b07ed052e3c86bfb1342bd8f441bea258d8a9dc071e6f0055344ff2e794411", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665489657, "uuid": "f77126e0-c600-4da3-9917-b47ab4d373bb", "comment": "Malware payload (RedLineStealer)", "value": "c7827ee16f27d0979e2c9ca40d7331abc4690e9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665489657, "uuid": "625e6df8-a727-4cae-95d5-0416685117b4", "comment": "Malware payload (RedLineStealer)", "value": "cd923b687eeadf1b71fda86f98acb7e6bcade36349281d986c4bf6e8e35c99b8950440ab3acb18a3bd5ca0eb3b2a41be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665489657, "uuid": "a2182fc9-6e06-4cca-ac6f-b6ab142894b6", "value": "T14324DF2131D1C472E22616798C25D7B9ABBBB8341A39578B3BD8462D8F353D2DE3434B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665489657, "uuid": "724301b9-034d-42ae-a7ca-8c118f657659", "value": "59de72f24710a4ab3ca7e4fa2f0a3bf4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665489657, "uuid": "f00da4ad-9135-4103-84ab-0de245aeebcf", "value": "3072:gu+Mm+eBx4g/y2EKLNtQNkwMOPqEj5oYpg4Qs2CIdb/doO:3+rJU29LNSNNqi5lC4Qs2bhdo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665489657, "uuid": "a6c68890-5bf4-4380-924c-3ad7033d21ae", "value": 217088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665489657, "uuid": "0e4d52e7-6c69-4a9f-9d79-63d324717048", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665489657, "uuid": "e46dc67a-356f-4071-8db1-37f0578ed76e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe3053e-4986-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665507780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665507780, "uuid": "febfcad6-ce61-41ad-8146-3ef0c6623954", "comment": "Malware payload", "value": "c5d329fbd15ae53d4429c0a2b9811b52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665507780, "uuid": "7b0016e1-a1be-4307-90f0-3b5427a29b5b", "comment": "Malware payload", "value": "a1e35f678e9003c0fc6023451952a1e84f7544b3ef9d7b49c9fa0b790c17532a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665507780, "uuid": "40dc811d-8751-431f-91d0-9c776020033c", "comment": "Malware payload", "value": "6063a8bad5a7449fb1afafc51a4f63058cb1284f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665507780, "uuid": "1e970e41-4305-47a5-947a-ba413f399393", "comment": "Malware payload", "value": "45a916f49c43106100358dce34d8ce1ef064bda1d9fac8ee8062eb67483b676b0e2436ef84699f1a7e7c34902d99e664", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665507780, "uuid": "83cf4e47-6f94-4a1f-9d3c-fc8762d82bda", "value": "T1117633533BF98274CAE6253699E64DF230E8ACAE0B61C7937B930C0E4F79D588439705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665507780, "uuid": "c88463ee-d925-4779-8ca5-c9b23ef1268a", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665507780, "uuid": "b7927e8e-318e-4279-ab5b-5bff1272de1a", "value": "196608:91OEF5vIu50q++zJZQuTX18vpd3oeSWSf8gSoAkS:3OELIu5L++nQuTFoHSWSf8gc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665507780, "uuid": "81d2b160-d13c-4019-99aa-60adf00cd9e7", "value": 7649574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665507780, "uuid": "9bac4e87-66a0-4147-bac9-83bfe375ce4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665507780, "uuid": "516b2173-4a6d-4aad-a817-a1d0a222757c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3feef349-497d-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1665503781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665503781, "uuid": "b2e1da7d-b6c4-415f-9e05-ea1232614a12", "comment": "Malware payload (Smoke Loader)", "value": "0a9a9ab944984e01f8e0e4bb66808e2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665503781, "uuid": "0862f14a-6814-4748-af67-d932698bc633", "comment": "Malware payload (Smoke Loader)", "value": "a22469a7bfe3025561eed67e7d1516987227dfaa191351fc5a7076dd1a9788e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665503781, "uuid": "a84f0aa2-cebe-4c6f-8af9-71b288954d83", "comment": "Malware payload (Smoke Loader)", "value": "b1b7d205c338ab5181217b11bfb382268572a805", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665503781, "uuid": "06054e96-926f-4b0f-b1df-40d05d862f9a", "comment": "Malware payload (Smoke Loader)", "value": "23ffe917a6c8defe632e2cd69c4d1ccdb06afce5352d551250d96a42aab1bbfb23169c9b75a9feae35cbeb42daaf2fd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665503781, "uuid": "d5a0df53-c870-4fc8-a1de-4d2a2411c90f", "value": "T1DD24DF2235C0C873D25216758CA4D6B1AB7BBCB259355A8B7BC8376D5F323D2AE20343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665503781, "uuid": "a1262c4e-e028-4f39-9686-0dfcd94121a6", "value": "2466deca3b013302337885751cf37be4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665503781, "uuid": "dfb76348-0baf-4b25-8c2d-5b2bd8c1400f", "value": "3072:9L1umasDTzk1LFn1ct8QcDBXTko08I/Cu1JIiQrFpUpguO:9UCjWLFn1tDBD/TI/Cu1JmrEuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665503781, "uuid": "59eaf026-bc89-4ee3-961a-51d0d078b590", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665503781, "uuid": "295780f4-a75d-43ff-ab4e-c12b04b03e46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665503781, "uuid": "e06687d9-b634-4dde-a1ea-1a18914c78f5", "value": "a22469a7bfe3025561eed67e7d1516987227dfaa19135.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d5b58a-494e-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1665483690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483690, "uuid": "34a5af26-911c-441c-8c1f-48937e538bef", "comment": "Malware payload (Loki)", "value": "f4cc52e1a776614cd7f6c4da97745338", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483690, "uuid": "db8e6481-9b00-401e-8571-8880c95bd470", "comment": "Malware payload (Loki)", "value": "a26714afb609ec0748239fe0fa8cdf4c73b24050cf6b3fdc4a84dd3c10df3822", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483690, "uuid": "6825cd6f-9eb5-4407-9930-10982e18833e", "comment": "Malware payload (Loki)", "value": "9297b87d2e1d82b798c031c27d68d89d13b22c58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483690, "uuid": "71e911fd-4c95-4812-9e3f-ae78ae9ff4b6", "comment": "Malware payload (Loki)", "value": "69338e2ab41a79985262ed4a22c8f4d8ffbc9d7b04429d5d9d5abd018a5d1d6ba0302114f9d7e04485099b97a2bbe9ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483690, "uuid": "c93c911e-e2d8-4269-ab49-7492cce564c7", "value": "T1B715487A26854A07E9543270CC83D1F32BFB6D68A172D1DB3AD72F5FBC512BE9102246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483690, "uuid": "4b3fc73f-939c-4c63-a6b9-39f283d7b20c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483690, "uuid": "ef5ec1cc-9e1c-4cfa-a17a-8c6bf1acb4ef", "value": "12288:ivwNVO79b5rwlGIah26uYMJxYYXxgp8sfDplE+P4mpAQSQy4A:xmb5rwvdd7Sf9/AtQy4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665483690, "uuid": "78e8d467-6b66-4239-ba88-074c62de61e2", "value": 934400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665483690, "uuid": "aa16dda3-e7c2-4b99-b53b-7b8fc540c626", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483690, "uuid": "eab8e7df-1527-4a64-9346-27f6ad3c6816", "value": "f4cc52e1a776614cd7f6c4da97745338.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2040c2f7-4937-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1665473663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473663, "uuid": "90622aed-474a-42c7-91d5-a1c8eef3392e", "comment": "Malware payload (AgentTesla)", "value": "25be733b1453b9d11ca01d5cff2683e7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473663, "uuid": "25d6e569-0689-4c33-a281-4c9999210390", "comment": "Malware payload (AgentTesla)", "value": "a2fe02a4538de065b3462977b3df5d92691266e34412f2647b6f423693685eb8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473663, "uuid": "53e10ea6-73e8-4274-a3e0-87248ab23088", "comment": "Malware payload (AgentTesla)", "value": "6152619d53f6aebdeb06efd549ed454f9d01ee0e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473663, "uuid": "e3741f5a-a469-446c-bf6f-ea276d821caf", "comment": "Malware payload (AgentTesla)", "value": "5d697e78dfb6ea74ed621dc7c1ad08a2e32bc4deeb9e628b931b421195d10e7afe21cdcc0f107613c989c345ed0ade14", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473663, "uuid": "e1920703-d0fb-4773-b4b1-1c5b772d667d", "value": "T1AC151A1835E6719DF477CAB59FD8BCFA995AF572132F61B7106303898B2AD42CE800B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473663, "uuid": "874d9273-8d70-4f29-8ee5-412308bb82fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473663, "uuid": "bbab79b9-05b2-43d1-b60e-7271e7874d83", "value": "12288:M2iNJADqjJ5ntlMwzIQN1/qamQsV/9dSkbMPtruzc82yTqL2blnzzHfrlDQRtWso:M1fjrtlfzVN1ijVl3YP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665473663, "uuid": "d5802a41-77f9-4f69-9be4-3a0769ce3b3c", "value": 930816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665473663, "uuid": "26f3ac21-7bb2-42e1-99cd-06dd342bd260", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473663, "uuid": "f23965bc-fe17-4c43-a18f-3eb305ab533a", "value": "a2fe02a4538de065b3462977b3df5d92691266e34412f2647b6f423693685eb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50798ec5-4928-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1665467301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665467301, "uuid": "1d6682db-749a-487e-940a-f38780404f5c", "comment": "Malware payload (GCleaner)", "value": "d1eb131a161be06ef094735af04bdb99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665467301, "uuid": "7d169d64-eb37-4358-900b-a647f2b6a62c", "comment": "Malware payload (GCleaner)", "value": "a34cd84ab3edd0b697e20905af0cb8c67a2bb6ef58477a16327a23c3ff203295", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665467301, "uuid": "4788c61f-f9df-4e98-bdd5-e843a627e961", "comment": "Malware payload (GCleaner)", "value": "077495109b1739114f31a80a83ffbd3b892bbf71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665467301, "uuid": "1226b3ca-2e65-4e3d-b8a2-87534631ba96", "comment": "Malware payload (GCleaner)", "value": "1da794d8196110546ebac2ec0db2c59039b9ebc070fef39bd26b579679489e368d38753476d04aa69e24351d2ef12e8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665467301, "uuid": "224e9266-0235-4386-a365-7351da923d34", "value": "T1AD74F11239C0C472E5AA7575CD76DAB12FFBBC7415314647BBE8226C4F222D2AE213C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665467301, "uuid": "097b1bd3-f8d5-4a31-b2f7-994a822669e1", "value": "f07757163332cdbf737bafdb4614222c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665467301, "uuid": "0cbd3ae6-877a-40b5-aca7-35045e946d1a", "value": "6144:luBW+LmJrxm9mKVdzhBO8OkyTwxvswsn56UHsd479k4RO:luBW+8r8mkvBO8OkyElsw8Dg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665467301, "uuid": "dad40df9-960c-47d8-9815-9750e5a1923a", "value": 348672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665467301, "uuid": "10c0b7e4-35e6-4fde-a915-bfccc1fc5b5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665467301, "uuid": "43064a73-6c35-4b48-abed-abf3cb1272f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a684571-491d-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1665462620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665462620, "uuid": "021d0ce1-908e-4e11-8329-13fa92fe8fac", "comment": "Malware payload (Smoke Loader)", "value": "d92523e6637cea6a19120c764fcf82a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665462620, "uuid": "4fd08bca-d775-42a7-a54e-04c92c23932e", "comment": "Malware payload (Smoke Loader)", "value": "a3a2bfd26612b25ebcecf081889b529c4eacfd4a3df6c56dab48cfd83c5d3b88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665462620, "uuid": "608891b9-95dc-4a1d-b850-74873e783e1f", "comment": "Malware payload (Smoke Loader)", "value": "611e3b0191af111c8c79b172373c9f79a8db4794", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665462620, "uuid": "1d7fd6fe-abc7-4b65-bcb4-1a2119b1515a", "comment": "Malware payload (Smoke Loader)", "value": "67614b8754caef7209a5baf5056948c7e68a9a11d5ff048673c340fcd95560fa985576575ca6cdf062e161cad3227c6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665462620, "uuid": "a9247bd8-1598-4399-b533-615dbe78f240", "value": "T1FD24CF2136D0C073E26656798CA5D6B46BBFF8311A758B8B7BC8066D4F353D2AE34342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665462620, "uuid": "6108b67c-0d3e-4c56-9c02-f8909611142e", "value": "f07757163332cdbf737bafdb4614222c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665462620, "uuid": "0073c6aa-f073-483a-ac68-32df6c185023", "value": "3072:gemOO3j43+JSzLWEnDOFjRFQN36pXto7WJ16yoGBHamIGAMjefuO:gJM3+J2LdnDOFUNKRTJ0WB6mIwj+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665462620, "uuid": "ac1edaaf-1177-45dc-946d-5a37e4d699d2", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665462620, "uuid": "774d603b-cb2a-47f2-a9dd-2b4229bde19b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665462620, "uuid": "f8f1a26d-d1d7-4142-8de9-c8e9d200660b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d1cdfac-4989-11ed-9266-42010a9c0072", "comment": "Malware payload (BitRAT)", "timestamp": 1665508849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665508849, "uuid": "b74f6eaa-b3f6-4545-8887-6027a6af8338", "comment": "Malware payload (BitRAT)", "value": "1f5c1e925be09de49aa530db5c4435cd", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665508849, "uuid": "27f0697f-b2b9-4a29-9de0-03aa1043eec8", "comment": "Malware payload (BitRAT)", "value": "a447e84ff39b927c6b677fb025f89736fdc9bdeb613eed4674956f1ca800ccbb", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665508849, "uuid": "f2b9c355-8ba5-4c16-8303-1a0666d632ee", "comment": "Malware payload (BitRAT)", "value": "2bc7eba78ec71016fd77124fd5e05b7557c44b88", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665508849, "uuid": "be52ccfc-eaac-48bd-9d34-7c5849cf10b2", "comment": "Malware payload (BitRAT)", "value": "aac191e161b2aa5f396b22d76b96f3a8ffe21bc176387e43c4e8fb9267f79ed50c61b31e2fae220f570a9c0c769b3597", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665508849, "uuid": "febca81f-3597-4257-ad42-d048f1907f5d", "value": "T1B9268CE9916A44D1EC063EE458383DC747327EB38AF40414277EB9448FB79ABCD0999E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665508849, "uuid": "b489f754-4ac9-4d26-9187-0bf94a234437", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665508849, "uuid": "b2f29bd3-45d3-4d9e-bd79-81f53baced94", "value": "24576:7/MKK/93NT6JtkKM5Xqix7Z4hwinQh6LhZGGNtSzGmzS+op1jHZP4qukK0PeXAyh:16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665508849, "uuid": "086a6fc8-453b-41f9-ad1a-41d8ee60c0f4", "value": 4688384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665508849, "uuid": "e5080d6d-7d12-41e9-8c84-33a02a130d2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665508849, "uuid": "64cf6ad1-2b74-43fe-a7bc-03e5a374fd04", "value": "1f5c1e925be09de49aa530db5c4435cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50112777-495c-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665489634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665489634, "uuid": "5edc4413-f2c2-4c83-a3f3-9f7af1bfc91c", "comment": "Malware payload", "value": "750b782f7db1fdda45ef6b4dd0f7f978", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665489634, "uuid": "1f37aced-ffd5-46fe-b6fb-0885730c1120", "comment": "Malware payload", "value": "a4f9b4813088e9e95a3fcf3afb1ab97a251463dcbec3f0be74c952417282bec9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665489634, "uuid": "45f8268a-8006-4b29-b9b2-16ebd54744ae", "comment": "Malware payload", "value": "591ff2bfe48f4239b2fcd4184d5497249a261e0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665489634, "uuid": "2b10cb3c-c7c3-4645-9b46-eb3179a732f5", "comment": "Malware payload", "value": "e2e0d36592e3bfa524016d7f77f3a5afea05ce36afe80a00b04c14e9f549f0cb553a8e8414cc42f20c11d7b93b4958fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665489634, "uuid": "5d989525-eda4-4cc3-865c-79533553fd0a", "value": "T12676332638E0D278C3910EB297B24EF131E49BF40F12247B778587FB5B6D1795A2A5C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665489634, "uuid": "ce260fe4-9e36-4460-a7c6-965e6d846751", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665489634, "uuid": "2bbb6fb6-6087-4ff4-9f46-d2094f836e19", "value": "196608:91OOM3EIoWlA0cwuW30YDEilp1iuG1glHF:3OOKEIo4gY0YAU3iuGaHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665489634, "uuid": "46ab5785-06cc-439e-ac8b-7057091dd929", "value": 7599377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665489634, "uuid": "9ce58078-a5e2-4f21-9696-a2253b63f11f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665489634, "uuid": "aa6007c0-6501-422c-b91a-bab8944aee13", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22872b3f-497f-11ed-9266-42010a9c0072", "comment": "Malware payload (Quakbot)", "timestamp": 1665504590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665504590, "uuid": "5a6e2734-9a51-40c0-9db3-f8f588b8820a", "comment": "Malware payload (Quakbot)", "value": "0c6f8d698429892215f30774a8cb68ac", "object_relation": "md5", "Tag": [ { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665504590, "uuid": "ad94ed1b-1bfa-4222-9e62-d99a5c35c3f1", "comment": "Malware payload (Quakbot)", "value": "a65ef097306b63e4f950c22f75bb0ac6298528ba293fc1ce6dfea1f1948e2347", "object_relation": "sha256", "Tag": [ { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665504590, "uuid": "9357f384-8729-43ac-9a88-667d0cbdac6f", "comment": "Malware payload (Quakbot)", "value": "4599989204529ca2037905cac796fae20d0a642f", "object_relation": "sha1", "Tag": [ { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665504590, "uuid": "33b23529-351b-45d2-897b-110422829c57", "comment": "Malware payload (Quakbot)", "value": "16d308b7feda5d05ba759eeed4640c61e2463ce0b0836bbd3c40463859d544726b07af43d02cd6a046acd7915b8d8d21", "object_relation": "sha3-384", "Tag": [ { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665504590, "uuid": "dcfc6dda-46c6-4034-a7f9-f4c08a85256f", "value": "T1F7A423ECB4893FFA898EF2148505E515249CFDCB4A04919EADB705A98FDF2B341F806D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665504590, "uuid": "44380042-c202-43eb-b5e4-163cba49f112", "value": "12288:SqMlHojg4n9wFeDHta+13Luj4JX3hgc2nr7I:i+d9YaHXLujYhgc+7I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665504590, "uuid": "5b7b108e-6573-4b48-9ad8-8c1a4aac7168", "value": 475604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665504590, "uuid": "c0e3ebf2-6643-485e-a521-5d214f83e893", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665504590, "uuid": "3cb80dc6-fc30-4be1-8b08-7b6ac6607123", "value": "d4bc1382-d404-4f8f-8cf3-18f02e3ca906.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "921089c4-499f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665518521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665518521, "uuid": "5f268f0a-6fe1-4fee-8515-928e6da65d95", "comment": "Malware payload", "value": "21e09fe2054fe04803b71890d5b0da22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665518521, "uuid": "301b4b8f-511a-46a1-9905-74c3db47a261", "comment": "Malware payload", "value": "a690f0c944dcb8e5e77990140d6e0bf30f9635002ef5e2dfa61a14f1227b5dc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665518521, "uuid": "9796a832-6e31-48f9-8261-6c600f5a4f5a", "comment": "Malware payload", "value": "6f2eb30d1bcb601601cd0f43fc4bbf73f22898df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665518521, "uuid": "78a8ec6e-e310-4ce1-9163-58b138b6ded8", "comment": "Malware payload", "value": "842d54e89d1610cfa7df1ef02f37e5ede21c8f54eaf221ddc3227374331b14ed6ceeb82fca62654bc85947cc2f0ca813", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665518521, "uuid": "8779e8cd-e083-4a71-9563-6577d7e20ede", "value": "T1C6763343B9D499BEE17285325A019FF0BA76CCA81C39C4C737CA05F99B7C989C0DB195", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665518521, "uuid": "4abac316-e2eb-4bbc-8dbb-5e56294b1b01", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665518521, "uuid": "ee054de8-28f9-404e-a574-f18898bf4521", "value": "196608:91OrnH/s1pwSkzYNdfU1eI/3sZS+Lx8Kg/AIIRW2/:3OLH0kYN9meseS+L1KAU2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665518521, "uuid": "92c4bd30-9c7b-4648-bf1c-1a77044e038b", "value": 7633989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665518521, "uuid": "927ceccb-abbb-4337-a376-428b03cc6d56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665518521, "uuid": "a8939241-802e-4493-9e12-76cb48340b60", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdbd9e52-493b-11ed-9266-42010a9c0072", "comment": "Malware payload (NominatusStorm)", "timestamp": 1665475752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475752, "uuid": "a7fb49f9-7950-4570-bd9c-9e8221895648", "comment": "Malware payload (NominatusStorm)", "value": "35cb30370c11e9eda616bf0a2bfda202", "object_relation": "md5", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475752, "uuid": "c8755c0f-73db-42d1-8c22-e0795227cdd5", "comment": "Malware payload (NominatusStorm)", "value": "a6bf95878058db1b654c9d623392cc394bca44b8ed080fcca3029db83d0bd17c", "object_relation": "sha256", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475752, "uuid": "8d6f85fe-c743-462c-ba70-f5a5c396302c", "comment": "Malware payload (NominatusStorm)", "value": "f496c4dfcfbaf81c7247f5db33af6e253d5fc568", "object_relation": "sha1", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475752, "uuid": "8346deed-3140-4eea-9570-c8d3ce3b2fb7", "comment": "Malware payload (NominatusStorm)", "value": "c2b3b1247b0f411c8c5214e64bfc61bb4d3bf568bb47a2ac27168d19dbebf43042c81de5641a64dc49b9b9345b4a5002", "object_relation": "sha3-384", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475752, "uuid": "2dbbd851-ae3c-419a-8b97-2c174e40b1c3", "value": "T106D508FED3A7CD25F07E4274542212152320F6A6B873C72E374EB14DBC1EE5469826BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475752, "uuid": "fad5409e-adf2-4ede-a47e-e7fff66e8c63", "value": "24576:aWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW/:jw9MauVwbIEvtpZfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665475752, "uuid": "e3ee6627-4fca-467e-93d5-c7719a1b946e", "value": 2829392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665475752, "uuid": "fe30f8a6-c673-40e8-931c-25d7b480c5b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475752, "uuid": "98793570-1d0c-4cbf-81d2-6d5de9de1c1d", "value": "a6bf95878058db1b654c9d623392cc394bca44b8ed080fcca3029db83d0bd17c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c2586fa-4989-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1665508955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665508955, "uuid": "341b4825-207b-4b43-87ea-7e7ad9294fd5", "comment": "Malware payload (ArkeiStealer)", "value": "9f244d6da7f20c0b8b0deed3fb52b6e0", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665508955, "uuid": "093bbb40-97c3-4884-b4df-005ebf5cca1d", "comment": "Malware payload (ArkeiStealer)", "value": "aa2b5d5f5e91f673c6ad75dfdf35c33ebda273b5ca96d5d4897cb791ba23d16a", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665508955, "uuid": "234f7d11-eaf9-432c-afe7-4c52ea6d1ada", "comment": "Malware payload (ArkeiStealer)", "value": "6bf3b82c6c7027633fb99e00f7aba41e5dbf9b25", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665508955, "uuid": "30e2d84c-ca50-4d25-8d83-88e7fdc47ee7", "comment": "Malware payload (ArkeiStealer)", "value": "4276ae80b15524f948210665a7394aac85dcbcdecd03df45fd00637fc424d117af0a21f11655ffdfb1c09bbdfd8f8482", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665508955, "uuid": "f0e13a83-f07d-493e-87f1-dd729614fe04", "value": "T16174E0013580C073E2672A358C75CAB55BABFC718975978B7BF82A6D8F352C29E24743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665508955, "uuid": "c006fb47-fecb-411b-9c10-d1c8abb5c5d7", "value": "2466deca3b013302337885751cf37be4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665508955, "uuid": "12396549-f2b0-47f6-b484-3fdcffbb228b", "value": "6144:CcRDLScK8GVnOaxEuZxl5gdBAV7NGCuUMm/SQ4j:CcRDJKjnOCLl5gdyiCui+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665508955, "uuid": "1904a6d5-3205-427d-9a30-26bfe4a84214", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665508955, "uuid": "09b9e073-4e47-4bf3-bc2b-990bf2fe1540", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665508955, "uuid": "f23acdb8-5ec3-401b-9e9e-8ba0c5e62a58", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "250da7dc-4954-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1665486126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665486126, "uuid": "d0d390c6-a3e5-40bb-8ba0-4b209134f5c9", "comment": "Malware payload (ArkeiStealer)", "value": "2f303d03187136a45d99bc73ad87f37a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665486126, "uuid": "f32a97ff-54da-4a51-8df7-c4e4c391fd05", "comment": "Malware payload (ArkeiStealer)", "value": "aa577ab544b9a1309bad485ca4169fc8d2072bb28563116369408ccf53d9295a", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665486126, "uuid": "c9c517ab-8f06-4139-83c3-0863dc1f56b0", "comment": "Malware payload (ArkeiStealer)", "value": "6c7da2dfd875e2e867cf63d3aa17b238b4686f3a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665486126, "uuid": "8a2481c6-cac0-40cc-a414-2beb75619b3a", "comment": "Malware payload (ArkeiStealer)", "value": "fc136c170bcf938bb6d4522d01e888d7073e8cb0ef897e447d5da933ecb3130b6629f54965c0e6f8ff613fec7ba90158", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665486126, "uuid": "aeb8c6e1-aebc-4bb8-8205-5790ebcaa3d2", "value": "T15E24D01231C0C1B2D26666799C65D6B06BBBF8790A75928B3FD8076C8F397D2DE20346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665486126, "uuid": "8ea58104-94b1-4a0d-9c80-efc91d80a271", "value": "59de72f24710a4ab3ca7e4fa2f0a3bf4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665486126, "uuid": "db35031d-a574-4c8f-9e47-0eb194305f3c", "value": "3072:Q2+LWaeBlAg/ghUzLqys3wMOCdpUhIx67yH+vJTyiOVG45mP4lgFxg3iO:v+ypisLqysjdanhTqVG4qygOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665486126, "uuid": "f82f1e33-6b66-4f0c-85f2-404ccc3bc26e", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665486126, "uuid": "cabc30d9-2da0-4afd-83c7-31894a60d82b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665486126, "uuid": "64619a0e-c4a3-45cb-a406-1b963b607ad1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96be1b1e-4972-11ed-9266-42010a9c0072", "comment": "Malware payload (AsyncRAT)", "timestamp": 1665499202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665499202, "uuid": "bb42ffdd-2d3e-4ab5-b5cb-6630f3334f36", "comment": "Malware payload (AsyncRAT)", "value": "bb240dcac9cb0b5082636d9d98f79459", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665499202, "uuid": "725b80f6-1ee1-4e9c-9052-b5f14fc7c4b8", "comment": "Malware payload (AsyncRAT)", "value": "aae20c0fbcbb6a459929a9ebf3a27bb72064df5123db3d8a78b4087c0a0648fc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665499202, "uuid": "037f4886-6821-4a56-a6d7-b19b5362c34d", "comment": "Malware payload (AsyncRAT)", "value": "2965a18059dc4f5f69d9e48023637ea6984ac595", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665499202, "uuid": "1a85336f-6d87-434c-95cf-b27dcd89f4ac", "comment": "Malware payload (AsyncRAT)", "value": "9fcc04a762d04784ba52ac4538add2d2294a8e8973616cd18ff71254ea54189ac61fb2ffb64096051e70270abecf79c0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665499202, "uuid": "4139f5e7-0dd7-4230-bc96-63c34ea04276", "value": "T1F4256B7E2A965907D8193171C487D1F32AFBAD506062D1CB6AD72F2FBC113BF950238A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665499202, "uuid": "6eb1e36c-772b-440c-9743-e78ebaced357", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665499202, "uuid": "7443fd3c-e93d-4051-8793-91f19873b8fa", "value": "24576:+RUr+UZtr4OVMbDmWZyycNj5bj6vpFAtQy4A:BXt9IiykMvpIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665499202, "uuid": "848fef44-773a-4fe3-8243-154d191df153", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665499202, "uuid": "9867a334-ae29-45b0-a901-8b1abedfd1a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665499202, "uuid": "d540f122-9e73-4cba-a312-98f5255201d6", "value": "NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86ab4579-4916-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665459661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459661, "uuid": "16902cf7-7192-4403-af13-54d3da2f2b1d", "comment": "Malware payload", "value": "fbb42ed5736644e803e647b40d4097f5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459661, "uuid": "ae5be234-578c-47bc-98b5-ca65e14c0925", "comment": "Malware payload", "value": "aae2c16dc2b6653b0d0aeab52214aaa8a68d81a4a72d46e0319faa056b683bb1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459661, "uuid": "b934bbe8-e1e7-46ad-8925-b0cdf4379f67", "comment": "Malware payload", "value": "a05c23ac10a07dcc0fc3de48c5f5a812968f8da5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459661, "uuid": "36922472-3c6c-429a-a94c-7251d48c1c7e", "comment": "Malware payload", "value": "fc10cc6ec2a74aadefcf4a9c4839157de6c4451b720cb9f2d394d22b1675e01ddc7e1314c9def84b658c9238d35158ba", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459661, "uuid": "23e82996-3fb3-4e02-82d6-00bf78c9f7f3", "value": "T12B636C46C2D10463E9968DB3B0E39BC71BB0F20D4DE14AA7958DB01A0E8F315759BBDD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459661, "uuid": "6a241c43-112b-476a-bb87-a28a91c85ff7", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459661, "uuid": "2c42b2d7-7b2f-471c-acc9-34452f975207", "value": "1536:6V49vIH4pga/eHUTQQQQQQQBdBgN6b5/2kWSC6WLrxtDvas:AOIYpga/eHUTQQQQQQkdBft/2YWLrxtf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665459661, "uuid": "c3ce0464-ba6a-4c61-a783-05312efa6a19", "value": 69176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665459661, "uuid": "902fcd64-b37a-4e13-9fd5-d99ae3189ae2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459661, "uuid": "d8426304-de72-4c8b-8216-1e701ca6fa1c", "value": "SecuriteInfo.com.Trojan.MSIL.Inject.10208.32073", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d0a72f-499b-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665516860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665516860, "uuid": "3349fc9a-8a0c-4c54-b575-f6c9bfcc3251", "comment": "Malware payload", "value": "8fdc97c88101719c85dfeab859ad58d8", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665516860, "uuid": "9cdf8555-b86e-4efd-9d39-6f1d36471103", "comment": "Malware payload", "value": "ab3ac2a34c3a3641a1cb1a52d615cfb50cf308e90ed4acea48a7cd1a0fe92c40", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665516860, "uuid": "60f00a99-495a-4ca6-a85e-1dd0f2e22988", "comment": "Malware payload", "value": "59984878131f35bfed85a5f9f3464786532e9220", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665516860, "uuid": "bf6bdc47-78d1-4325-af9e-e80e6bad4585", "comment": "Malware payload", "value": "c26492932469cb44aa576f3d7bae6e7b69d8c49e2e6fd61770ce2543e617cc5811eac7a28819b6fd94e6f37cc0ebd8be", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665516860, "uuid": "ff4a23a0-1fd0-48b2-89b3-84ab8e6d6494", "value": "T13515B623A3440372C6630275AB4E66D6F328D0BC73659664A49ED17D3342CB9877BBF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665516860, "uuid": "0a07b96d-c24a-468c-9658-513164cfc8c8", "value": "24576:/Qy9woBwJwJHcVlBZkyFvIJPjhslVlBZkyFvIJPjhszwoBwJwJH:V9woBwJwJHcVlHkbjhslVlHkbjhszwoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665516860, "uuid": "c533009a-7b72-46c2-a293-d7baf9ba3c48", "value": 919552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665516860, "uuid": "9706255d-5c1e-4b5a-bc4b-e343c42b6e5c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665516860, "uuid": "f2b9af5a-6a63-493a-9958-0d4d416458c4", "value": "invoice.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a6947a-4961-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1665491707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491707, "uuid": "6a8438f6-3a12-49b8-860b-97e2f801c131", "comment": "Malware payload (Smoke Loader)", "value": "76d48e03c4195db4e5189c86d6394401", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491707, "uuid": "c086b210-2fd2-471f-8b35-d1ed1f2c5fc5", "comment": "Malware payload (Smoke Loader)", "value": "ac6d326f7757f0eb840b0d3793da580204ac7b100c8de9b967c4b71102c68b8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491707, "uuid": "17c2b8cd-7463-4b3b-8e8a-d984284b2d20", "comment": "Malware payload (Smoke Loader)", "value": "0912a768a967958a60beb920eb08e82cf833f336", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491707, "uuid": "4ed34734-9ec0-4b22-8dd3-76778c56c329", "comment": "Malware payload (Smoke Loader)", "value": "95d54a6cfd5c8bcfc407f582b20cb117c991e19f521d2190c83099c81146f34abba49a001698dc0b2a735bd01cb6a3b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491707, "uuid": "9c85de76-2e82-4ec3-9659-2f99c7bb0d2f", "value": "T17A24CF2236D0C032E66252388835C6B47BBFBC751979968B7FC84A6D4F353D2AE35346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491707, "uuid": "6ec90603-67ac-4d3f-bc03-73a2f3c2cfe1", "value": "4db5fa00d6d53e828ab0bf90238303f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491707, "uuid": "ccad868d-5489-4a32-b507-c1d85dcc4bf1", "value": "3072:z1jEU8fC4VULKBLsKqNt8ksc7cfKvgstzsIJoFc68E7Z4O:zVLn4LsKqB78KvlFsIaK6hS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665491707, "uuid": "b8859b75-bb15-40cb-8052-f6aeae6482a7", "value": 216576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665491707, "uuid": "a906d9eb-f05c-43cb-bc68-31b5077aba2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491707, "uuid": "be64964d-7188-41d2-9b38-c32e79801886", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e21c84b5-49ad-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665524669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524669, "uuid": "9498a070-7c63-4f4f-94e5-6f6c41857a38", "comment": "Malware payload", "value": "0dfba86be0820f37615c7df9a9c100d4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524669, "uuid": "cfa1f30f-b06a-45fe-8b80-7bd1ca40c74e", "comment": "Malware payload", "value": "acb2ca6614edca674ea683921bd412c498138d4e6af47a2c79641b0e3c54ed0e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524669, "uuid": "fa3c9f25-e852-4efc-b054-4c41a0c911d9", "comment": "Malware payload", "value": "6e732625f4573b5973acaf1023baaa72166c9e41", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524669, "uuid": "51b8ddf6-d674-4ed0-9c30-00168dadcab1", "comment": "Malware payload", "value": "43122e1b0ada9839b8ecc4ec1c8182f7d1e4265b8a850348a3850e910ecb91beb999b4fb93c15a3413d5ca446ea62d86", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524669, "uuid": "69a26e19-3e8f-4443-bb52-a9d887720ec1", "value": "T1EC440A0173E48625F1BF4B3B4E77E7140632BD529CAA865F7148635E6D313A08DB2B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524669, "uuid": "84a29d4b-32c6-443b-aaa1-1e8b594d5f35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524669, "uuid": "efa95bb3-7ba7-4cbf-adaf-fd99e07caf2e", "value": "6144:e98L598L598L598L598L598L598L598L598FHPAqYvr6yRI7:lKKKKKKKGW6oI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665524669, "uuid": "6996c673-af0e-488c-be65-96db40fb30a0", "value": 274528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665524669, "uuid": "1ed488d1-e189-4433-a55c-588b424445d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524669, "uuid": "74846fff-a877-4450-bb2b-f0714f95f79d", "value": "acb2ca6614edca674ea683921bd412c498138d4e6af47a2c79641b0e3c54ed0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7393a960-493b-11ed-9266-42010a9c0072", "comment": "Malware payload (LokiLocker)", "timestamp": 1665475520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475520, "uuid": "a2382777-5cc7-4779-98d4-219c160eba51", "comment": "Malware payload (LokiLocker)", "value": "d647220db85f6557e262ada99919e9f2", "object_relation": "md5", "Tag": [ { "name": "LokiLocker", "colour": "#CA143F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475520, "uuid": "8c8e2841-9763-41ac-a782-b3de0c6bcba6", "comment": "Malware payload (LokiLocker)", "value": "adb6f8d52932e656f3b129d4f31104426b39c1c6521e23a59108ee3f7990ba91", "object_relation": "sha256", "Tag": [ { "name": "LokiLocker", "colour": "#CA143F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475520, "uuid": "711b82f1-e533-43c1-a2d0-24da950e38f6", "comment": "Malware payload (LokiLocker)", "value": "5fceb3f1819a994b22f3f83084ea50e540d9f8e4", "object_relation": "sha1", "Tag": [ { "name": "LokiLocker", "colour": "#CA143F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475520, "uuid": "d00e8189-e8bb-4cb8-8c44-9aec2409c25a", "comment": "Malware payload (LokiLocker)", "value": "b95e22515900347ab95cf2c469e936e4d821840b6f6e35aa43d707fc39217b3d07fe19a0dfe24be16f8993b5689aafe2", "object_relation": "sha3-384", "Tag": [ { "name": "LokiLocker", "colour": "#CA143F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475520, "uuid": "7f47d8c2-d7b0-431f-bd1a-d94f36f2b161", "value": "T1A4E49D5253E79E22F3B786FD99B152348722BD97E636C31E338145C42E30758EE523A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475520, "uuid": "c5310a40-89d0-4ba1-b758-3a6ae23a72b2", "value": "12288:hkr/10xl0PFS4jwbIsO/arlTT6zncVUJ7vndkrL:ar/10xl04EOIH/cTT6DNGrL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665475520, "uuid": "8df7d29d-53e1-4867-9114-4fc309d7f86d", "value": 676074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665475520, "uuid": "ff0759c9-f2d5-4cee-8f9e-a6541ec4e581", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475520, "uuid": "0c71d5b7-ed28-434e-864d-93a95b69f72a", "value": "adb6f8d52932e656f3b129d4f31104426b39c1c6521e23a59108ee3f7990ba91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0689dd44-49a4-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665520435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665520435, "uuid": "ff17d9c7-bf85-4eaa-bc19-10171dbcb405", "comment": "Malware payload", "value": "caabd009c205efd248f4ea4a7886ca96", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665520435, "uuid": "a0bfb84b-5ef6-4ec0-bfa6-a1f41937c7d7", "comment": "Malware payload", "value": "adbbe0406d7ec2a712770ed96df69883c358b776c317ab579f7ebe66f845f155", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665520435, "uuid": "6b93b0d2-876c-4e50-9aa2-0cd6d254b965", "comment": "Malware payload", "value": "0ecd7f1145a0f1558dc0222bd7c91e42bd00bdc0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665520435, "uuid": "2ea3774d-ac4a-40f3-be89-78a9b0776eeb", "comment": "Malware payload", "value": "133a07ddf60c982b84d3eb6483fb84779d1df68460ed24139b4e0dcf51e6c7b3edeb537375487c698b7a921c0b58f8a4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665520435, "uuid": "c758ed99-3010-4c68-8078-5a54947d4331", "value": "T1A396AE91BBD28264CC5FCB30446B46CA26707F127F1283FB6650365E2D32BA8857D7AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665520435, "uuid": "9297e6f0-62c3-4855-85dd-22b61f10cd9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665520435, "uuid": "900f7f54-aacc-4832-abe9-6500946307f8", "value": "98304:RLu13/Jk2Ph05KwFFClurxUTkCOS20BYql7x+oZHcV4i/kgE7/FG4l7zP3u+0xZ3:Rikgc+cqG0vGfLgc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665520435, "uuid": "97122e8e-0c76-490f-857c-48d0cce8506b", "value": 8655344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665520435, "uuid": "be9cd8f7-f7ca-4fcd-88d0-58e063d42ba7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665520435, "uuid": "e9ceccb5-490f-4349-9c50-b6d98f317f06", "value": "adbbe0406d7ec2a712770ed96df69883c358b776c317ab579f7ebe66f845f155", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f0f91e-494e-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1665483661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483661, "uuid": "b2fade2d-3804-4816-8a3a-48847662f38d", "comment": "Malware payload (Loki)", "value": "9557862d3d1137a5d961c5d77c65e959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483661, "uuid": "6ad0c335-589b-426c-adca-af6fe1703bb2", "comment": "Malware payload (Loki)", "value": "ae93471cafc5101d93e78eef81093dbcfdddb8c2d73c3bf12fdc95fdf675d3d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483661, "uuid": "1bc5368c-770e-448b-a842-68980569cc2d", "comment": "Malware payload (Loki)", "value": "70b47d08c58ad8e82de374dfb467c18f80463c31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483661, "uuid": "7cbe070a-6d9e-4ee1-9c3a-0573e2a959ce", "comment": "Malware payload (Loki)", "value": "79704e22c290556fa47f60783ffc075e8178574d735fcbdde213fa00d0a543e72ecb53bb3789b1fa9b82de1959d54c60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483661, "uuid": "5b54871f-1417-4081-9142-ac19e7161c03", "value": "T1E825497E25964903DA543131CC83D1B32BFA6D68A272D1DB7AC72F1FBC512BF950224A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483661, "uuid": "da309ea0-f51b-412d-a075-83d2aecddfbe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483661, "uuid": "9e00e7f7-f322-464c-a08c-03ff055e8f22", "value": "12288:I5PToyUsk/loCQFqbWsNtMJC4PcQydWH23AZYRAQSQy4A:Iyj/EFqCsNtMzW3AOAtQy4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665483661, "uuid": "bb2c867c-670b-4863-9daa-b1a47a638379", "value": 991232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665483661, "uuid": "678bc56c-e9dc-40eb-ba30-c9c945888df1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483661, "uuid": "3e7ee99a-45ef-42de-8e39-8a408488c847", "value": "9557862d3d1137a5d961c5d77c65e959.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df08452f-49ac-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665524234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524234, "uuid": "231789df-9c67-4548-831f-324a563e30ee", "comment": "Malware payload", "value": "9dc72e68ac98e04b763e4b2cc897bf1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524234, "uuid": "b87f4fcf-af59-4c16-8da2-d4c5ec77c288", "comment": "Malware payload", "value": "aeb59c8b8f811286b38777789e4917668f76793969fb13c2be4f368f26f23630", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524234, "uuid": "ad37d250-1eb2-4efb-886b-b1fe4e93a5e2", "comment": "Malware payload", "value": "84bac13193e63dc7738880c98570de9f9aedaf0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524234, "uuid": "b25bc154-1341-4ffc-af81-85d6dda868b3", "comment": "Malware payload", "value": "0c72b8e6f4b1af7d2ca04ce58c071e601df318a99714959930896df4d251baeacafb4e5cab37f3ca828bf90a5b3933e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524234, "uuid": "bced76a2-a525-4b29-9287-a8e4240648b0", "value": "T1D724CF213580C472D25229758C68C7B56BBBBCB1A93457C77BD82B6D8F322C29E31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524234, "uuid": "78f0cdc5-4f6d-4d88-8553-daf7b0486120", "value": "e680a2b40b54e6ebf1523763588728dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524234, "uuid": "4947fba7-6d12-45a1-8d47-e5fde8de874a", "value": "3072:dhp2a4Msgfsk/L9N0IAGsiDScroqt55Wc7RPGWxJO:dz4uhL9iIhDSot5Wc7RPTxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665524234, "uuid": "8ff079c0-fa96-471d-ba1f-a9609936fe76", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665524234, "uuid": "50e70ff4-b069-4a6c-a94e-5e12227d37a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524234, "uuid": "3a61d870-d2a5-44c1-9659-f3b1f7702e84", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db28fcd0-4918-11ed-9266-42010a9c0072", "comment": "Malware payload (WannaCry)", "timestamp": 1665460662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460662, "uuid": "def560a4-e2cf-4832-9e1b-de9e7704830d", "comment": "Malware payload (WannaCry)", "value": "18f04f3fdcfc7974cf9d2549e515fee9", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460662, "uuid": "8c5caff8-b9c7-4600-bc20-7dfdb80a05e2", "comment": "Malware payload (WannaCry)", "value": "aee6ea06bd64f629b2f5726c4060ee6ebe4137f6561fa8ceb4f16f08e326e4cd", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460662, "uuid": "222ec6ef-b599-4a42-8167-8fcdbfff13fb", "comment": "Malware payload (WannaCry)", "value": "6ac10312858ff0fa47beef762552ff55810d52d6", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460662, "uuid": "b35a35be-f1a1-4a5e-899e-22b960204a54", "comment": "Malware payload (WannaCry)", "value": "b3289c99b1a22626c478fdda45bb85e5014625ac31ccf63fdd52786c9c358fd84141cbd8fc1e1e6a418c61018c3d3cb4", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460662, "uuid": "942b67d9-5d8a-4e52-917c-270bb8219b16", "value": "T14C363348F9F495A9D30E2D7008E7D66A72723C8B17AB692FCF0089A71D4379D57E060B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460662, "uuid": "fd25b614-84c5-4561-a765-9ef76ce6f6f5", "value": "9ecee117164e0b870a53dd187cdd7174", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460662, "uuid": "402b7d72-bf65-42e6-90a8-cac9c54b7ea6", "value": "49152:XnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEc:XDqPoBhz1aRxcSUDk36SAEdhvxWa9P5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665460662, "uuid": "3041dc56-8cdf-4fd6-881c-96e5f9e4e583", "value": 5242876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665460662, "uuid": "c9e49bf7-6210-499d-a1a3-d64dd4ce17e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460662, "uuid": "5047166e-049f-4765-920f-9fddee8c54bd", "value": "aee6ea06bd64f629b2f5726c4060ee6ebe4137f6561fa8ceb4f16f08e326e4cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ebc1388-4934-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1665472479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472479, "uuid": "f03a2c3b-c51a-4d3b-a237-ce7cd0e352f6", "comment": "Malware payload (Formbook)", "value": "3126252a037ad81626545b520dfb2add", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472479, "uuid": "bf8294a8-106d-4c8f-b888-99b80894e625", "comment": "Malware payload (Formbook)", "value": "af32e8b62de48289c78883d9616cc57bdca4774e102ec3ceca462c77886cebce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472479, "uuid": "4819b52f-8f42-42e0-bd4b-b4152e023243", "comment": "Malware payload (Formbook)", "value": "68cb8b8c30667d7bad795b64758253252be58621", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472479, "uuid": "99b606de-4096-4bbc-af89-4e8a2301fb9c", "comment": "Malware payload (Formbook)", "value": "edd4daccded5785cc4fbb53ba0f6ad7bf75d7056dee8cf1eefd97892a78fc5bb68c53770f0b65c4ed3ef4ebcf4543ee3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472479, "uuid": "38038bcf-322a-4289-95d2-ce5279fc733e", "value": "T1B8F4E0270BEA4B0BD125B7B894D1C3F6A3A9DC01E467C3876BCA9C1FF08A661C760755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472479, "uuid": "6aa11cfb-777f-49d0-a964-9a9ee0a63f2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472479, "uuid": "25850e50-8480-464a-b5af-96fd5b86ec1f", "value": "12288:kAx2iNtbzIxc8ikgFfhb53skIFG5107UcGNjEDz7w7iTIDiOQt30:H1nzIxPYhb5aFs1BNjEn7nIf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665472479, "uuid": "686b2350-91c2-4ac0-b301-cbbd13624f25", "value": 783872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665472479, "uuid": "48dd3af2-c4ee-4eaf-b497-0c05c789de6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472479, "uuid": "f2ef0e28-4a09-4acb-b894-0355afea4012", "value": "af32e8b62de48289c78883d9616cc57bdca4774e102ec3ceca462c77886cebce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa4a627-493d-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1665476230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476230, "uuid": "9d13bc8f-d739-4572-8e65-0c642229b2ef", "comment": "Malware payload (Formbook)", "value": "3b0c5b4eed9f2222f09e61efaee554f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476230, "uuid": "4e0c47cc-06ba-45d7-ba33-b7de324ef97c", "comment": "Malware payload (Formbook)", "value": "af4e4f24d35ee2d2d5efdfcaff5d9b5c0b6173165d66e5e22ff44c53e8a316f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476230, "uuid": "458a0a0b-0c7e-4e91-936f-b9f5f038b3e5", "comment": "Malware payload (Formbook)", "value": "c32cc7642bc141b6ae804d620d663a41cd5b76b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476230, "uuid": "67a5daac-ca9e-4504-999e-cdc2f4fdc905", "comment": "Malware payload (Formbook)", "value": "2115347414cc0be96a33af6f342a2b75b4f5e5b69cd8922923ab613766c5dc58fa68f8e17b9837eefc22d280dcc0d2cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476230, "uuid": "8bd69010-beac-4c6e-90d0-f9d52863692a", "value": "T133258C7E16994607E8243274C893D2F32AFBAD606061D1CB5AD32F5FBC552BF921334A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476230, "uuid": "ba01ed93-93f1-467b-856e-a9b9655f9d86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476230, "uuid": "25d0153e-d0db-4af1-b66d-58710c150e09", "value": "12288:xIwDxoBuee4EFJcwoeyKeXZca1AJlQo74xjtDS3lAQSQy4AB:HK44EuRFX+qqlgtaAtQy4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665476230, "uuid": "9ebcfc10-b8e5-4b1e-aa5a-01ca30330fea", "value": 1014272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665476230, "uuid": "cd1aa42f-9b6c-4219-97af-dc05f38d653c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476230, "uuid": "ce2bed0d-b78e-4d0b-a6d9-6f955e687dea", "value": "SecuriteInfo.com.Trojan.Inject4.44941.14960.17808", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "796112ad-4938-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665474242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665474242, "uuid": "c8fd8994-f8d1-4aa1-afbd-8fed6c9d19f9", "comment": "Malware payload (SnakeKeylogger)", "value": "d602502b3f2e8f1b6ab53efd7b5e7383", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665474242, "uuid": "1e46ce15-8f69-4e2f-b3bd-12982c4d92af", "comment": "Malware payload (SnakeKeylogger)", "value": "af9261c21a9b9a00e12aa2b1bfd4777c7c6abb2b837cf9278d105f522f4a566d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665474242, "uuid": "1e988bc8-07a4-4a56-b8c4-b0cdaf65b6ab", "comment": "Malware payload (SnakeKeylogger)", "value": "631841bb846945bcf9369f66e6307b7cf3fa8c46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665474242, "uuid": "ecc873b8-5e5e-4546-b134-c17d842c135b", "comment": "Malware payload (SnakeKeylogger)", "value": "61f9343470dfa770aec89eb97c8b0f2eca022b684081d0bc1c470a05a96934009210a603ff2f323e5575ee290ec62f11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665474242, "uuid": "41c34da6-29d5-4dcc-a1c8-0689e4288e78", "value": "T1B2255CD2A1908C9BE86B05F1AC6AD53021D7AE5CA4A4C10D56DEBF1B75F3352209FF0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665474242, "uuid": "f82cb806-c60e-44b7-8cb7-7454eed4f4de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665474242, "uuid": "b21839ec-f501-4b1c-9957-06039293e439", "value": "12288:6AS2iNJ1awAuumfZAxnoysxttTYrAyp5V5z0rjjibE8:215WuumfCxnzKtuUe5VCqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665474242, "uuid": "6b2f8aef-89f2-4859-bc46-a146b6da4f13", "value": 1032192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665474242, "uuid": "f5d70348-d60d-404f-82af-c5bbff3e7367", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665474242, "uuid": "b6e06602-9f78-40c5-9b6a-b15ae0881d6a", "value": "af9261c21a9b9a00e12aa2b1bfd4777c7c6abb2b837cf9278d105f522f4a566d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e474ab6-4955-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665486732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665486732, "uuid": "d4ed5940-4a01-4c96-841d-e99db2243143", "comment": "Malware payload (SnakeKeylogger)", "value": "50c863f01cf040750231d954e73dcbf6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665486732, "uuid": "5aee24f7-0269-4339-8f33-1e862027168d", "comment": "Malware payload (SnakeKeylogger)", "value": "afae56ccb5ceb87d28c33dcf87270f668300cc79f42756759844f664f67b933e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665486732, "uuid": "f59d9474-7e8d-4280-96eb-b1df0208a0f9", "comment": "Malware payload (SnakeKeylogger)", "value": "437b60ba372e8106c1495a52607d5c90247ab399", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665486732, "uuid": "8fc58009-5d02-4865-a229-239f4a821670", "comment": "Malware payload (SnakeKeylogger)", "value": "0caef2756bc4c301e231fcbe0f5c1e8a2c73edcf06ac3f797580e31ff2fd5b3d5fd36b0b4a408e721bb5f72599e4015f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665486732, "uuid": "347996f2-97a9-4fbd-a296-5e7d052ac803", "value": "T10425597E19854A06E8263274C493D2F32AFBAD606060D5CB1AF32F6FBC116FF9542356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665486732, "uuid": "40aa9b21-31e3-435c-af6f-a1f575a577a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665486732, "uuid": "6d0980b1-eb5e-49bb-a094-6ce484f21a77", "value": "12288:alwFO44sKWlsagPFlSQ28++nXejVQiSkN0m6jZUAQSQy4A:I44sKWcPFR2eXamqAtQy4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665486732, "uuid": "e1a724d1-3c4b-473c-8320-40d75f72c849", "value": 978944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665486732, "uuid": "a288acca-90f5-4121-b203-4aee9e476f3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665486732, "uuid": "1c7fe087-7d04-49ef-b3e2-061db457770b", "value": "50c863f01cf040750231d954e73dcbf6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22dc5120-48fd-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1665448756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665448756, "uuid": "40fc69e4-bef7-4af9-b6b3-fd5771197d91", "comment": "Malware payload (GCleaner)", "value": "c983bb337a13c4ef7fcf53519f730b45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665448756, "uuid": "154c8d7d-2da0-452e-9285-a1e83ef012e7", "comment": "Malware payload (GCleaner)", "value": "b000347178c5645b8691fe97b3fab986fbac71012f2645898b7d6b315df41fea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665448756, "uuid": "79470217-20e9-45fc-8d29-e278c6e2778b", "comment": "Malware payload (GCleaner)", "value": "9481397fc3d2ec0f21dda2dc71bc71a446297967", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665448756, "uuid": "07b07a20-3193-4dc5-bbcc-07cdb739e712", "comment": "Malware payload (GCleaner)", "value": "d864e36b0a0c43d85e2ad5c6fb003ada7055f69b666e0d8aef104d179d1dfcbe27d92e0af7a09a425f4da1dfd393d9f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665448756, "uuid": "2424bd5d-0355-4b8b-ac66-0f838887a93c", "value": "T18574F1213980C031E96A6174CD72D7716FBFB87516364A87BBE812AD4F367D29E30386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665448756, "uuid": "eb93d42a-905b-40c5-a2c6-9c390393cdf2", "value": "78ee95c35be8f9cbb7d14afcce7e80bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665448756, "uuid": "42115f5c-c5e2-4ba3-a8bd-f29285efb14e", "value": "6144:IshwMLLKwLBt4hrddwm9djG70BXwFAmq9UzCh2/rONkfOR8Bqp:IshwMvLL49dLD6gBXAFqmzeNi3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665448756, "uuid": "f7eff956-bd70-4704-b984-a5f96200486a", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665448756, "uuid": "79a1a0a7-fdb9-4e97-9d8d-f81e9e306243", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665448756, "uuid": "fd8029b2-224b-46d9-9edd-94a4ede718ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a5dad0-494a-11ed-9266-42010a9c0072", "comment": "Malware payload (NanoCore)", "timestamp": 1665481906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665481906, "uuid": "501b9c87-c06a-493a-b731-0d5e0df669bf", "comment": "Malware payload (NanoCore)", "value": "35e0c0fe9fbec6f870542d34703544a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665481906, "uuid": "de8d5149-36c5-4e3a-a805-69d6127a232f", "comment": "Malware payload (NanoCore)", "value": "b0c5a3e2456d9df495e299db88e2431ab0133ea2327d885f6234ecf8ba5805e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665481906, "uuid": "fd5392b7-212b-4e78-a763-76280559782c", "comment": "Malware payload (NanoCore)", "value": "c11b28d1a26745b9eb19f84619d1362c64d05df8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665481906, "uuid": "6df98d53-1e6b-4c65-a200-50c057642876", "comment": "Malware payload (NanoCore)", "value": "b560bec1930b4cb1cdb675817aed5f0f242e63182e7b0847dc09ac4a64f769ea603b80b1fdd84aac8e4496aeec2b13c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665481906, "uuid": "12251c12-cd5b-4a0d-92f8-51b8f45e3d89", "value": "T1A6451213B7C684B2D1722A306939E7167ABC78301F24DA6FB3D05D6DDA749C0A225B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665481906, "uuid": "9374dba4-ad14-44a7-9eaa-10152c336371", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665481906, "uuid": "9be7994b-8247-4bae-8e75-ad7ac7a209e1", "value": "24576:0AOcZ2i7H0AknChev6tUM2y0waKKV8gyUcztVqEubl83o9ZkbgH:iG0Pnx5yvqV8gJWfqEUU2ZkE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665481906, "uuid": "0bd8e640-e299-4f80-a1cf-bd5d329d7963", "value": 1244367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665481906, "uuid": "5a70bdb1-e592-4eb5-a0df-709304923b98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665481906, "uuid": "1b309c5c-4da2-49e0-b901-b6f1983c73d4", "value": "NEWORDER736648833.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03026ef-4913-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1665458550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665458550, "uuid": "b7a22c46-8946-486d-a045-91f224d4fc63", "comment": "Malware payload (Formbook)", "value": "02cf22ca0694d9407fd0e3b268d956be", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665458550, "uuid": "b7574cfb-4359-4b7f-b236-bce6594bfd5b", "comment": "Malware payload (Formbook)", "value": "b161882346a8b3d21627b392ed9f58ef14374d10a76a1a34fc59a50222ad041c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665458550, "uuid": "2a9999f1-b89b-468e-a250-4a349b34a04b", "comment": "Malware payload (Formbook)", "value": "902aedb770e443d331f2a86689c47cb31fa15eb4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665458550, "uuid": "a7685fd4-24c1-4617-8a50-d0fcc2287388", "comment": "Malware payload (Formbook)", "value": "8119f6395a1bdef034bd5a43ea7d74b5474b4fecb8511d89ed58a93a7b3cb1f050d556d6f5770c4c98a8c1160a20ea51", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665458550, "uuid": "448a1245-9e09-4938-9f9c-b1372215e71a", "value": "T129D433A93A425152AF7ECA3D9F73818EEAB144F104C0F0B3C757AD5E143864B4DE9AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665458550, "uuid": "770a9784-c3cd-4ce8-9c44-7562df710037", "value": "12288:4a/DECXepq7OGD79kqT+lOp/7Au/O2Sb1f9Y1rlpjjDHV:v/o+FDxT+lcTb/OpbqrnHHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665458550, "uuid": "d7270ddc-9e98-4a18-a34e-f0ec90ae595b", "value": 620468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665458550, "uuid": "8b56eec5-269a-4a04-8142-0b2fbdaed336", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665458550, "uuid": "93403e8a-3a07-4e3a-9fd5-bed760c6be9b", "value": "12-03-303-930290292.LZH", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7468d8d2-4947-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1665480676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665480676, "uuid": "6dee1a80-6f1f-4ed3-8737-fbb024ede3e6", "comment": "Malware payload (Smoke Loader)", "value": "7a14753737a3de00a01d7c0bcfa52230", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665480676, "uuid": "10539d24-eee3-4314-b23b-d72ea3725fb2", "comment": "Malware payload (Smoke Loader)", "value": "b1c6801cda370f55a29b629e62f46c899d57494c6dd2bf7583c4f17e1a4bcaa7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665480676, "uuid": "735eb4df-b726-474f-bbab-0ce2e9828da7", "comment": "Malware payload (Smoke Loader)", "value": "f55cfee97f76001ceb503809570faaa744886d5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665480676, "uuid": "2cc4def8-bcaa-4fba-87bf-e19cf59f6883", "comment": "Malware payload (Smoke Loader)", "value": "f199de765e4beede3519db7b1c26a23af70325ed50071a9bf1149633aed5fa1b05ffd50a9992bb689effe73996aa38f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665480676, "uuid": "2f7aa0fb-d01e-4ec2-8b44-1ecea8e20974", "value": "T1C924D02235C0C072E2670639CC65D6B56BBBB8351A7A578B7BC8076C8F353D2AE25343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665480676, "uuid": "a00f14ed-5f80-4c5a-829b-af8673581e41", "value": "59de72f24710a4ab3ca7e4fa2f0a3bf4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665480676, "uuid": "84d1d569-c4c0-4d77-b70e-15b801e53503", "value": "3072:DL+LnYeBWWg/7JqDLndDrwMOHk6oqJbHjcgz3mMEZV7msq4ik06PpO:X+z0jJmLndDgzR6L37K2p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665480676, "uuid": "a3dd4c97-c1b1-44bd-87fb-6b4b10210f92", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665480676, "uuid": "280db5f9-dcf6-46b4-b25e-4c7a341878d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665480676, "uuid": "7ac96931-fb4e-472b-9353-002c7a9477be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053c3e9d-493d-11ed-9266-42010a9c0072", "comment": "Malware payload (BlackShades)", "timestamp": 1665476194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476194, "uuid": "9ad0d584-d3a2-4a7d-9d94-a98c9b4ba780", "comment": "Malware payload (BlackShades)", "value": "573fac8edc720f62c90eb8a1cb50a250", "object_relation": "md5", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476194, "uuid": "6cb50590-134f-4fb6-b9f9-d08f906920c6", "comment": "Malware payload (BlackShades)", "value": "b4dbd5d511767b205f77f9337ab8564d273c9c88d5a1ee1a4edddabfb8d0672a", "object_relation": "sha256", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476194, "uuid": "3ce17ded-632d-4d6a-9239-27e3aa446a05", "comment": "Malware payload (BlackShades)", "value": "31224b52276789a52d45f21c090adb9794da7cc1", "object_relation": "sha1", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476194, "uuid": "7f98f9e4-936e-4d27-b576-9243e8311a62", "comment": "Malware payload (BlackShades)", "value": "d68a434e0423395d550ac3a3105db3876e5e035ea5feae8077fd90edf86efe9d8e5708f633a57174b34bfb3071ba0cef", "object_relation": "sha3-384", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476194, "uuid": "f2750d5e-a81f-477b-a896-b3b7fe762baa", "value": "T1126407F193F79E36F0AD1278DC20411586BAF82676B3E76D6F48246C6C0EB446141BF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476194, "uuid": "81657cee-01b3-4c9a-9e4f-0b137a5690be", "value": "3072:sCGDAz1qop1+Bs/dOBg+rgESSN8Cz6VvYW9XYTPIZihyUxjMFbuydFYllbk5VIYF:sqZYBRSSmCz8vlmiO8bDcllbkw5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665476194, "uuid": "39b0ffcd-f4c3-4017-96e6-4baf4a226f55", "value": 318823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665476194, "uuid": "d791da12-69d0-4c3b-a952-d522d1eed076", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476194, "uuid": "67eb0e4e-6c40-415a-899e-2e594e007ed5", "value": "b4dbd5d511767b205f77f9337ab8564d273c9c88d5a1ee1a4edddabfb8d0672a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d796f64-493d-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665476450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476450, "uuid": "a3e558f5-231e-413c-a79e-e576daf9bff2", "comment": "Malware payload (SnakeKeylogger)", "value": "ed4e3c0d723f93ae87659f5144223301", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476450, "uuid": "20dd208b-860a-44e5-a2e8-deea35bd8be8", "comment": "Malware payload (SnakeKeylogger)", "value": "b502ce5bdf6d7ca5ef654b5d5c4e878c76a308fb0b624ef9b223168454eb65e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476450, "uuid": "bab2331b-e758-445b-8c2f-52174e427948", "comment": "Malware payload (SnakeKeylogger)", "value": "e62333d26296537d869a8e6d929bf5cb87d720a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476450, "uuid": "1dcab3a6-c702-4334-ab0d-1411b440c608", "comment": "Malware payload (SnakeKeylogger)", "value": "91986e1960986cdd0572391f0e70c1c12f2d765c5cb1d4b4f10959d68e2475671fb20e649a69c98343f926e2fe900af9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476450, "uuid": "5c601d0a-80ed-4316-a316-dcb928edcc38", "value": "T1A3157B7E1A994607E8243271C893D2F32AFBAD606061D1CB5AC72F6FBC552BF9503346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476450, "uuid": "c44e5fc9-dd17-4a05-94df-717f09d910d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476450, "uuid": "d8603699-99a7-448a-b490-dfdf8156867e", "value": "12288:ldwmiLKshZS4SlL0y2dIHAYRMcTYLyVBafQrHFKiAQSQy4AI:QL5Ty2CycTuyVBaIrXAtQy4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665476450, "uuid": "1d8bb4c8-181a-4a9e-a2ff-c6983e21dcd4", "value": 955392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665476450, "uuid": "3c91785d-6fa6-48ec-9918-74334e597c6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476450, "uuid": "8045efd6-0a4d-42c8-8d70-bccb8eb9d9d6", "value": "KP20221110.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e387de0f-4967-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1665494606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665494606, "uuid": "bdf49deb-f203-4147-b81f-7c9b99fc4faa", "comment": "Malware payload (Loki)", "value": "8e5c6803b98d0d81becec2f2d8c7c57d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665494606, "uuid": "0f5c553f-733c-4dcd-bfa6-4ce9e7336829", "comment": "Malware payload (Loki)", "value": "b53e62c1d7215a0dc33d035ac0721e2c5cc8a72aa8f7ea4ff7a3c01a55131345", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665494606, "uuid": "edddfecc-30a4-4dfb-bb13-0f3583f7689c", "comment": "Malware payload (Loki)", "value": "0e653cbfb54db8cfa70fd447d606c1c0f87d9589", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665494606, "uuid": "cc3650b9-db49-4dc4-8473-ce9ba8d0ae4e", "comment": "Malware payload (Loki)", "value": "b546c7d8653116e42b8d956f90852b1210af45658367a5e68670abfb2982a0c9295dd506e1674a4c6b10c6f4aeb72479", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665494606, "uuid": "3c408342-42f7-47fe-a984-1c97e4892bb9", "value": "T1D2157B7E1A954607E8253274C883D2F32AFBAD606061D1CB1AD72F6FBC552BF950334A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665494606, "uuid": "c41a4ed9-5b9c-4cde-9bfd-283795bc0067", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665494606, "uuid": "77727ac5-a4be-461e-b5ff-584769dffe03", "value": "12288:y9weFUZt9hIQJaCz8i2w6wihi2aCbikjemwPAQSQy4AI:19hnJaCxrihRauSAtQy4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665494606, "uuid": "9dd3d83e-cd00-4e62-869e-fe8c06f2c66c", "value": 918528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665494606, "uuid": "cb0fde92-12ef-40d7-bf7b-369c8b822cd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665494606, "uuid": "d62c47e8-fee7-4efa-a314-22eebd1eb153", "value": "IMG-4450.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c984784-4935-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1665472798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472798, "uuid": "d2ade732-736b-4f0c-b430-b771287336cb", "comment": "Malware payload (RedLineStealer)", "value": "0fb52c3eca5b1b66b9634ee5d9c223c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472798, "uuid": "15b8a488-a23e-4cc4-95ba-cc6a321d8d1c", "comment": "Malware payload (RedLineStealer)", "value": "b5412319c25e53df63fc1905a347841ea97771a33bd8743da76a4bf6ae83c455", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472798, "uuid": "d4d34097-0b50-4d1e-9dd8-28e771c9b9c3", "comment": "Malware payload (RedLineStealer)", "value": "6d7a820bd83a46f16d7920dd7269e12d27105388", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472798, "uuid": "d4d00ace-a612-4397-a353-da9c30d2a888", "comment": "Malware payload (RedLineStealer)", "value": "26bfc662a0fc613a8f143e35a13d19bce9870e886172337f4a2d8845502b680c35ddd5a4bdab31b04124ba3bd9ceed1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472798, "uuid": "b1e6b6d5-2915-4eb6-82ed-a500b3de99f7", "value": "T193441B8173948457F8975A304E93879AD728FC82AE30769B2360F75F4A3BEC29F64705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472798, "uuid": "30b41937-8416-459f-aae2-0ca0a24c7e06", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472798, "uuid": "2018b42f-b874-404b-b5aa-6ae41a952597", "value": "1536:EI47GyTGCwiSnmQUt0LB1MfKs5g+o1pv+uiR7UutEseaN5HI:EvGyYiSDnt1M75Fo1YDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665472798, "uuid": "7263ede7-3795-41c5-a37b-981c768d6635", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665472798, "uuid": "18849853-68d4-427d-813c-615380be2cb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472798, "uuid": "b9dc7cf0-8468-48b0-8baf-619d04839b08", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "041988f1-48fc-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1665448275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665448275, "uuid": "f00ce9a0-86df-4e20-a3ad-1eeeceafacb2", "comment": "Malware payload (Smoke Loader)", "value": "e5cd16545fe8d04faa7e7793e42df55d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665448275, "uuid": "b7cf310f-af78-43de-9d1f-4f12e8e92f13", "comment": "Malware payload (Smoke Loader)", "value": "b5c2b381305b21be548d0123d9b4f44c101f324c1e0a6a3360ddaec4935de4f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665448275, "uuid": "fbece24a-1af0-4ed9-a562-d523bf8f18e3", "comment": "Malware payload (Smoke Loader)", "value": "a9a297b8d843c9e742fd05708f20d51d7540a101", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665448275, "uuid": "1b56e4f4-7f27-4db2-bf4a-beda42d4b040", "comment": "Malware payload (Smoke Loader)", "value": "bb372abfd06b320d947eb73e2dbe426f3da3a50fd86c452a2f877f20f7d5a49fb4f5bd246b61febc3567a22c61950f2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665448275, "uuid": "a0c9ff18-1d38-4133-b554-ec7f9e8e07a9", "value": "T16724D02236D0C472E26716358C68C6B56F7BB8701A359E8B7BD8062E8F352D3DE25347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665448275, "uuid": "2295bd74-eec9-4cf5-8361-a47c4a5faf0f", "value": "78ee95c35be8f9cbb7d14afcce7e80bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665448275, "uuid": "964fc53c-419c-46f6-b868-defdbfb511ac", "value": "6144:rdXc8LdksBzxz7uvgwc5zPViWNFdw6pu:rdXc8bB9WvpcBNHtvpu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665448275, "uuid": "899ea057-16b0-4657-bdd8-847ddd311a5b", "value": 217088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665448275, "uuid": "72ddb2a1-38e6-4d00-84cd-cb9948458686", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665448275, "uuid": "ec9ac316-b3a6-4edf-afe7-bf3eaa573a40", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e8163f7-494e-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1665483646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483646, "uuid": "b50a4296-8d4e-448e-8738-87c1f61a8a7c", "comment": "Malware payload (RemcosRAT)", "value": "a4774d4a9b4cdd2ff22979be79ce231a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483646, "uuid": "9532c1ef-5b84-4b0a-8b43-6d77e115febc", "comment": "Malware payload (RemcosRAT)", "value": "b626692f57e0e92f63368429dde7316b712d46e4d03472f75414a318630306eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483646, "uuid": "1a6026b5-d108-47d6-b336-63d9465896a9", "comment": "Malware payload (RemcosRAT)", "value": "bccd2a265c82fa8f6695683623a89fa7dd4b7a8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483646, "uuid": "cf2b4908-eb52-4cb0-bc40-04fa673fffe6", "comment": "Malware payload (RemcosRAT)", "value": "cb776f7f15811538b0e6959d98fa93f499e53b183fe40f701424691fdaeb49918786df9923a310ccd1c0649a09a79848", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483646, "uuid": "ab90e657-6126-43e0-96f3-af06924c4aa4", "value": "T13C459CBA21C54417E8693079D487D2F32AFBAD606051D2C76AC72F6FBC811BF951338A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483646, "uuid": "c0c26ed1-ab9d-4aad-b2fb-9b2444d6c15c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483646, "uuid": "6a3053e3-4a33-454d-ba72-23ae3065bfb8", "value": "24576:tcsZj6XnGZkllGo2dkb3+oW0zaJfGXjAnhYCYt:3Zj6WOladW3PaJWjAhYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665483646, "uuid": "bedfcc89-4cd1-41f8-94d5-2caaaf07f1c8", "value": 1251328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665483646, "uuid": "610b25f9-08e8-439a-9858-cebdbd09cef2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483646, "uuid": "b34524e7-1ce2-4be2-835c-1c4a7049cfad", "value": "a4774d4a9b4cdd2ff22979be79ce231a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e90537-4918-11ed-9266-42010a9c0072", "comment": "Malware payload (NominatusStorm)", "timestamp": 1665460618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460618, "uuid": "69e94ca8-4da5-4ec6-951e-e69124a4991e", "comment": "Malware payload (NominatusStorm)", "value": "baf4909562444cd5cbb905f3e141d1ec", "object_relation": "md5", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460618, "uuid": "0dc485f0-501e-4925-a708-6e7a9f91a9f2", "comment": "Malware payload (NominatusStorm)", "value": "b65576de701658a6a5ff38609bad239447f31ef38f567e4f261afed4db7f379a", "object_relation": "sha256", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460618, "uuid": "e2275222-f5ea-4c73-9e51-92aa33f39452", "comment": "Malware payload (NominatusStorm)", "value": "d768ad5b32ce5de03d79a730ba9ca015d34fe6fd", "object_relation": "sha1", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460618, "uuid": "8cac941c-ebaf-4427-a500-19fca0b0d3e2", "comment": "Malware payload (NominatusStorm)", "value": "c6354ff0530b53aa125c427adc62407efe4d26bbe4dc00932af6ac665bd5a58918bdacd90f6c51912239383034b207df", "object_relation": "sha3-384", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460618, "uuid": "856a5cdf-1c0a-4edc-8b23-a6fa3789f88e", "value": "T182957E963B92C12AC06E03350CA2D3872172F86A9F1342D734D9B37E7DBEAC44A755B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460618, "uuid": "2cdfc8eb-593f-4c11-a9ce-911688c6a372", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460618, "uuid": "4f9eddd0-8715-4d98-8913-60618b7cb71e", "value": "24576:lKKKKKKKKKKKN7ChBWMQ+uSJJd3Dkd9+ZDd3vNSM0y9T+m5WNDV:VjLuSh3i+FtvkMzT+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665460618, "uuid": "110f4b04-ed37-4d89-8425-09706a3e51e3", "value": 1921408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665460618, "uuid": "89a505c3-9825-431c-8ac1-08fc6320c604", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460618, "uuid": "f2bb21cf-15f7-422b-a122-0ed3704aa8a3", "value": "b65576de701658a6a5ff38609bad239447f31ef38f567e4f261afed4db7f379a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4803aa3-4975-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665500540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665500540, "uuid": "c0b7a745-3dad-4bb2-87d4-790117823db9", "comment": "Malware payload", "value": "d6789e957473e48dc6cab4e5cd516dac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665500540, "uuid": "bc2ca48e-f3ef-4d26-b951-33435d10d01e", "comment": "Malware payload", "value": "b6da1f4b8808d1e1eb5c6e9fd77eaa58a8efaad424362247495b39269e7e6c4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665500540, "uuid": "594dc81b-7a72-447b-b8ae-3882d4d767f5", "comment": "Malware payload", "value": "2321470e2003a1828bf2881007a5eb57c90cc4dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665500540, "uuid": "fa073925-de41-4ef3-aca4-efa8a48692a0", "comment": "Malware payload", "value": "30c3c3ba1523ba3d4bf291c999bfdb85e3d82b836f6ff6575b838605141235b1b2b9478407825e0bc3979dc8e759ac26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665500540, "uuid": "b444c880-3cde-451c-b2fe-0e60927b96a2", "value": "T11E763322B4C0C4FAC6B69576A9A0FFC810E5D48B4BD3807367C54A49B9BB824C97D74F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665500540, "uuid": "bdbd25c6-518c-47ac-9c26-3acf1485209a", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665500540, "uuid": "56590a64-ab9a-449a-8a8a-12083339ff99", "value": "196608:91OKBoeDZqdS7/q7On00bv/C/pQWT1IFUBtB6:3Owoesf6nrj/2pUFkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665500540, "uuid": "abdfe144-02cb-4124-9369-fb269b1b52cd", "value": 7609737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665500540, "uuid": "b034ee11-8f21-449a-b303-e7184348cf36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665500540, "uuid": "0a4bebaf-30af-4ce5-b384-70bc5eb280e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3675c24-492d-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1665469722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469722, "uuid": "066c0344-8e61-4b32-b6b4-b1d834aa4aab", "comment": "Malware payload (Mirai)", "value": "1297430a1a9043c4c0fb06ac217a27a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469722, "uuid": "ae543a4e-6e2e-40c6-9860-ee6ed4252377", "comment": "Malware payload (Mirai)", "value": "b8073766b79b4b20572acb44f3919cfcff8599bb5039133088858a339ab96ea0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469722, "uuid": "c33878b4-7062-4ce5-91fd-925c2f718702", "comment": "Malware payload (Mirai)", "value": "898fae48e83acb1d20e252b4854c1f6f75fdecd9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469722, "uuid": "719945c9-38ca-47d0-89ca-c6c0e8bbbbf1", "comment": "Malware payload (Mirai)", "value": "159dfa1d0e01ecffbda86c2162b8ce3134a54dc26e841755bb66ae900e03238325740a4a451c3d5b22a460e22cb86c5e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469722, "uuid": "16e2bffc-957b-4782-8a8a-cabd8edd999e", "value": "T15D33F1909297CD73C634F83A083D489609D01E9CC27910731137E6ADAA76D47E7AC9FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469722, "uuid": "e213c4f3-b96c-4d7e-8b90-8478ab27bfb6", "value": "1536:B7xHr50Pf4WldFlQNoho4YRVSTWcEZG5fFL9VhRNRgAHLCKhM:Xd0PDdFeNohotEWjZGNFLThRlO0M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665469722, "uuid": "e96d9930-d35b-4576-a177-448ed723d698", "value": 53656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665469722, "uuid": "8553ed16-69d8-4c3b-a3c4-61d5e4f5c1dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469722, "uuid": "455e7fe6-8ff9-47de-8f07-cf4f6c8e3ced", "value": "1297430a1a9043c4c0fb06ac217a27a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ffbeae8-4935-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1665472964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472964, "uuid": "410655f6-b244-4b8d-9be2-af5e1eff84ff", "comment": "Malware payload (Formbook)", "value": "2aea248b2b590adf9f002bf12b8e7b88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472964, "uuid": "a3298952-2f23-40c9-8497-d9de4279cbf1", "comment": "Malware payload (Formbook)", "value": "b8278bf8900a451a507c52e5fe3e886cf2ee5b3f65488eaf9c288318e0fd52a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472964, "uuid": "744cba28-8184-4979-819e-adb0338ed3e6", "comment": "Malware payload (Formbook)", "value": "dfbb2f6619eddb467c77ea3cdab16085ccd391cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472964, "uuid": "3da3c215-faad-46f7-83ee-ae59f4a9d283", "comment": "Malware payload (Formbook)", "value": "64973d51d1cb49b4e28319bdfbb258529cb18cff58d0381c620b71278cadec373b3d1fc40459682679d07a6fc4cf7b7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472964, "uuid": "2994d1eb-266c-4ad6-bb01-bd231f661000", "value": "T1762538BA21858517D4253132C487D1B32BFBAD606162D2CB6AD73F2FBC452BF950738A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472964, "uuid": "ae65e6f2-f2d9-4e1a-b2de-dce6d30acfd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472964, "uuid": "cf102451-11cf-402e-8fb5-68dbab13ed9f", "value": "12288:s8rBWShXDy2iN5vjR1J6vpqnAoLzwW4CkvBYZxMulVr0fQ+NNBymuH37j7Qu:zzy1foBMAoLzT4CGBYZeAVofAmi7j7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665472964, "uuid": "55cedf1b-e9ed-461f-91c5-96dc9b9f74f9", "value": 1034240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665472964, "uuid": "557fd1da-eaec-4dfb-9aa2-3683865c0b00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472964, "uuid": "64bbc3c3-bf06-4bf8-95e7-3c2d5530c3fd", "value": "new Greece order.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d6191ed-4954-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665486113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665486113, "uuid": "98ed16f4-431e-41c7-81c0-96ef636693e9", "comment": "Malware payload", "value": "b141a07af192a04e4e7aa8ff9e260d5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665486113, "uuid": "05d84c46-79ab-421e-b752-348f15da3614", "comment": "Malware payload", "value": "b84e4b51dfed1b4d050e80a2d214e291455691876eb4bd5de075aa4b22052b23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665486113, "uuid": "8d6e9890-962f-4af7-9fad-d6b515bab59f", "comment": "Malware payload", "value": "d37b0e3c912fda7855206ff14624f64d92bf8dfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665486113, "uuid": "3ec53722-5a0c-4a26-bb7b-3e0f7e6c307c", "comment": "Malware payload", "value": "f3792079ba425441830064efe6c6d2c166ccf57f7aca444460edbe5edfe08112e5f88cd6dbc21591771f2825afc19221", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665486113, "uuid": "00a73c95-6033-47a4-8412-544670ff5250", "value": "T1F77633B531F188F9D2928B31DDF14AC689E48A9A2915607723478E0C197FA8BCD33D5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665486113, "uuid": "96cfad0f-ba14-4104-bbee-26c37d9ab802", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665486113, "uuid": "477cbc2f-4133-4ef0-ac3b-f1543d0dcf49", "value": "196608:91OLxm1WqRZj/kuKzsVklxb30VfFZ9vyN3W/d1B7RvEPtkx1YsctZ6vetXc:3ONud7kuKAVklifb9vyJW12Pex1YNtyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665486113, "uuid": "142394f9-06ab-4531-a856-c37241db1f34", "value": 7599194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665486113, "uuid": "e2a57011-6bb4-4a67-916a-499623db22ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665486113, "uuid": "66e0e2c8-26b0-4700-b691-3102c609d802", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae4b812e-493b-11ed-9266-42010a9c0072", "comment": "Malware payload (Chaos)", "timestamp": 1665475619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475619, "uuid": "89fb77b6-1e14-44c9-9221-d2a59d219722", "comment": "Malware payload (Chaos)", "value": "34e04a1ba74f1618eb01c32d07a5fed9", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475619, "uuid": "c5cbf11a-3a1d-40f9-a6d4-f0ac1a8015ef", "comment": "Malware payload (Chaos)", "value": "b8a361b7fb6c8254df01861a3f5453c6924848ce73b31fc86b7c6249e71f1c81", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475619, "uuid": "545625af-6f3a-456d-944a-0c37c7b637d9", "comment": "Malware payload (Chaos)", "value": "c142980be6904c88ac21a3b73a92463df3d8811f", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475619, "uuid": "8e499560-5bcb-47e8-b919-97e6f41d198e", "comment": "Malware payload (Chaos)", "value": "d0f73e7c9693529a45827916c74a3bb66d254f5fa52063fb2fe0e8224c693176e2625d57eb20bac8f1db2a2654dc9b4f", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475619, "uuid": "ea0a5b91-1763-45e8-a118-5f2f2e08fea7", "value": "T14ED34E34AAEA5019F3B3AF788BE0759E9A5FB7633B07845D1059134A0A23E41DDD0B3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475619, "uuid": "c78cdd69-9e0f-4ebd-a571-d8a190c005a1", "value": "3072:xjTpyJTr9ocDFUPZ9svbWVTdu8bDGfZpOozo1LisW:Clr9ocDFUB9sz808nQm1Li", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665475619, "uuid": "6ab3ee07-8105-47e6-8a5e-24f9f33e59e3", "value": 135632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665475619, "uuid": "04afaca1-ae94-42fa-82a0-4bdb7110ed8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475619, "uuid": "26958940-2f7d-4296-80fa-34b170b00036", "value": "b8a361b7fb6c8254df01861a3f5453c6924848ce73b31fc86b7c6249e71f1c81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68684345-49bd-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665531336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665531336, "uuid": "d79511ef-10ca-41b4-ac79-6ae8de16889a", "comment": "Malware payload", "value": "8996bee224b021e075544dce3181c26d", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665531336, "uuid": "c504e436-75d8-40ab-bffd-00b054cec231", "comment": "Malware payload", "value": "b8ebf0781e27d49a32837d37fac5e631ab27b45dac1f7f5dba6c3d26e41804a2", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665531336, "uuid": "f59413c5-d648-4f0c-bf75-bf7223d05e56", "comment": "Malware payload", "value": "5302f1cc0cd4f58967259338df06f4d8dae3b893", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665531336, "uuid": "49ba853a-5c99-438c-9621-21a8a287a2c7", "comment": "Malware payload", "value": "9b538ae0f5d29db19aa14403ebef9d9f2648fd68a3018825d6f02d9cb9b34f02d4c2bc5688339d0a6222e355d7d6b164", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665531336, "uuid": "4e6a8032-01d2-4645-b0c7-205d886facd1", "value": "T19BF52323F661996BC8F2D2362574133561778D28DF43BB8B7D5837B924BB9D84B822C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665531336, "uuid": "e6b77134-7c7a-4b77-8382-48ec61bb28d2", "value": "98304:di96efffnRcj7jGPJqkV7dRyQr0KGzsPNDEL:dKXcXgXHRyQr0KGoJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665531336, "uuid": "9c27bdd1-b5d9-45f1-9440-b1bba3b68a22", "value": 3564453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665531336, "uuid": "d73f181d-44ca-470e-863c-028adc6f8350", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665531336, "uuid": "843fa2ca-00a7-454b-85f5-7819201560e6", "value": "Livesexy.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9983e12-4947-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1665480792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665480792, "uuid": "ef6c7787-725b-4101-96f7-769f3495e4c2", "comment": "Malware payload (RedLineStealer)", "value": "cdb9a3e1c2b3cbc73e0bdfb3e6594b42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665480792, "uuid": "bc435779-cfe5-4180-b4e3-a9fab6151ee5", "comment": "Malware payload (RedLineStealer)", "value": "b91271baa492cc3753b2969b87f2899b94d7ce6b6907ab0c265cf81fe5a3fcc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665480792, "uuid": "55aaecd3-355e-40fa-8c24-8e39cb6ed1d1", "comment": "Malware payload (RedLineStealer)", "value": "7efb15e489c5cbf74ec040aab49ad802b916fa26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665480792, "uuid": "6141eb84-797c-4c66-9de8-b8669b056a1e", "comment": "Malware payload (RedLineStealer)", "value": "d7cde43aaa6ead23eda25f34d7c775e5fea25545adea91e27793ea68c42ae1e3ec493c3a4eb8aaa571390332f15ccb02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665480792, "uuid": "ae68d144-cd77-4db8-8f79-46cc54d5a235", "value": "T15024CE2235C0C072E2265A798C65C7B47BBBBC711A39468B7BD84A6C8F352D29E35347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665480792, "uuid": "18a5c08d-93c0-4a72-a04c-92ce80915a7b", "value": "59de72f24710a4ab3ca7e4fa2f0a3bf4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665480792, "uuid": "bc2661ce-e374-4d14-9960-9087c4496bca", "value": "3072:DSV2eBHkg/xAMzIkvxLkcvS/wMONnSByClno9+NgRNKsNfwaO:GtvAkLkcvSuke75Nf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665480792, "uuid": "28b2fed1-7c8f-4186-86d9-6947dbd2803a", "value": 216576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665480792, "uuid": "7d9868cf-dfe2-48be-9238-6f19ad87260a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665480792, "uuid": "5138679e-7ef5-42ec-bce6-10b2f2691210", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca1e483-49a4-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665520445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665520445, "uuid": "dafda825-b2e9-41ba-98c3-fa6fffcd8598", "comment": "Malware payload", "value": "c8b7f657a276d65f0e84605458f53e8c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665520445, "uuid": "9114abbd-57c1-44af-abf1-0834e075da8d", "comment": "Malware payload", "value": "bc4a1e2765efdb132352b64da6f51d88f6438f1756363376652e47057b899fe6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665520445, "uuid": "87e195b8-d6bd-440f-a101-27aedfaca8d3", "comment": "Malware payload", "value": "c59683767375cf76df3525e9d9464ca165650182", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665520445, "uuid": "0aa66b8e-fbd1-4b9c-8d4e-387188fe6be4", "comment": "Malware payload", "value": "a0cd6d80fd4d7f4230b5ca7734053bab554745e61d30985d2d5c48ced8e0593962c2ffe24b8cb509928d3620f776fae3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665520445, "uuid": "42108fec-a483-4a4a-b5ca-9a279af72892", "value": "T16236BF02B7D2C0B5C5AF03314877A35A5271FA564F2387E3B6D07B2EAD717C04972A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665520445, "uuid": "e3629480-2f85-44f7-b1bb-ec1ef7ba835f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665520445, "uuid": "14dbd119-591f-48cd-acf4-6993e0de9c1b", "value": "49152:ejLuSh3i+FtvkMzT+e01CB19VNkC6wARe0ZGxbxcgsIsTZmHqDRl76mvMNvwBsD2:iLu1A3hc9ZGlWrfTZmHqXE9ssD/Qj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665520445, "uuid": "271aaf67-1d73-42e5-bac1-13bfd3570722", "value": 5242880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665520445, "uuid": "6d09b85e-4d41-462a-8f70-5d3e4a57c872", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665520445, "uuid": "9131a1f0-01ab-4249-86bb-cc7bf4155060", "value": "bc4a1e2765efdb132352b64da6f51d88f6438f1756363376652e47057b899fe6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e72ba65a-492e-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665470131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470131, "uuid": "309191ec-58db-402e-8f49-84e1c244eb63", "comment": "Malware payload (SnakeKeylogger)", "value": "75dd169373b326375bcb8f311128588f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470131, "uuid": "a374809a-bb9d-4e7c-b119-88af96fdc2ac", "comment": "Malware payload (SnakeKeylogger)", "value": "be87ab6ad3040a3e0e47d3592ea473d1b2b16df6f5ceaf3b424dcce68270b9ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470131, "uuid": "a900f188-e64e-4cbd-b48c-b4546ab10bf8", "comment": "Malware payload (SnakeKeylogger)", "value": "38dda90f575d61cdee25c935bf1572f95dcae80b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470131, "uuid": "4acd9660-92b4-42a3-81b2-1e198449c8d3", "comment": "Malware payload (SnakeKeylogger)", "value": "26c96ab06bd49fb7640ccb3393ef51e1af6b70d3021894c2e548503dda5c246f72788a85a24a56032f6c5d2a44bab5f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470131, "uuid": "88792e0e-826f-484e-aaff-a207ef03f394", "value": "T17535F18AB70E671AD4D9473AD4E863B641318CD9F721FD7B28F832AD4EB27DE0450942", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470131, "uuid": "73f34656-2983-4e6a-9dca-0438f62be0ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470131, "uuid": "2f9336a0-8638-46dd-98de-e822eff61d74", "value": "24576:mn1PEiHE3ftTwV/P6aeosXQPZ4rcffdJydqRRRRRjXtAmA0AakiHZB+:o1PLitKFUQSqTRRRRRjdAmA0Aaki5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665470131, "uuid": "0a54640f-9315-4764-b72d-f315d4ebbcb4", "value": 1110016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665470131, "uuid": "96d7dc73-6adf-43af-b320-81903165881c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470131, "uuid": "e1e75035-13b0-4d3a-8dce-34d87ca54f31", "value": "75dd169373b326375bcb8f311128588f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b1ff26-494e-11ed-9266-42010a9c0072", "comment": "Malware payload (AllcomeClipper)", "timestamp": 1665483718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483718, "uuid": "51a8b3a7-bc57-4fe3-b37d-58ee99c7f7d7", "comment": "Malware payload (AllcomeClipper)", "value": "8dcec334c74becd217f0f61c53a45a54", "object_relation": "md5", "Tag": [ { "name": "AllcomeClipper", "colour": "#A2067C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483718, "uuid": "de28272e-de9e-44e7-aabf-bbec0764f93a", "comment": "Malware payload (AllcomeClipper)", "value": "bf00a990eb93a4696f6b5d6029d654ce3e2959b14db849c6630c17256c7aa31b", "object_relation": "sha256", "Tag": [ { "name": "AllcomeClipper", "colour": "#A2067C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483718, "uuid": "20d39f2e-a320-4d38-b900-1a19e64d1ba0", "comment": "Malware payload (AllcomeClipper)", "value": "02a178c1bdd24a780c491c2efe1dcf6bb6be13f7", "object_relation": "sha1", "Tag": [ { "name": "AllcomeClipper", "colour": "#A2067C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483718, "uuid": "792e8448-31c9-44bd-b793-321f4f3658dc", "comment": "Malware payload (AllcomeClipper)", "value": "ce3c37383f7d827aabff25d06733b36491dcb5a054c81f00023d87f5ba30cbb235b5a7bd67baaff0fc84adc9cf914189", "object_relation": "sha3-384", "Tag": [ { "name": "AllcomeClipper", "colour": "#A2067C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483718, "uuid": "7b57a471-9711-4831-add4-a2e437a6b6bb", "value": "T148156CD26B83CAD6C5372B7A07A0A13457F1EDC71FF58607A92972B956333C0290E636", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483718, "uuid": "08f58eae-0cb1-4814-b5ad-1f03a8e42f20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483718, "uuid": "2014efb8-1b34-49d0-bf00-5ce6d8437a2c", "value": "12288:q39riVwf3iJ+HN3TF4W7Wba0WGU68RnAgqgNYEgeGEKDBjs2sd0psmCA+Pdm7Y7a:qNriy/fTFOzgCGTjUDn/MI9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665483718, "uuid": "04a522b8-d71c-4d1f-9c06-c397b3cf9415", "value": 892416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665483718, "uuid": "27f93eb5-9ca3-400c-910d-3623e57e3be3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483718, "uuid": "a7edd89f-3ac3-434e-964c-d572a8f187b2", "value": "8dcec334c74becd217f0f61c53a45a54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d0b470-4945-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1665479975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665479975, "uuid": "0fff223e-7531-43e0-8eb5-845ecff68751", "comment": "Malware payload (Smoke Loader)", "value": "998b4e6c9bdd243929c5ba35adf8f932", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665479975, "uuid": "a3c15baa-3fdd-4ec7-81fc-0c95dbd173a7", "comment": "Malware payload (Smoke Loader)", "value": "bf4404788850b8dfeade8e68a96a2171b1b5f4783709cde59516e8c99bbaa9c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665479975, "uuid": "5a67455d-710d-4009-89a8-5c089fcc5095", "comment": "Malware payload (Smoke Loader)", "value": "e039d7e75dcbdfff1f8c808f9477a8aba90f7d0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665479975, "uuid": "80f68dec-175a-4c15-8306-a3972a1e3ede", "comment": "Malware payload (Smoke Loader)", "value": "3a746fefa0129a4e2609903c058d30c2c83ae18499ac784208a0b000296d0db37fe331432ec3fb728b906b7a6add9c9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665479975, "uuid": "0aed3e1d-a2f7-42d5-a2f3-f2aabf6625ba", "value": "T1A824CF2232C0C472E62316B98D64D2B1ABBBB87059355ACB7FD8166E4F353D29E31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665479975, "uuid": "957fb942-6589-428d-b9ac-8d4e7acc0deb", "value": "f07757163332cdbf737bafdb4614222c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665479975, "uuid": "d812c203-0905-4081-8d80-b7085cc55df9", "value": "3072:Z4wBcOxTj89nUYsLLee1IRFTvXp8YS1zp6lutUqOcs5WkXj+3fFAmbEHN3vF0O:ZpBTLLee1CiYkYctz+BXy3dAiEHNN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665479975, "uuid": "d406cba9-0f15-4565-a746-fb703db49744", "value": 215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665479975, "uuid": "2e10ac6d-dbe1-43c2-92ef-9b6a30b84277", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665479975, "uuid": "12c7b1fb-768a-4831-bbff-c985ee0ef04d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d5145d-4916-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1665459665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459665, "uuid": "cf756646-30ba-4643-97e7-969d4eb0e676", "comment": "Malware payload (RemcosRAT)", "value": "8a7a6157262732d60b4eb629542d807b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459665, "uuid": "1db3c8b0-b7f7-4a0f-9ca7-bd26694c3f23", "comment": "Malware payload (RemcosRAT)", "value": "bf9b6173d2867c122cabed33c022cc71fa6a5bdf9be0fd09af88a9dde5ccac36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459665, "uuid": "8585ace0-e259-4f31-b8a3-b07e33194a0c", "comment": "Malware payload (RemcosRAT)", "value": "a167a022d5caf8fcd578bb1de50a1dab2e670548", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665459665, "uuid": "68ba9c17-64ba-430f-bed9-82eccfe1bfd8", "comment": "Malware payload (RemcosRAT)", "value": "668edecf1996bc6214410f45842ae62d87c36b11d32039685bc6d30153b9affddd57886ebf48cdd11aa56e6435d97c15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459665, "uuid": "b810d81a-303d-4fdd-84e1-40baec3feaf5", "value": "T18855BD7E16994607E8183274C883E2F32AFBAD606061D1CB1AD72F6FBC552BF9513346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459665, "uuid": "7bd4dad8-db5c-453d-b5ef-40c9c813cbc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459665, "uuid": "b9504dfa-7db8-4d20-b055-41ba2ae9082d", "value": "24576:Qv6m3189kZa/TSl3UJG0LpNhc20hobY5D11WQmFFPEAtQy4A:bU186gmlk80LpNhwobY5h1WQmFFP9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665459665, "uuid": "2549e2ea-0aac-4413-bd3c-0d9116a52cdc", "value": 1300992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665459665, "uuid": "075c6b7e-efeb-4b00-99a0-015af2bd7f66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665459665, "uuid": "19de37cf-ca82-4d6f-b761-9de069c3a5ef", "value": "SecuriteInfo.com.Win32.PWSX-gen.29605.11304", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4bfcd0b-495f-11ed-9266-42010a9c0072", "comment": "Malware payload (StormKitty)", "timestamp": 1665491065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491065, "uuid": "a58a88b9-e2a4-4615-b33f-9a4510f3eada", "comment": "Malware payload (StormKitty)", "value": "437cdc9cd5aa816864a2d1f6ec30d23c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491065, "uuid": "184f8be8-57b3-449e-9348-d5cf48dac3c2", "comment": "Malware payload (StormKitty)", "value": "bfa82ccb728c0ba5533bfc1093487edb9d06ab10080b915c64b759ca86b0d9f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491065, "uuid": "85dc3028-bbab-4936-a4ae-3ca575c25798", "comment": "Malware payload (StormKitty)", "value": "23b7a7c73604cd3ad97ca77062f6fc1c8be67376", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491065, "uuid": "50738bce-cfd8-443c-8876-2fb9d7ea5d1c", "comment": "Malware payload (StormKitty)", "value": "11b57492985f764453bd9819574775855382891fa623af7acac2c6931b58b8eccc68e4e5e2e37510472eca1ec1ab1530", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491065, "uuid": "60e2ae0e-f5a8-48d9-af69-c82983507503", "value": "T18783F78DB65031DFC857C872E9A51DA3AB60702F475B8243A09731AE9E0E58BDF064F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491065, "uuid": "a80d74ac-fe1e-408f-8a6e-0232fc4c10e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491065, "uuid": "32774eb2-ac66-4423-93bb-a427038ea8a9", "value": "1536:+QWI/CRcoIpDJM7ojtOTNH7zpga/eHUTQQQQQQQBdBgN6b5/2kWSC6WLr4uixPCb:xWIo4DJM7ojtOTNH7zpga/eHUTQQQQQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665491065, "uuid": "c9007c5e-689c-440b-aad5-23ce6973f168", "value": 85824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665491065, "uuid": "f171abd6-3ae8-44b1-ac82-e00b070ab193", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491065, "uuid": "05302756-c99a-4313-9dcc-1fc6edf56c79", "value": "SecuriteInfo.com.Win32.RATX-gen.6714.12779", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d19f0c6-494f-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1665483992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483992, "uuid": "7dae6861-2f42-4d07-88bf-a57e17ff55ba", "comment": "Malware payload (RedLineStealer)", "value": "6868a1df44d7be7d687211715509c999", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483992, "uuid": "90c30c46-86bb-4e91-8261-e6edd9a360f8", "comment": "Malware payload (RedLineStealer)", "value": "c0cbc42be162a27bca2da5896e07a36bd73256f78f368f702ba7c270038f94d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483992, "uuid": "0584ce38-f695-4ba3-aae4-38730553af5b", "comment": "Malware payload (RedLineStealer)", "value": "206d89cd7ea2210c9b7e7147e65d72fcb58c3b94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483992, "uuid": "b8b15774-c09b-498a-84d4-75d9dc378005", "comment": "Malware payload (RedLineStealer)", "value": "7ce7356462c4b99b9a67b3dc0f6932daf61045926be8b7812e0bcf30f33f298524e28011bdbd22f4ac9c2b3160e66d75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483992, "uuid": "646de98b-102e-4695-8e8f-148c63d09f94", "value": "T11B262370B2F2E07AD46A09B11849BC3197F00CA8DD12A915FC9CF6E50A70EE91F56F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483992, "uuid": "b8803e54-a104-4c41-b9f4-70ad9be1c03b", "value": "a5b8e93122432e666455249c6633c54f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483992, "uuid": "782cbea7-881d-4d43-a540-88cb01ed3669", "value": "98304:uSepSO6Js2tTJ5+yqH2p31aoLR41nDziHBo4XDh6+eu5Hy+o5hiCBgzNffR:uSXOKs2tmi3Moych7Th6Ft5hiXhB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665483992, "uuid": "7730b093-a320-4daf-830e-a867f4f23c90", "value": 4456448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665483992, "uuid": "27e4d690-7313-498a-9028-883bdca514e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483992, "uuid": "53827f89-709e-4d04-8d3d-69abd963b9ef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5a873c8-4973-11ed-9266-42010a9c0072", "comment": "Malware payload (WannaCry)", "timestamp": 1665499683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665499683, "uuid": "23290321-f052-47fb-80b5-e0a2d4604092", "comment": "Malware payload (WannaCry)", "value": "59ced1d2c417c6ebd0a2a1c605e6062b", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665499683, "uuid": "869e0f81-f3b7-4bba-b5cb-c6ab99e92e9d", "comment": "Malware payload (WannaCry)", "value": "c11b4b0ad85753e025f868992a6b4de73eaabecac9d5b3762e3223ab5d57011b", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665499683, "uuid": "6ee8da95-6be8-4ced-ae94-cf156662c4ba", "comment": "Malware payload (WannaCry)", "value": "265950bb706582290ad3876527eb840adeb0a463", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665499683, "uuid": "f7c8e1a8-028b-4f04-89a6-269a17ccaa50", "comment": "Malware payload (WannaCry)", "value": "53eb01dd45f68b3876bd3848f76c79ca8930a03c3b9069be6a91d6958dd2b389cc73fed07baf71dfa32a9844de616198", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665499683, "uuid": "eeaa359f-5c70-48e2-b8b5-d2c7efedc744", "value": "T1C206339560A860F8E1055AB4947B4E16F7F77C2D32F71E0FEBC08A7A1D93B97A780241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665499683, "uuid": "d1909ab5-0703-4e21-a892-2e05ae46bb47", "value": "9ecee117164e0b870a53dd187cdd7174", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665499683, "uuid": "adad88a4-5ba1-4a8f-b8e0-af2aa16ce4b6", "value": "98304:oaPoBhz1aRxcSUDk36SAEdhI3R8yAVp2HI:oaPe1Cxcxk3ZAEmR8yc4HI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665499683, "uuid": "4dce0b7d-8b04-43b3-8fbe-f8ddf6dc2ff8", "value": 3723264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665499683, "uuid": "e693e712-5862-458b-b2ee-695121c175cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665499683, "uuid": "2b93eacb-6f7a-4f57-a8cf-3b63fb38ca4e", "value": "c11b4b0ad85753e025f868992a6b4de73eaabecac9d5b3762e3223ab5d57011b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb1d0f7-492e-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1665469763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469763, "uuid": "4ce4c0bd-d016-4ea8-8bfb-aa01b4732b38", "comment": "Malware payload (Mirai)", "value": "45c28f2844cb17fd7c6a1ae69ea110ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469763, "uuid": "d4e64fc5-3575-498b-bfe1-d6fb7e041ad8", "comment": "Malware payload (Mirai)", "value": "c12f8ca9ed64daffcfeca6eea517b2aa31d2c1d564f994377d9029569b2b988d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469763, "uuid": "d480f802-3fb7-4572-b3e7-c0cce594e31d", "comment": "Malware payload (Mirai)", "value": "50ef70ff752090d9b2412d14ba0aabf6e82a5c0b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469763, "uuid": "c94a6dad-4a7d-469e-a129-8a4a8a6aafce", "comment": "Malware payload (Mirai)", "value": "dfe9904793bdb2ff382b651a873e83ed87830c1f5af3fb476ab53a1c4a3b81712aa465c370aac9934930ab47be5d0956", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469763, "uuid": "c5ce6a1c-c748-45fa-9690-29d75bf71f1e", "value": "T1FBF2E099E36DA338C17008F8E9A944C329176F78E9EF3477051A437032B954BAE78C47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469763, "uuid": "0f4886f6-2882-428a-9e80-60262d1aa53b", "value": "768:2CIqFied3+qak4E5bdnoeotINLc24Ceq9q3UELCS:2zqZd5t4IF5AhfLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665469763, "uuid": "c950d335-c65a-4e9a-8ea7-563a44065b42", "value": 34508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665469763, "uuid": "e96aa686-a6ac-4da8-961d-f25d2031c3d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469763, "uuid": "75124904-4dbb-401f-8540-b4d84148ce10", "value": "45c28f2844cb17fd7c6a1ae69ea110ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3648e5d-4990-11ed-9266-42010a9c0072", "comment": "Malware payload (AsyncRAT)", "timestamp": 1665512162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665512162, "uuid": "3b12caec-5e28-4860-880d-ba60647f08b1", "comment": "Malware payload (AsyncRAT)", "value": "091087e7aa7c350baaf2bcd98e904a1c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665512162, "uuid": "102af352-8203-4e82-8923-5a0fd64f7a89", "comment": "Malware payload (AsyncRAT)", "value": "c23720918a8e7437696b641fad5fe9b76ac0cea2269ed1e741113c77e434cc00", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665512162, "uuid": "cd6b92da-ee4b-45af-b693-1d09a3312906", "comment": "Malware payload (AsyncRAT)", "value": "2267aa2069e727acd7c68389655948173898c92a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665512162, "uuid": "cc8261fd-0dc2-4c96-8a3f-c66c1f4d2cd2", "comment": "Malware payload (AsyncRAT)", "value": "d608625ab6ef5d0b680808be46bdb9cf87a105b5a926d55a2036f6e7acac2246a382ffee3464b6307022dd1cea17a032", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665512162, "uuid": "d22d1bc2-1568-4d0e-974b-fbb582570fb9", "value": "T12724D291D6C021E2D1EBEDB0EB4050D0B0551D5E44BFBDB4990AED8A8DA76F377222CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665512162, "uuid": "0441a93e-f39c-4021-840e-25eddcd359a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665512162, "uuid": "04e0a380-cf9d-47ca-9b3a-0c343522c004", "value": "3072:kuoETxoZ2p3h3ba1UQXVe2CYCtSZZZZ8Ux:kuoz873b/klCYCtSZZZZ8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665512162, "uuid": "f7da8b4b-d353-4981-ad13-3f67abcb1134", "value": 213504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665512162, "uuid": "bf32073d-c054-41b2-94e4-5d317e9c7695", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665512162, "uuid": "677615bb-d69f-4739-8d57-2cf4a6b62525", "value": "091087e7aa7c350baaf2bcd98e904a1c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e14d10-49ac-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665523952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665523952, "uuid": "f6fd644c-2f4a-4617-8d0b-5101395b5026", "comment": "Malware payload", "value": "a9ca62db76461c00c5a1dab2245f9367", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665523952, "uuid": "cd33557b-bcce-408b-9933-59b4c7f1d062", "comment": "Malware payload", "value": "c25f83cb2f76b220cf98cb8ccd44bb30b4e8d0abe8c884495bdf9a3869006f47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665523952, "uuid": "7a8d41c9-70ab-43db-a90c-1a27cc758baa", "comment": "Malware payload", "value": "b6f7875f5d20e232770fec950de80bf2fe63e536", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665523952, "uuid": "5a88a4c9-c594-417f-b12e-f064a71e2954", "comment": "Malware payload", "value": "96d5620de96412e6c78537926629dfda5844887a6288f96dbfac2403343ad794e62f9e465665b5a03b00ae921e41d25a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665523952, "uuid": "bea9e6fe-56a8-476c-bf7b-b679e3295841", "value": "T19424CF1235C0C072D2221A398C65D2B56BBBFCB5597596CB3BD89B6D4F323D2AE25303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665523952, "uuid": "19b30b3c-7863-4692-8f2b-b480d25760a2", "value": "e680a2b40b54e6ebf1523763588728dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665523952, "uuid": "dda9bc94-b560-4f21-b4a3-109443b91ead", "value": "3072:RPo274usgfR2LGq5FyGsqGLYK1Ux5otIiZ+C1E1TZB9RCGqtmcYiM6gOO:RAHYELGq5FfGLr2xuWYyTZBCBPYUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665523952, "uuid": "9a741c63-dc7e-4f2b-80c0-06dc08f911d2", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665523952, "uuid": "4f77082f-211a-4079-a60a-a620f1840c52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665523952, "uuid": "12359dfc-f0d2-4437-be00-bc9b88a62364", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d32961cf-4983-11ed-9266-42010a9c0072", "comment": "Malware payload (njrat)", "timestamp": 1665506605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665506605, "uuid": "6f7cf7f1-54b5-4af0-b7ce-d85a98629ab3", "comment": "Malware payload (njrat)", "value": "53f161394471b0d98b8666e376b6a2b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665506605, "uuid": "fb5bf344-f0f1-4ef1-a0fa-bfa5e6befa0b", "comment": "Malware payload (njrat)", "value": "c28278a7bba245eb019800f239e426aba3797602ca5bb7280e20ba9a4f843ecc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665506605, "uuid": "876a5d58-371f-4f93-8530-717dcd06081b", "comment": "Malware payload (njrat)", "value": "3bc8129f709fbdccca2d1f96d0b6b484ca10276a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665506605, "uuid": "7e553b29-62a4-4f92-bf12-874e26f4d201", "comment": "Malware payload (njrat)", "value": "2be65d28ff71c7d7f05017041baf3661f4ab0ff44b4756716e8b27274fef02bbb966a5a637d9a439ac6e303427853481", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665506605, "uuid": "1bac117a-41f9-4e5b-a38f-017c070990f0", "value": "T163033A4D7FE18568C5FD067B06B2D41207BBE00B6E23DD0E9EE564AA37636C18B50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665506605, "uuid": "3ad34320-1b6c-4d96-86a2-79032d93a057", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665506605, "uuid": "3962155d-df85-4b6e-bb61-0fe44241fd94", "value": "384:6eoIvVSikmj0NVtv/Vey0bkmflcs+SvZrAF+rMRTyN/0L+EcoinblneHQM3epzX+:6d4nO1VV0bkmmVSRrM+rMRa8NutGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665506605, "uuid": "62fde19a-e3df-412a-baf9-97ae9c5d772a", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665506605, "uuid": "551593b5-4f03-4cc6-87c6-e43d866180d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665506605, "uuid": "f3e3f1a3-5410-4b36-a8a5-d2b073ee3f66", "value": "free_donate_mod.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b31731-493c-11ed-9266-42010a9c0072", "comment": "Malware payload (NominatusStorm)", "timestamp": 1665475823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475823, "uuid": "a6688324-747e-48f5-bcc6-a7fbc67bb0e5", "comment": "Malware payload (NominatusStorm)", "value": "1687e359e0cff8a12137992fddc7cb0f", "object_relation": "md5", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475823, "uuid": "0c3683b9-0487-4136-9d70-88e3c284eb49", "comment": "Malware payload (NominatusStorm)", "value": "c2cc3f6b4eb79daf2ba83d94ea94f4000fe9be22edc26cc196e29bc391c3a38e", "object_relation": "sha256", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475823, "uuid": "7dda2b54-c207-4c65-818f-651c6c01af84", "comment": "Malware payload (NominatusStorm)", "value": "492df27d9e22af439c235c754468b95dd01ccdd6", "object_relation": "sha1", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475823, "uuid": "cb77c90f-f6bd-4d0a-853c-ff6371454338", "comment": "Malware payload (NominatusStorm)", "value": "6aeeb0159efe8b3b2be9932e7291c96ea77760d90dd69c9e3a478d30cd8006919226dc796640a40cafc29dbf4c337383", "object_relation": "sha3-384", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475823, "uuid": "7c62fe5f-7496-4631-9af3-297eb102d701", "value": "T103C507FED3A7DD29F07E4274542112152321F6A6B833C72E378EB10DBC1EE5469826B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475823, "uuid": "40e80765-3208-46e6-a8eb-9b8108864c23", "value": "24576:A88888888888888888888888888888888888888888888888888888888888888P:qSimUYVwbIEvv5wy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665475823, "uuid": "af34ad07-0406-401a-a33e-d3c5bf76e745", "value": 2643623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665475823, "uuid": "66a8d715-a31b-49f7-ab56-cb1bde85874d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475823, "uuid": "bcc0bd2a-5b8f-4da4-b6e4-733a5d3c08ef", "value": "c2cc3f6b4eb79daf2ba83d94ea94f4000fe9be22edc26cc196e29bc391c3a38e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd97583e-49bb-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665530674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665530674, "uuid": "9aed0292-ca5b-469e-b476-42ff3bae1039", "comment": "Malware payload", "value": "ef39bc7abc6e1724602e92a312906da2", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665530674, "uuid": "17b71b13-81a7-4780-b993-d49a2f523f66", "comment": "Malware payload", "value": "c2dc8ae4e68d297e90310084523bbe91c2002b249df9fc0b138aee0e8eb97606", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665530674, "uuid": "17cedb20-6305-440e-9ecc-96467743de33", "comment": "Malware payload", "value": "b4974b81e1762720dbae57a2dfae76e5f98ad2b0", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665530674, "uuid": "8fcf33f3-845b-4f70-974c-e651787522fd", "comment": "Malware payload", "value": "d585f63f70dc08bd56a6922fbd733347ae7f94306d62fb8e07ee8e89b778398215bdffd05b1f3a43c56d4f72f1c83691", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665530674, "uuid": "39e5a692-d875-457f-9c76-b7a43e9e187b", "value": "T16225122F4C17E9A85BA887797E7B0478320B61E4E1AC20DD9F84F0D2B6C183E855F5D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665530674, "uuid": "b491bf99-0922-4d6c-bbfc-85c7a5a5e94d", "value": "24576:x4lo6Nrgvi+PR6IpqaF8hhYQCDCjH3Kyp0PmDtD7umH9:AcVMawYAL3D0de", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665530674, "uuid": "b0be9867-10bc-4ae8-b3e0-1bdaed5c46e5", "value": 975515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665530674, "uuid": "ac0b7746-75f9-46a2-9d5e-e65093e0aed4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665530674, "uuid": "43a24ef7-f3eb-42e6-9458-f3742dde1a01", "value": "RFSL_9895.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "044c0224-4965-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665493373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665493373, "uuid": "59fa90f0-d5f6-4dc7-8172-69d0fa42a771", "comment": "Malware payload", "value": "353f5cfac2e5b7f770051477c7b78ac9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665493373, "uuid": "e31e6ba5-e380-48e6-b5fa-629bc7d32ac1", "comment": "Malware payload", "value": "c39d9603e5b2907a24021cef358a9509a650dd1c60b766ece0565e1c09c4765c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665493373, "uuid": "b35e69e1-9bae-490b-af52-aeeb3a2b9dbb", "comment": "Malware payload", "value": "3916c0ca90fcfa857dbaa9645da3647ba1b73af9", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665493373, "uuid": "085d90c4-9ef2-46c4-b310-eeb2f08a64d7", "comment": "Malware payload", "value": "7c1f9661a6d8280490b93353856c070256be30ef3f55fd96dfedd614fb93571559be740ea745618c920bd27083a53b73", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665493373, "uuid": "c18cf9db-9e18-41b9-be75-233faedb955d", "value": "T17A764A8A67A8EF34C4B89136114A273516664D24AA43D3C7190CB6EE7CF3DF44B86BDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665493373, "uuid": "fa461703-0d0d-4211-961e-5041ccbe1c7b", "value": "49152:nkj8EWKMaicWqVlMfw2tdcxW2MNb7jBSG3KHgQApYoitcQxWsVpt02zx/Aamcfko:nkgfKMv0g2i002zZ9mcfkrSq7Z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665493373, "uuid": "91589a25-2fc6-472b-abf2-bcb9f7043088", "value": 7511413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665493373, "uuid": "47d28d8a-9d05-4cdb-b323-1f29222b531a", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665493373, "uuid": "1e8c5e48-05f7-498b-9dac-b107f7e1cefa", "value": "Zarz\u0105dzanie_po\u0142\u0105czeniami_Telecom.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3137005-496b-11ed-9266-42010a9c0072", "comment": "Malware payload (NanoCore)", "timestamp": 1665496243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665496243, "uuid": "4eb3482b-2574-4ee1-afd3-d75562868dfd", "comment": "Malware payload (NanoCore)", "value": "1d00728cbb02b69a8cad3f032be410c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665496243, "uuid": "768a8cf9-7699-4ce4-9ed6-aedc29adc90c", "comment": "Malware payload (NanoCore)", "value": "c3fb8b20af40e3a6905a1190d657bd725c241efa3d91d0c0e1546f2b8ae8a2ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665496243, "uuid": "b2212df4-479a-447e-9e62-fea4f79d43de", "comment": "Malware payload (NanoCore)", "value": "a803d959e77cdbec645288fe922d12e6888a209a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665496243, "uuid": "d5d4edc2-a488-40a4-8efc-6cd1ec6b472f", "comment": "Malware payload (NanoCore)", "value": "2260e56eb994cf015e50fbafcb934c1c7108522e12a982f5a562ea256ded80341dfc7832526d9c9bbeda3486ce88a6cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665496243, "uuid": "01711b9c-8411-4983-89e5-f018f4d83098", "value": "T1BB7412548A14C523D9E70B7039AED37AADA4D92210F9C75F5BB09EAC7C22252DE0DB43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665496243, "uuid": "31620443-f9c9-4cd9-bf51-d5205fd331bc", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665496243, "uuid": "e8160a76-7b33-4ec9-886b-c6ebe6e00393", "value": "6144:HNeZmLE2rXehVTdEMLjtEkzKJg5/mnc52iOu0anAU5hvrBAVGFryDgvMar819nYk:HNl9KhVTtLjmkzufc5D0aBvrXVkgzr85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665496243, "uuid": "b9f63ea6-e1cb-4f67-ac1f-5b6af543ee7c", "value": 364461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665496243, "uuid": "42d4b358-6854-4514-9b65-0df2c997c3bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665496243, "uuid": "ea95665c-fc68-4d15-89fa-17c93e90622e", "value": "PAYMENTTRF889020022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d031e00-493c-11ed-9266-42010a9c0072", "comment": "Malware payload (NominatusStorm)", "timestamp": 1665475858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475858, "uuid": "b539c741-1d68-4ee0-9b05-3a998c3823b9", "comment": "Malware payload (NominatusStorm)", "value": "4647bb53eb893013f8c752f2b550ae81", "object_relation": "md5", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475858, "uuid": "b9a80d28-c061-4af4-b56c-b761edb88bbf", "comment": "Malware payload (NominatusStorm)", "value": "c4a8a693c9fff83884b78c8dc44b2bef1cfa750acff6fecd6eacd79531a87889", "object_relation": "sha256", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475858, "uuid": "115524b4-cfcb-4721-8f72-fb952aa25e58", "comment": "Malware payload (NominatusStorm)", "value": "5779a312940e1b8dcc587fdf22f94ec220c1db4b", "object_relation": "sha1", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475858, "uuid": "740045f3-cbed-4e86-b5bb-6bf280309fb7", "comment": "Malware payload (NominatusStorm)", "value": "65f2513ff9ac47b3480c2577dfec142b0fde2bd44f9f26eba8f171a3151a61ba8b57f7b4e3ed4504893635bbb6373734", "object_relation": "sha3-384", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475858, "uuid": "325506c5-5a9a-4fa3-9724-3eae021dd3cb", "value": "T121D409146ADB403ED77F0733442691472231B9BB5F234AFB50A0A77A7B3D2D189B19E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475858, "uuid": "771a8795-1888-4064-883d-907dcca6776a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475858, "uuid": "5b436f3d-9fe6-46b2-afd2-bdf02b56f45b", "value": "12288:lKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKN7ChJ3WMQCbuvsf1/8EYsi:lKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665475858, "uuid": "3e50fc58-4847-4e09-af1b-eca0cba49952", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665475858, "uuid": "eb2bc9ba-f8e0-4403-be8f-2e47065c626e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475858, "uuid": "0100d636-26fa-4188-907e-ed39cdcc347e", "value": "c4a8a693c9fff83884b78c8dc44b2bef1cfa750acff6fecd6eacd79531a87889", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f7d1d9-493b-11ed-9266-42010a9c0072", "comment": "Malware payload (NominatusStorm)", "timestamp": 1665475556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475556, "uuid": "05345857-d171-4022-bec6-bae42ce9cb77", "comment": "Malware payload (NominatusStorm)", "value": "0f670067ee229e8de79be7130767419e", "object_relation": "md5", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475556, "uuid": "bc2cdfd1-2eb6-4422-8dfe-fc0314c238d1", "comment": "Malware payload (NominatusStorm)", "value": "c4cb3231af4b18f80038d2ea658884027117343583b6244991484d631eb2e571", "object_relation": "sha256", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475556, "uuid": "e9bfed30-917f-4e38-b4a3-4aec22e84977", "comment": "Malware payload (NominatusStorm)", "value": "f97153c22b1c4579bc978ace00ba3e2c65a61e57", "object_relation": "sha1", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475556, "uuid": "b5969d43-af09-48ce-9f51-2952f3fe5846", "comment": "Malware payload (NominatusStorm)", "value": "6eb9e8bf294743269d64f13160f08fc6167deb674c3be09d6570a4792116a36d595bbaf53a2a45b65a81a00c770a9088", "object_relation": "sha3-384", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475556, "uuid": "db1d3557-e2d5-44cb-bb39-a7540931d99f", "value": "T1618628BBC26BCD29F47D19312414120A3720FAA5B86BD79E334FB55DAC2EC4879513B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475556, "uuid": "ed8b05b9-c9b9-4d60-951a-84a0bb82dc9b", "value": "196608:uf7ZEJhYzD3BiExsDuGAvuiYV351yIsJHf7ZHk3N1gz:uf7ZEJezD3BiExsDuGAvuiYV351yIsJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665475556, "uuid": "28e6095a-379b-4edf-8435-c122347dbfa1", "value": 8130802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665475556, "uuid": "5c1c7bff-a788-48a7-b834-36c0a170cddf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475556, "uuid": "6330b4ea-58dc-49e3-adfd-edb9f5c33183", "value": "c4cb3231af4b18f80038d2ea658884027117343583b6244991484d631eb2e571", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "480f8470-493c-11ed-9266-42010a9c0072", "comment": "Malware payload (WannaCry)", "timestamp": 1665475877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475877, "uuid": "1c9e6833-1be6-4f2d-8f8f-967af308c2f0", "comment": "Malware payload (WannaCry)", "value": "14baa82b3b48237395b7f0b43927229f", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475877, "uuid": "1f721ded-4163-459c-b5df-988266cfb333", "comment": "Malware payload (WannaCry)", "value": "c627a3087882305a308806c37c86758102f1a0f670abd8318d9988d4ec34aca6", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475877, "uuid": "0386e868-0d30-43dc-b357-4dd68d7817cc", "comment": "Malware payload (WannaCry)", "value": "99b382b9b239db3a3a0cc34ade673d6071b773d8", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475877, "uuid": "832c3ad3-9a23-44ec-bb42-50ff3b093e98", "comment": "Malware payload (WannaCry)", "value": "5828ba2e20f913e38b48bd4bb0383104fea3ab027a6123b91c305c86af05ef58e99eefdcf91fcfa6edd01e439386c639", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475877, "uuid": "9c6ba533-6128-4eb3-b528-0297883b66a6", "value": "T136363358713CD2BCE1450DB804778A6AB7733CA566FF9E0F9B4086660D13B5ABBD0B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475877, "uuid": "86ccce2b-d218-4524-9106-b928a104a625", "value": "9ecee117164e0b870a53dd187cdd7174", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475877, "uuid": "dcf406d2-64c1-4353-9269-d8ced5ac12a3", "value": "98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P5N:yDqPe1Cxcxk3ZAEUadT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665475877, "uuid": "0efe2c09-9c61-4cae-8ac2-c8ad7e6ed096", "value": 5242876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665475877, "uuid": "03380d5e-82fd-4d92-a649-c7de88a54804", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475877, "uuid": "36ab728a-07cc-4ba0-bc25-45df01261522", "value": "c627a3087882305a308806c37c86758102f1a0f670abd8318d9988d4ec34aca6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3280c18a-4937-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1665473693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473693, "uuid": "fd1aa9ee-eedb-4f32-ac69-42ad7152bd00", "comment": "Malware payload (AgentTesla)", "value": "ec85a368488a7972f2a6977def2c95de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473693, "uuid": "c1265877-7c19-4d6f-a66a-609760cee7ab", "comment": "Malware payload (AgentTesla)", "value": "c837d46a2947aa9bc4c5c85f524c6e7cd796a9d8d97f5e59fc952e396d6b9662", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473693, "uuid": "d2320e2d-b911-4b79-a412-6bc8efdbd086", "comment": "Malware payload (AgentTesla)", "value": "0f297811bc7773abf0d8a27f8163fef06633884d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473693, "uuid": "ce536bea-5af1-4a8f-9c7f-89f012c27e45", "comment": "Malware payload (AgentTesla)", "value": "aded58088d0ec4be5a3e31861cc2eab3d1654791d5e88901207068a1b0d3ee6e612bf4e81d865a1b4b30fd119dffd9b3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473693, "uuid": "f32a8d5b-0400-4540-927a-8ca7adffae4e", "value": "T18D74122423A5C6ABDDF61A330D767F3CCE6AA52304F9830B13445B5E7E21B86971E316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473693, "uuid": "e2c55d3f-7cca-4401-957f-d2e4c7cec2a4", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473693, "uuid": "91e748f0-0b9e-433e-ace1-88237fcf4514", "value": "6144:HNeZmpOPi//S16vVaENu/XugOUtMQY0f2UWjxrCqswIVOjZJW8c:HNlpOPI/S16v+XpOUtMeFUxrCqswRzWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665473693, "uuid": "10af1dcd-d623-4c31-9566-ba3395a92e76", "value": 339071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665473693, "uuid": "e103886f-a93d-4e05-8245-6efdab0fbe7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473693, "uuid": "151f2955-4146-45b8-b312-92c3c6327211", "value": "RFQ 1 DESCON - PORD-2022-0461.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c047543-4937-11ed-9266-42010a9c0072", "comment": "Malware payload (a310Logger)", "timestamp": 1665473763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473763, "uuid": "009ae5d2-97f1-44a6-ab84-e38a0b04a3f0", "comment": "Malware payload (a310Logger)", "value": "915e003163fe3be68dafaba951747c36", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473763, "uuid": "a5320c21-4a49-45a7-94c6-f47ced1a8606", "comment": "Malware payload (a310Logger)", "value": "c837f6bcf3caedfcc26ee72762a58bbada283013ef4d1c766a18c3e6a0bacfa1", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473763, "uuid": "faa7ab74-3698-4174-882d-d76aac0ed8dc", "comment": "Malware payload (a310Logger)", "value": "e6b1bc98e4817a8dcb547fdbab6598a74f13224b", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473763, "uuid": "6ad54fdc-19d3-4c5e-b764-cac3d0180ea2", "comment": "Malware payload (a310Logger)", "value": "53a20176dc2292ce56727f86481ba2e0ec06fd8713e3bb5bde79315017f7f0ea5a8b06992d6e1acde569297eea564e02", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473763, "uuid": "8b29e791-bb25-4c44-b098-d85a4f281928", "value": "T10255E13617DACA07E3416278D0D0F3F9CB699EA4A87BC743BEE52C5FB1487529911322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473763, "uuid": "5f60034c-2a28-4b9f-8a54-c1d1340b73ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473763, "uuid": "f3004a3b-632e-4962-8112-aa9c9b29e379", "value": "24576:H12PEaqDn/8s1QhG5rYPRKLJ4P9ZIxUV3Dv+tNH:Huqz7QhvP8LDxwTmtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665473763, "uuid": "e8d52beb-c0ee-4e9b-8a3b-8f9d3bd99550", "value": 1309184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665473763, "uuid": "70df77b3-ffe1-4cf9-975b-83c952b410b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473763, "uuid": "f259f413-cf18-4f0e-bbb5-4ea9db9fdc68", "value": "c837f6bcf3caedfcc26ee72762a58bbada283013ef4d1c766a18c3e6a0bacfa1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c38c77-490c-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1665455519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665455519, "uuid": "39c01c81-f17d-44b5-a09e-55cd0ffe96f7", "comment": "Malware payload (Smoke Loader)", "value": "6cc8f230328fc32cb709b946eb8284fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665455519, "uuid": "5e8c0719-60a0-4ca6-957a-98c066893aee", "comment": "Malware payload (Smoke Loader)", "value": "c988eb187359b3a03970c04d637d713b7d0d60d4b1abce8aa663ca4ed1dfcc7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665455519, "uuid": "33d2fcc8-d33c-42c8-8a4a-cd56f0c9eced", "comment": "Malware payload (Smoke Loader)", "value": "6c1e0cf00ec2ece87354144b3b18b931940c02cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665455519, "uuid": "47208a30-1460-4365-9783-d4eb0946e184", "comment": "Malware payload (Smoke Loader)", "value": "08ecd7295fd5af391123eacc921b6399fd4df4a5d0a3664cbb1ea3902aba62fa83d4884e7f72693bd888f9776f2adcef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665455519, "uuid": "e6f2ff71-885c-466c-ba38-295f8eb31d62", "value": "T1D624CF1236C0C0B2E6631638CC65C6B56BBBB8751A759A8B7BDC076D4F312D3EE21346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665455519, "uuid": "a7fe19b7-5fcf-4fee-acc9-2b1f2b46c285", "value": "78ee95c35be8f9cbb7d14afcce7e80bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665455519, "uuid": "40399c8e-11e7-4c80-a789-98bda95838c2", "value": "3072:is9Z+o/XGfAKEiz7zLv4oXt1iRGj2qB8Z4JfZ9rKf4drOgNMe0LPeSU8cO:isr+DZzLv4o91hS4JfZPrOgN6TeS3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665455519, "uuid": "ac05bda6-6b1c-4b09-b621-5a182ed147af", "value": 215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665455519, "uuid": "9624e412-d18e-432d-ad55-9937530baa3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665455519, "uuid": "dd8d92fa-033f-4b35-be5b-c886e596505c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a9ebd1-4951-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1665485194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665485194, "uuid": "068027c7-74dc-41f6-82f0-346fb407fd2d", "comment": "Malware payload (GuLoader)", "value": "4f4e053ddc2ceddb532e8786540c249f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665485194, "uuid": "cf0c3c4c-044e-4c6b-a2a4-29335a781c1e", "comment": "Malware payload (GuLoader)", "value": "c99e5d501ac5c8bbe555461e1fbdaab837b6d2da32b272a42050841b0a6f3378", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665485194, "uuid": "6b8f1085-e1fa-4b21-80a6-664132cee83a", "comment": "Malware payload (GuLoader)", "value": "ee0a5290010d82e50f210942c7386e94675d9ff3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665485194, "uuid": "679941fd-f6c3-400b-af30-4b375763c1a1", "comment": "Malware payload (GuLoader)", "value": "f860493a159236996eb43351ea1c2f4fafd53f208a4a818283d250418fa2b407a38cab38593f313f8eb86fd23b2437ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665485194, "uuid": "c168ace6-0496-4b14-8bfa-8b9df367586c", "value": "T11F052346EB40E6DBE89D46B1450F3368AB9D8A2750B6674FC3883F1B3C155A1C23B396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665485194, "uuid": "e44cae51-534f-442c-8130-4063cb893781", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665485194, "uuid": "42705433-4f2b-43ab-8b74-d07dd1e0d4c9", "value": "24576:QpmLdHtXxRwmhrxUlmLf2G0sdAPQjjNcMG96:PxVxRtUQQGmEjGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665485194, "uuid": "d741dcf8-31e9-406b-90c6-458ad285ee63", "value": 835821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665485194, "uuid": "2f930753-13b4-4b54-8da5-97b177c80841", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665485194, "uuid": "120b0135-c56f-48f5-a0ee-78f861ab8bab", "value": "DOC Shane inancial Holdings LLC Transaction Information 11.10.2022 .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c4eda6-494e-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1665483737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483737, "uuid": "01ae9594-b753-4193-9e6b-855d3c846849", "comment": "Malware payload (AgentTesla)", "value": "d94078ed71ebf1207e912f034f4299ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483737, "uuid": "ee14a3d4-f38a-45df-9d43-07fbebe70237", "comment": "Malware payload (AgentTesla)", "value": "ca996291d4ae9a2e2dc94525ca9755984d8cf1d75dcc035e01a2394912edf575", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483737, "uuid": "78813cbe-1594-4014-86e6-2d9904f42675", "comment": "Malware payload (AgentTesla)", "value": "c9c98ba63de1553e4f191ad6ce191080aadf1bbc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483737, "uuid": "24a8fc42-79e7-42ab-926b-95f39767d0aa", "comment": "Malware payload (AgentTesla)", "value": "2517139461d90f6c660a95e63f61fabf66e6f9149f359c1c0e8028ffe7cc37d793b96b628e2d8a3f43dac41119a17e5b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483737, "uuid": "1f601663-056f-43f2-9037-1b95ed288861", "value": "T1E435497E25964907DA543131CC83D1B327FA6D68A272D1DB7AC32F1FBC512BF950228A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483737, "uuid": "aa01311f-0ae9-4328-b1f2-157fc44af7b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483737, "uuid": "74fe331e-0568-43b3-b30e-ec55a126769e", "value": "24576:Jz2L7mr+BHtjK1TVxS7BvBsXnLAtQy4A:4vtjEVwzqnOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665483737, "uuid": "f103294c-0453-48ac-8c9c-0e110a375183", "value": 1101312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665483737, "uuid": "f28b80c2-b9db-4baf-90ab-885451f19d39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483737, "uuid": "eb0eacc3-dc01-4df8-8d7c-d598b22b488b", "value": "d94078ed71ebf1207e912f034f4299ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f76a914-4999-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665515886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665515886, "uuid": "2d254ba2-9329-4c29-bc8c-31bdba4f9543", "comment": "Malware payload (SnakeKeylogger)", "value": "fc54330d4983157118ba6163532e7041", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665515886, "uuid": "4ff667d8-4b04-4e55-878f-8de51c290350", "comment": "Malware payload (SnakeKeylogger)", "value": "caede2f1fafdb819746d0dca09b823d6404f39119d2a43437ec72cd23a55582d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665515886, "uuid": "e81d2928-ec88-4daa-9b91-91a012908046", "comment": "Malware payload (SnakeKeylogger)", "value": "7bc568b28e7962531c536da098d3b551f851aacf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665515886, "uuid": "8a4d3d89-cc19-401e-b1dd-626f2f43fb75", "comment": "Malware payload (SnakeKeylogger)", "value": "6fb7bfe9197cc3bd21c0f6b44c864aa4e9c86107f311837f0da20bf42cbf2261610f2dd990e08414b20612deb9bf0ef5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665515886, "uuid": "0c2a51c6-3fb9-4bc7-be70-409fd2fddb40", "value": "T179440270EB6DE673DF7C32301674884817D6BEC67258DD88DA489A08055BF283E36B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665515886, "uuid": "900851af-d683-4726-929d-3efb3b1eaabf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665515886, "uuid": "82afac46-8454-4db7-b360-c4e8351c0521", "value": "6144:wDBkuri/tJaPrfxvwrgfqdiEdeW+MMK/xBf:w1kwMAzfxKgSky+k/xB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665515886, "uuid": "4d0d44fe-a89d-44f7-a4ed-bcfcf53843d9", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665515886, "uuid": "e8d7e707-923c-4e34-9ef1-dce27f34823e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665515886, "uuid": "2c9a6e1d-9f82-4102-841d-baba1925faaa", "value": "Remittance Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bedf4611-49a7-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665522032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665522032, "uuid": "29f77447-9b7f-444b-b332-b38f5c48667d", "comment": "Malware payload", "value": "628c75f61ea69dddf4701be60aa7ec4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665522032, "uuid": "ebd4a8d6-035b-45fe-bf47-39a5b4e7bcd4", "comment": "Malware payload", "value": "cb547d8b09b79bb5bc8bf64e204117ea48e4d33ef51b85069fe6a2babe3050fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665522032, "uuid": "ab0c8578-44d7-4aec-a636-702b06bc8a2f", "comment": "Malware payload", "value": "2cb7ee2d3e875159573d16db3ce69d2aa616cc0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665522032, "uuid": "b90e41bf-f8fd-4d17-985b-f6d5f3a25d10", "comment": "Malware payload", "value": "3036618b23e113a369947ba04d5d03147fd4dc61af41884d962b0c3095dd673d4dfa9c8e24225875141454f2ac3f08be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665522032, "uuid": "c9fee8c5-a355-4296-bb42-179f991d5816", "value": "T1D824BE1135C0C072E22626398C65D6B56FBBFCB95B3556DB3BC8276D8F322D29A24303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665522032, "uuid": "483b5fbd-510a-411c-9877-669e8b2d1375", "value": "e680a2b40b54e6ebf1523763588728dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665522032, "uuid": "1f8b32ee-2865-4532-a91d-8fd1bcac2b6f", "value": "3072:KVe2u4Usgf5bLDDC4Gs7YN3YX3GALPRnMC/vG+jx9HoGCO:KgU+lLDDCPN3YX3trRbG+F9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665522032, "uuid": "5fb23307-0ced-470e-940b-a2b9540f92f9", "value": 220672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665522032, "uuid": "cf6235b7-56dd-45fd-951f-2002b614dbd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665522032, "uuid": "7293ded6-210c-429d-b340-a28085d57c89", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c735c7b-498e-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1665511103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665511103, "uuid": "b81aba3c-093c-4283-b879-0158a74595b8", "comment": "Malware payload (Formbook)", "value": "9ac60b2eefff30e9ca7ee5ca3a074322", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665511103, "uuid": "47c8bf96-907f-46fc-8dd6-e5187c1bdaf0", "comment": "Malware payload (Formbook)", "value": "cb68859e3e976870a550cc5b49b0ab0f4f07870e26ca45cff21359e71f0444df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665511103, "uuid": "9a13f031-2db5-4544-bfb9-8fe0a6e338d2", "comment": "Malware payload (Formbook)", "value": "c04b2f19a691b8335c08b623f528edfbd49258b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665511103, "uuid": "8ac2bf30-a518-4751-b59a-557de61c3da2", "comment": "Malware payload (Formbook)", "value": "9716764d698aa5129d35fce3fd0659e20427292887287a948e1bfbaa2f5328c1bb0e1c40456836e83f26aa543d78665e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665511103, "uuid": "6ca70087-a9c1-4816-bf6e-9c43c4a7f609", "value": "T1BF356B7E2A9A4907D8157231C487D1F32AFBAD506062D1CB6AD72F5FBC413BF950238A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665511103, "uuid": "0875e3a0-afa7-4d04-b74f-8bf18b98b351", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665511103, "uuid": "f2530dd3-c5d3-4f5d-a4e1-a32979326c1e", "value": "24576:3pGJ7qNUQgSikc8qA3oVq/aZ5FukBAtQy4A:Ddg5kDIQQaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665511103, "uuid": "a1f4680d-7c06-488f-9bdc-28d782b431fd", "value": 1070592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665511103, "uuid": "368ed10c-10a1-4e7f-821e-d6d12eb85c48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665511103, "uuid": "dd24a338-5870-4570-bc65-abedefb7929b", "value": "SecuriteInfo.com.Win32.PWSX-gen.28940.23978", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09692603-4997-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665514856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665514856, "uuid": "97f01a66-2c53-4f8e-9f84-3c88d020b82d", "comment": "Malware payload", "value": "99ad20c107ba08621551ce99cc93e6de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665514856, "uuid": "af70d66d-45dd-4f8a-9f81-856547ab02b1", "comment": "Malware payload", "value": "cb888effce240bdaabf6790397a9764135685b653fc732cb83d08f850434b354", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665514856, "uuid": "7322fd4b-41da-4d95-a7aa-54882de3271c", "comment": "Malware payload", "value": "6318e4c1003184fe2f347cb0120aa6f97fc75851", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665514856, "uuid": "89e24bbc-e33e-470b-bfee-563bdaa4fffd", "comment": "Malware payload", "value": "c1d4956ea4d363e9ce9a9382c025c33c173314656cd05075b3ee546fd28a1fb08ea9ce07e68b535875aacb65be835907", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665514856, "uuid": "4c511865-19df-4321-8fbd-f95767548d72", "value": "T16A7633813FD4EF7BE16118B21B582FC3B5E799750D505C93ABD401AC0BB8852D2FA87A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665514856, "uuid": "00a83f20-1270-40c0-9541-955bd9f9936e", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665514856, "uuid": "9e8b32ac-c299-40b4-b1b2-e225ba7be402", "value": "98304:91On8Ak1pKum37b514ugdSRFQ8S2asRc6eBSNB8krY/PCDIY5kyThuXFxNt17N9r:91OnMmrVVmeJaoeOOqY/PNxyTh68v4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665514856, "uuid": "f648b39b-a12f-4303-952c-4379c3789fec", "value": 7591730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665514856, "uuid": "c9e67bb3-5de4-4a5d-acaa-e2a8c2dbba95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665514856, "uuid": "8e6c0a99-b848-4b9a-86b8-370cef0bea32", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "002829e4-4961-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1665491648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491648, "uuid": "9a04b3f8-e6fd-4eba-bf75-4ebd31374365", "comment": "Malware payload (Smoke Loader)", "value": "dccb3894da2926eef9ec0b6310967c3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491648, "uuid": "10723795-d3d2-4b2c-8a4f-afc286afd112", "comment": "Malware payload (Smoke Loader)", "value": "cba1e1b3ae358d0462d8d060079791887499c6fa9ca558582af96fa61cf5d0ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491648, "uuid": "1c3c3fd6-9acc-4f38-883d-7f83e9e38a37", "comment": "Malware payload (Smoke Loader)", "value": "26146d192e9bc185df670b8bafa7520ea6edc93d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491648, "uuid": "e7e597b0-33c1-4d9f-920b-04e25ea50567", "comment": "Malware payload (Smoke Loader)", "value": "72adc28ea23912dbc102770285a9570265bbd93821badf5524c8ae78abfdc8b513aae1234fc11d141d8e24f12f2a636f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491648, "uuid": "c18ce15a-b83c-4014-b504-b6001fb5ad8e", "value": "T1E524DF2235C0C072D29616788CA4DBB46FBBFC711B3956AB7BD8466D4F312D2AE35342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491648, "uuid": "61694955-132e-4f14-a31c-5b7776bf5fe2", "value": "4db5fa00d6d53e828ab0bf90238303f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491648, "uuid": "6bd34894-a523-4fb4-985b-09ce4f326627", "value": "3072:3/jg8f8QV27rLq9I2/t84VwXMUbCHAIh2Ht1CrR5dO:3cZtPLq9I2lw8UbTIh2Nsrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665491648, "uuid": "38023858-9094-4e61-b6c5-d28eef228988", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665491648, "uuid": "1600b3f3-1e50-4e09-b5a2-dc63c35c1398", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491648, "uuid": "b4875874-3f54-4d33-b7e8-590ef1b0d27d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7529faa-4995-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1665514396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665514396, "uuid": "ac63c508-1383-4773-a8bb-56e7352c7323", "comment": "Malware payload (Formbook)", "value": "bd8094e710362d51234298ecaa856ca2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665514396, "uuid": "af9a38e8-7d2d-4d5e-8908-72005de71ca2", "comment": "Malware payload (Formbook)", "value": "cbaab74c7babdfbadf51792aa697c1b752d0b7eb1a1f06a95ba81e6b3e911b01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665514396, "uuid": "1daf1157-e1d3-4319-a908-8776705cc686", "comment": "Malware payload (Formbook)", "value": "85002db38b117d2e4028b9dd45c5485e87a73a31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665514396, "uuid": "47e2e8d4-dc8f-4ca5-8916-a14738480c69", "comment": "Malware payload (Formbook)", "value": "4eae7231842528e89e22fbd405410485afab6134f86df91b32327888943de9ca2a637eebc40eb93c85d35f62eef85909", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665514396, "uuid": "221a515c-2db0-4c6f-ac11-079a696c74c4", "value": "T12B357C7E269A4907D8157235C483D1F32AFBAD506062D2CB6AC72F5FBC512BF950338A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665514396, "uuid": "94eea9b5-5eaa-488c-9425-5388585308d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665514396, "uuid": "0251e03e-1ee3-4d44-9761-c728dd44d12c", "value": "12288:6iPpOUshSbtpcJAZadE6mKCM9OrDPg29RAQSQy4A8:6iRZbtKJAyl59GT3DAtQy4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665514396, "uuid": "4abb2e44-81be-4c58-ab2b-e634f0ba790b", "value": 1070592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665514396, "uuid": "9f82c506-39b8-4c93-a21c-1031b75b600e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665514396, "uuid": "14c5f4d1-be6c-4062-8357-e1bf702ccb68", "value": "muestra de orden de compra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "867b046b-4913-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1665458372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665458372, "uuid": "b4865a36-dcdc-40bd-8b69-b21fea76c9ea", "comment": "Malware payload (Smoke Loader)", "value": "59389b3a545e206ccd09b43591ff4e24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665458372, "uuid": "f073210b-a3e3-48b6-b043-eb8d14a9e2de", "comment": "Malware payload (Smoke Loader)", "value": "cbdea9d90dfd7308d6fbf957539d6357d86d6b3defc1b3f1ce9b03b6c37b7f9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665458372, "uuid": "2735e7c8-dee7-48df-a834-e43605975aca", "comment": "Malware payload (Smoke Loader)", "value": "b998c52a20099ad6d258ce57f9e7c3230f8e1081", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665458372, "uuid": "0a534ad6-91ac-40cf-bc3f-9b7e0c2ec558", "comment": "Malware payload (Smoke Loader)", "value": "a528e725202092a3c57ac55023da5faaa91ed3b4fe31e2189272f1d6c7150dc13b3b95932152c5f0b238e8e01673dbb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665458372, "uuid": "a21a35f8-d409-4e77-8333-c76574e2b917", "value": "T1EC24CF2232C0C472E26656348C65D6B1AEBFBC701E358A8B3BD8076D5F366D2DE25347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665458372, "uuid": "77dd548d-786f-4f29-8b54-b6c8692fb92f", "value": "78ee95c35be8f9cbb7d14afcce7e80bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665458372, "uuid": "902e7d37-0b11-4fe7-87f4-0e16df89acdb", "value": "3072:js4FTo/XrpAS7RENLIwlcvRGD13YHW3wNgF/q2aTWrfiT3Ig05afO:js8TynwLIwlcW3W5NgsKLoB5f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665458372, "uuid": "3c94f7a9-81e5-4d8d-aece-963cd32997db", "value": 215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665458372, "uuid": "dd378311-5887-4b55-a6c6-453717defa01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665458372, "uuid": "3ba71f23-7b88-49f7-94b1-e1aafc43d809", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7736084-4918-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1665460602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460602, "uuid": "1fb98001-1fad-4335-9778-a3be86d489d0", "comment": "Malware payload (Mirai)", "value": "daa9cbbd0d8bfd3239cb9a4212f73452", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460602, "uuid": "ec231595-907f-42c3-a6fb-70951da3e899", "comment": "Malware payload (Mirai)", "value": "cc76d40ee8d0a3f9bc01481d617c4bbfd5b9f552cdda93ee1af87ddcfc3d110a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460602, "uuid": "6d3557a0-588a-46b7-99ab-8a3ad7f5e46d", "comment": "Malware payload (Mirai)", "value": "def5b3459e2892efef6ab587d9c2a5fb77bcf3e9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460602, "uuid": "8b8025a1-a32a-4eef-8694-f8933189272e", "comment": "Malware payload (Mirai)", "value": "d36e42944e57b996c720aaab8b21c584e69d212b9843729e55f5d1c681014200bf3f949f4cd4555e63c11dc9b1cd7665", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460602, "uuid": "18eb240a-8042-4075-bd0b-ced7dad80963", "value": "T1D496E091FF47595ACB2B9B31119A0FA8E331CC4777038BDF1628C469DC6378A9D21AD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460602, "uuid": "cc066504-622f-4d94-9f45-c0194bafb242", "value": "98304:XgJ1jikGonRhpkKCLlpAxFka+D8bA/WEAtTcx60lGUF:X8xikXCKCJpADkcbEAKxXIUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665460602, "uuid": "e1eab343-7597-4986-87e8-9e95fb778a8e", "value": 8700309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665460602, "uuid": "5e7d14c3-6e8c-4db1-bda2-4eff9ab6d7c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460602, "uuid": "00c49965-1141-43aa-9404-2393af4291ff", "value": "cc76d40ee8d0a3f9bc01481d617c4bbfd5b9f552cdda93ee1af87ddcfc3d110a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a48e17-495f-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1665490848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665490848, "uuid": "b0916dbd-bec3-40ea-86dc-043ce22c58b7", "comment": "Malware payload (Loki)", "value": "17fbfeff461f7699a5030a39515da9e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665490848, "uuid": "951eec8c-b0ce-47c0-9f1e-f3fe9e5c9628", "comment": "Malware payload (Loki)", "value": "ccffa2c388af2b3da210647b0f7be25a53cf7a4c6f99bf4b64987e881b763e23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665490848, "uuid": "e45b3441-2566-461e-b186-d76f71556441", "comment": "Malware payload (Loki)", "value": "96ab0813e976419985e47bca34f5add10f81471c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665490848, "uuid": "cf813db5-0f80-4bf6-8e3a-b820acbf3d06", "comment": "Malware payload (Loki)", "value": "1610081310577f992d9327b5800e757a80d7b8fea96ae179752d1a6a75265ffea36161810c07219b44a0cffdbe51cd00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665490848, "uuid": "91acf611-5061-4f65-bcea-2e66033ee1b4", "value": "T12E041280E7A1D5ABE4E30B774D35AB16AFF55B222A01124F23904F1D3B76481D20F7AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665490848, "uuid": "851dc26c-5648-4730-89e5-069e6415b455", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665490848, "uuid": "9d8f9d10-25e8-4db6-b795-df1e749c3fc9", "value": "3072:l1NjcVVnLpPunbVq5/0/XhZfomCZq0XPdvhHTe/mb3bfV987+eM5Bw5P2DQkFyiE:HNeZmQ5WhZfobUKVZHC/0x987Qw5yQE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665490848, "uuid": "b89b84f3-264d-4878-bf8e-30a5c7b0ffd3", "value": 189605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665490848, "uuid": "3c99e152-f5e4-49d4-bfdd-8cb260026b00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665490848, "uuid": "b8525616-3d5a-4cde-89a6-e06229640f79", "value": "11.10.2022_____Remittance Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92d8cfe6-490c-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1665455387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665455387, "uuid": "0935c0b7-fa0f-4752-83f7-1130815c1034", "comment": "Malware payload (Smoke Loader)", "value": "ad73029eee2c272c5a4f65c0df6be2d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665455387, "uuid": "c38de656-7197-4ed8-ae9e-d56777b7be61", "comment": "Malware payload (Smoke Loader)", "value": "cd0c0bfcd4994346d9ea0a771d68db4653c8fd09a2a4697567ee193ae210c804", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665455387, "uuid": "92b882ca-5edf-4f73-aa6f-9a596809462e", "comment": "Malware payload (Smoke Loader)", "value": "70e1c854d3ed5e0c13f85fc8dd00c3188ca2bd21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665455387, "uuid": "6fdc09cd-3f46-41c1-8d2e-247cb9fe0ad1", "comment": "Malware payload (Smoke Loader)", "value": "76793191ed1220d729117f0a3633e6e0adb23b9d076b5589ea9272667a942ef416a571684168ad1f0e38b00d94de438f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665455387, "uuid": "ddb78392-2715-4f76-8428-89f0537e9ceb", "value": "T1EC24CE2236C0C432E66616348C25DAB47FBFB8715A7997CB7BC81A6D4F352C29E35342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665455387, "uuid": "9eefd2b6-fc31-4308-aec2-90e9c8223aeb", "value": "78ee95c35be8f9cbb7d14afcce7e80bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665455387, "uuid": "e73c11e0-0793-4916-a05b-150d4be2edaa", "value": "3072:pbfdho/XDnAyBUnfLkV6kQRGz5b9fjKfww/0yWTPIM4stzSUrsysO:pBhCpcLkV6kF9www/AosVxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665455387, "uuid": "6ab8cc7e-851e-4704-84f2-8411fed02e7d", "value": 215040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665455387, "uuid": "5b8db86e-341a-42ce-8c84-a6e985738619", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665455387, "uuid": "5bd62fb3-f77c-4677-b7ef-eaadcfb2c0fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4278ce9b-493f-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1665477156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477156, "uuid": "7f8ecccb-6cf0-4d9b-a8e0-a11165e9130d", "comment": "Malware payload (AgentTesla)", "value": "4ceae717e45d10295a7471dfd91f7d41", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477156, "uuid": "45d1c92e-2cd1-4836-abd5-4ec3919891f7", "comment": "Malware payload (AgentTesla)", "value": "cd209162f459cf74f7848d74026493349b1ab9d2357fd61eea90214af13047e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477156, "uuid": "dc79c6fc-fd9e-448e-b771-cec87fdc96e0", "comment": "Malware payload (AgentTesla)", "value": "89252c17931272ec9860df1acd7cd2b4ce9edf16", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477156, "uuid": "6f963f32-cdb7-416c-a8ff-f5b080a9d838", "comment": "Malware payload (AgentTesla)", "value": "204670efafc66f37b44b6d33df989c3991d12098ad34d435c09525a8510d3e607f005b5fd04de77414cd620573ffb556", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477156, "uuid": "9a35346c-6ecf-4fd1-8f08-b5ebe72032f5", "value": "T18FC3F1313937638AC25C7E71EF4AE9BC4368AC522C55C981E646F59BC2B3E94C18432F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477156, "uuid": "a57b6d2c-52be-4bd0-a263-244919e46d63", "value": "3072:6EuUwCqib2lKwNdZBW9ytiUkOeSL7IdqDe6q3:/hb2lbzBW9MiUkLhR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665477156, "uuid": "028dc2d4-bf03-49be-ab06-8ac660d79133", "value": 120488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665477156, "uuid": "c3397677-19f0-4651-8f29-b1aeaec461ec", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477156, "uuid": "91a0c301-2054-4af3-a471-90c66ebd1011", "value": "IV22200102 11-10-2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb57393-496c-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665496660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665496660, "uuid": "8cd6ea67-bbff-4c30-831a-18d31d5981b3", "comment": "Malware payload", "value": "abb974fa91c3129677732235dbcefc2f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665496660, "uuid": "c35db78e-3856-4956-80f7-381c764c40e5", "comment": "Malware payload", "value": "cdafcc7bc094d89f02d5ea8529abedd613b96874b5226004c975af80525adff4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665496660, "uuid": "10bf8041-510d-49b2-af40-d24bbe6798a6", "comment": "Malware payload", "value": "0b86c07005c45eeb4f72d129e63276cf82b0f38a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665496660, "uuid": "026ffffa-68d1-489c-93ed-1734b7686377", "comment": "Malware payload", "value": "961f3dc4051ab119994d91ec2a51a5fadb1b148d79952c2d56670b14fbe7e3d3b6c33e1adce7358268bf76d955286da8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665496660, "uuid": "780cdb94-b073-4b97-9abb-9a238f87b8ac", "value": "T12504CF117ED4D034E7A30A314C72A735B2BABC7C2731997B5BC4760EEA72589B934326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665496660, "uuid": "f1a631c0-7e65-4846-aa64-134876b68cc0", "value": "5002bceb823d3d7321ac4b2e8ee9f66d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665496660, "uuid": "12103636-b118-4208-bd46-df8554e27b3b", "value": "3072:sNf3wRqQxKvxnsRcaCvzdSH0RVNTUyV5EZUA9dHS2AVzH:8PeyxTvR60RV2tZdSNVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665496660, "uuid": "ac075a04-1b04-4c7e-9293-bedff7de8eae", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665496660, "uuid": "96f13aff-ca1e-4a91-beff-38f9950b8110", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665496660, "uuid": "ad56a4e5-9795-4091-b889-5374047d1a7a", "value": "cdafcc7bc094d89f02d5ea8529abedd613b96874b5226004c975af80525adff4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f139f91-4989-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665508933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665508933, "uuid": "a94c46d3-28fc-4557-bcf1-40ddb033bfd5", "comment": "Malware payload", "value": "d6b0135c39c0f8730ff0b10323d68037", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665508933, "uuid": "6b435467-566b-4e93-b155-fd7a65a03aa9", "comment": "Malware payload", "value": "ced207add99a702c5dee43290054c0f2bb0a3da00ca57237506b86e3406f50c0", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665508933, "uuid": "fe417c58-e10f-4787-8fbb-75882f4f9de9", "comment": "Malware payload", "value": "cdc44542747e87890c24e9f9f2366cfc459b44cb", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665508933, "uuid": "be7d820a-519c-4f80-94bc-f6f383ef45e6", "comment": "Malware payload", "value": "4ed356b2965e1021ede691290ea2593a2c3a51a416df2438cbc36edb1234f498f383b2bdf53944b7df8f7338fb30e48d", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665508933, "uuid": "2470936e-b453-4630-bd27-34b4cb17f5af", "value": "T1DBE301606B31BEFDCC3DFE7E3A2064B983A69F4961351412B6C53C9C047B44A9F2A123", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665508933, "uuid": "105ecc92-09a7-40f0-a0cd-ae4a06edf3c9", "value": "3072:MLhbr4C0MElx2KDeZDpLHY6DH9eywPkOoshBmLk1:Khbr4CVElQTZtY6DdsHosR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665508933, "uuid": "343ab7ab-459f-48e3-be24-250a2059737c", "value": 150376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665508933, "uuid": "5c18262c-2d50-484a-a23a-eb8961d44b9b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665508933, "uuid": "fc6f998c-8941-45bd-88ea-f52d18141e09", "value": "FC22068032478332.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba6fb1b-49af-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665525221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665525221, "uuid": "593e2ccc-4550-499a-9924-04f6268eb363", "comment": "Malware payload", "value": "d9a356201937565242508264314f670c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665525221, "uuid": "ad8819a3-f59d-4778-9dd9-de5d253b561a", "comment": "Malware payload", "value": "cf91b749866817cb1f6fc8849c8bd5e0b0340bef17d1812032bdefd459b93690", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665525221, "uuid": "a5843f03-851f-4a56-b6c1-fc5d231df566", "comment": "Malware payload", "value": "da4d7ce092fdf7473d75c774835245ca7620e06a", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665525221, "uuid": "58e8d929-f71b-4c2d-8e1c-a5edda10fc84", "comment": "Malware payload", "value": "66e4ced814e6bd6ebbfeebbc617d44183dfb20c6f4e8bf841960c8137fd71cdcfe1ef90678aa494ea03a02ef3bc4daaf", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665525221, "uuid": "2500e8f3-a1d4-4a0b-bdb6-0b6e4fbc4d07", "value": "T190F52317F27595ABC9B6D23621742235A43BDD28CB17BB867D0877BD24BBCC80B816C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665525221, "uuid": "c1e913eb-3fd9-4b18-84b9-4224f9dd6bcb", "value": "49152:D/NUSSHe5UQtHy1fffEcy317sc1x7B3l0ZL7ZhJqDLrYxzSEKqQux4m628EYk9JB:LqX6efffnRcj7jGPJqDqau4fWtyT9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665525221, "uuid": "65e34a41-4cae-414a-8e58-27935cfbcc90", "value": 3634085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665525221, "uuid": "c5b6d43c-aa5d-44a4-b9fc-938698530a11", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665525221, "uuid": "97b548e0-b0d8-4475-a64c-2538ab16a1a5", "value": "Games.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0818b62c-493d-11ed-9266-42010a9c0072", "comment": "Malware payload (NominatusStorm)", "timestamp": 1665476199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476199, "uuid": "eab235e0-b85d-410f-a1eb-365182f999a6", "comment": "Malware payload (NominatusStorm)", "value": "2ea8fefaec8a7df61e49016722966ea6", "object_relation": "md5", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476199, "uuid": "eeffc0d5-a8f5-46a3-b1ea-679ae9a10995", "comment": "Malware payload (NominatusStorm)", "value": "cfa4e4d144f9f5310462e42d7c5a04f09f4463fe4f346fe52de40f5f998423ce", "object_relation": "sha256", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476199, "uuid": "67624554-cc80-42b3-b05a-8370592c05c1", "comment": "Malware payload (NominatusStorm)", "value": "989d0b1c91540db381b77674e3aa63249c9e3362", "object_relation": "sha1", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476199, "uuid": "0166e60d-c20f-430f-bbc0-f3edc4f63c91", "comment": "Malware payload (NominatusStorm)", "value": "9399d26293cac33571fd8c0f11791050614629502933d465bcef004f828455678da89d8990df73cf9539a613b0351974", "object_relation": "sha3-384", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476199, "uuid": "a0b13c9b-9e91-4128-9bdd-007f8080f399", "value": "T10626E6FEC367ED29F03E42705019022A3260E1A67923C32F374FB55DBC5EE146996AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476199, "uuid": "5f2904d4-0cec-415d-91d7-0f931a5cf5a4", "value": "24576:A8888888888888888888888888888888qSiyNYslUSd9VwbIEvv5wzbzpS1I:mSimUYVwbIEvv5wPFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665476199, "uuid": "2c0bea7a-78ba-48e3-87f9-9faa571441c5", "value": 4706094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665476199, "uuid": "1f0cf41f-89ae-4393-95a0-ac891338851e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476199, "uuid": "ed2bfbb6-b4ed-494d-a243-897013959865", "value": "cfa4e4d144f9f5310462e42d7c5a04f09f4463fe4f346fe52de40f5f998423ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f46989d7-49ad-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665524699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524699, "uuid": "45a6a71f-c02b-4236-aa0f-14a195152269", "comment": "Malware payload", "value": "a2a8196e0e1ff6ee1837f8ff47034a67", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524699, "uuid": "a3afc1f7-583e-42a5-b3c7-48168ed2635b", "comment": "Malware payload", "value": "d09088dc9a46ea530d882044830a0b776f9e814fe8636bbf765b75b3cfd60662", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524699, "uuid": "300c9001-2d50-4b83-9017-f22225701e87", "comment": "Malware payload", "value": "8110679b459fb81d24c8f8f77eb81afb952df768", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524699, "uuid": "b360c356-8782-4b59-969b-420d11e6206d", "comment": "Malware payload", "value": "a4ef6c99499fe9cb67dcdbe803b46de24e098199e144cee537c85b59756adfc98e5b78ccea76616e89ed17ac7b70527b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524699, "uuid": "02af89f0-f720-4231-9d5e-69a9fa8e679b", "value": "T161759D652BD54139C1BF0336047396472371F4AB9F6342EB24A0E76D7AAE3C445B2AF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524699, "uuid": "6a0f0c8e-e7da-49d7-9817-2b8c0b88b2e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524699, "uuid": "ab97e900-cd3c-48df-85fc-c0be9996aa04", "value": "24576:lKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKN7ChBWMQ+uSJJd3Dkdo:ajLuSh3i+FtvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665524699, "uuid": "9f038dd1-21c8-4330-b088-ad53f7f534bb", "value": 1623816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665524699, "uuid": "2cca0963-7992-4897-a437-7a66e798dc71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524699, "uuid": "7b5ec715-6700-44c3-bd5a-9f4eef7f402a", "value": "d09088dc9a46ea530d882044830a0b776f9e814fe8636bbf765b75b3cfd60662", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b5d369-4940-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1665477698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477698, "uuid": "db71cb8a-7f6f-4c4f-a52e-c8e99e8d57c5", "comment": "Malware payload (Formbook)", "value": "646282b2fe71bcf8451991b0aac38026", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477698, "uuid": "ba3088bc-b974-429b-bae7-01474cbe36ff", "comment": "Malware payload (Formbook)", "value": "d1a992a3cc2be0ec2a7c1e4a40fdaa4cd331333b843349aa34b6e68f3f1106be", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477698, "uuid": "35ddca3f-9810-4092-9c78-ea2029b20a3e", "comment": "Malware payload (Formbook)", "value": "3c4eae93d5afd9136a672c0fff5d806c149e1e50", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477698, "uuid": "9c22f9ad-0d3c-4399-a713-ac5fb6d0d832", "comment": "Malware payload (Formbook)", "value": "d5ef28141879eb108052051d91bd8aa7568b287429a03d8642d90d9e29360848c8ffa8a1820180a9a831c9284f611398", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477698, "uuid": "cfabde66-85fe-4a66-818b-bbc63f7e95a1", "value": "T12D543AF1A740C465D8A796B9883BDAA7A433A60DDCA8090D3D91FF0F7D72347402799B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477698, "uuid": "2856a026-7950-405e-94ae-69a7b8c4ce53", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477698, "uuid": "6f4e9415-58cd-49f0-b3a4-515d03b25571", "value": "6144:gNeZDuDA1+fDrZOQYG2CGwNYyVs4fJ3+Wseq7KyEwC1fZ:gNugA0fROfpwNYkn+WhOXEwC1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665477698, "uuid": "9ab14f6d-d2d7-490e-adaf-562dc7d50876", "value": 302715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665477698, "uuid": "7ac3c861-766e-4097-86bd-198e93d602df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477698, "uuid": "5f145392-aee7-4fcf-8656-7564e4782251", "value": "DHL\u6536\u636e\u6587\u4ef6 _ 9905238986 _ 11102022\uff0cpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a38518c-4937-11ed-9266-42010a9c0072", "comment": "Malware payload (Ransomare.Koxic)", "timestamp": 1665473733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473733, "uuid": "6254c2a0-ebff-4c09-acb6-e242b6226afc", "comment": "Malware payload (Ransomare.Koxic)", "value": "3c4fa896e819cb8fada88a6fdd7b2cc7", "object_relation": "md5", "Tag": [ { "name": "Ransomare.Koxic", "colour": "#8C9A1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473733, "uuid": "92e6c800-c96c-452d-aaab-47a74d494258", "comment": "Malware payload (Ransomare.Koxic)", "value": "d2203b6d272d44b7abc66e290c3b79767428168b077a16ded1db0babbe34f333", "object_relation": "sha256", "Tag": [ { "name": "Ransomare.Koxic", "colour": "#8C9A1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473733, "uuid": "d401a078-d400-4f28-b77c-75e871e21f00", "comment": "Malware payload (Ransomare.Koxic)", "value": "0ebf10867534cb472bb98344f80e3a8aac0aa507", "object_relation": "sha1", "Tag": [ { "name": "Ransomare.Koxic", "colour": "#8C9A1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473733, "uuid": "0463c2b9-ca95-4a17-9df2-5ebfa62c188f", "comment": "Malware payload (Ransomare.Koxic)", "value": "7a30db45f724c438f80bca4e87550187c3dbcdf40852e7a2ee771ca01df4aea45ad57d9504dddacf3d2342d281b5361d", "object_relation": "sha3-384", "Tag": [ { "name": "Ransomare.Koxic", "colour": "#8C9A1D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473733, "uuid": "d15abdec-91d1-4df1-adaa-b215e0df01ef", "value": "T1AFF3E16F686C1F25D827A33CB2076E3515F95B1F3AAA16ACEDFE9BB151709401E13083", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473733, "uuid": "9a471a99-ef1c-466b-be0d-0ebae1d91a9c", "value": "07253c21dea4ccc980c087252fddc7a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473733, "uuid": "8cff2860-1463-436e-a5e5-67139c9a1d90", "value": "3072:Wkb6bwPcmQ1mbTw8Gt189VTG079sTGyAzbnuvXdIR:WkTPcmscw/1ETGgWGy0uvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665473733, "uuid": "5f72702a-48ed-4d62-b89c-146ee081557d", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665473733, "uuid": "addcd493-fbd7-4686-8190-5933cf97c0e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473733, "uuid": "93cc481b-f138-40dc-b246-5b8b88665965", "value": "d2203b6d272d44b7abc66e290c3b79767428168b077a16ded1db0babbe34f333", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3527685d-493c-11ed-9266-42010a9c0072", "comment": "Malware payload (NominatusStorm)", "timestamp": 1665475845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475845, "uuid": "8a069f11-e89c-4aa1-af44-eae8fbabb4ee", "comment": "Malware payload (NominatusStorm)", "value": "4a862cbdf7fcb6ea9c7b940e778f3c50", "object_relation": "md5", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475845, "uuid": "e605a33e-ebcd-4a1b-804f-f2791d59f2c3", "comment": "Malware payload (NominatusStorm)", "value": "d222bce08a74ff0bfaffb0cea245aff271118afa88713d28f5235db05df8b762", "object_relation": "sha256", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475845, "uuid": "89a58120-1b7e-4e1f-b403-4bff01e1d9a7", "comment": "Malware payload (NominatusStorm)", "value": "1843a22fd01f0091553cb28b0ba9000cd944b65e", "object_relation": "sha1", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475845, "uuid": "4134b928-27a8-4491-8a63-c36c86181f4f", "comment": "Malware payload (NominatusStorm)", "value": "efc0e150dfac4e751e32844569f69991f13d85d57e4c22da5457874ae3e7975893c9c6762ef70af53f8fdd8facc59154", "object_relation": "sha3-384", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475845, "uuid": "cde7c972-4428-4fa1-a14c-5acce751a234", "value": "T16B6627BFC22BCC29F47D28712014165A3B14F6A8B9ABD39D324FB45DAC1EC4879553B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475845, "uuid": "b26fcb8d-cf01-4a10-b1db-714fd3e9f2bf", "value": "196608:Kf7ZEJhYzD3BiExsDuGAvuiYV351yIsJHf7ZHk3N1gz:Kf7ZEJezD3BiExsDuGAvuiYV351yIsJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665475845, "uuid": "50a9f42c-7814-45cb-9301-81293a459918", "value": 7056302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665475845, "uuid": "1589bb04-b104-4b3f-a751-9d8cc0cab16d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475845, "uuid": "214321e8-8444-4a5d-ab44-7478f6d89484", "value": "d222bce08a74ff0bfaffb0cea245aff271118afa88713d28f5235db05df8b762", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf918701-4956-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1665487244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665487244, "uuid": "c75beb26-8ec0-4c2e-9c6a-425ef81193ea", "comment": "Malware payload (RedLineStealer)", "value": "2150bc411c57ffc8891201fab2edcadd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665487244, "uuid": "a3eaf76f-ba2e-4de2-9c68-394252c50a19", "comment": "Malware payload (RedLineStealer)", "value": "d2e58227dca50c9fcc5dc4c0754a2e9c79f81ec4a0e1db7c77cf1d70661f6747", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665487244, "uuid": "5a1d108b-5013-48a1-935e-22883ab0e912", "comment": "Malware payload (RedLineStealer)", "value": "f3d71f3d0753e0a33672d17eb893aace845cdaf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665487244, "uuid": "0c57c47d-e9e2-4969-96d6-6737ac091fa2", "comment": "Malware payload (RedLineStealer)", "value": "5fff6a6f54f5480e0a94f670706930426008c69917ed71852f23695fb87822032e81992fa39042f623525d840be1215a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665487244, "uuid": "7a29d29b-f963-49f6-80b3-f22c7bbfb280", "value": "T1D475AD177A59CE12D0690733C4DFC00883E8AD82AB66DB5ABE8A33AD15613E71D4D5CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665487244, "uuid": "cede2037-de47-406c-b590-f8e8d0b504f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665487244, "uuid": "531c13e6-755a-4fb9-8c7f-5b9faa774d40", "value": "24576:+XGq9fNAehxNnn+MsgnUQ0+vgd9Ulk5R/+VKkccpScpuw72sEeh8Sx8y:vqVNxhxFVKQKHgk5RmVKG7dr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665487244, "uuid": "00728b85-7e77-4df1-b865-f8bca6f68625", "value": 1693184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665487244, "uuid": "1803e17c-261f-4f75-b6e8-4677f19bf1d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665487244, "uuid": "c0a7bb19-3d33-4f7a-83f6-3eba9d975227", "value": "2150bc411c57ffc8891201fab2edcadd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f571b3d9-494c-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665483040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483040, "uuid": "ab565d1c-92db-43be-9b9c-f6ff5a5f6116", "comment": "Malware payload (SnakeKeylogger)", "value": "37382b656335a02a3a497b1bcb053df1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483040, "uuid": "50f3f4e2-a8ef-4910-86c5-aabbe1822aa4", "comment": "Malware payload (SnakeKeylogger)", "value": "d40f32f81438c0c6bad28f8b8b08ebb452871640a691cb879ea1a4220b452017", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483040, "uuid": "1b367d94-5a7c-4eb9-91c0-b106285c1c54", "comment": "Malware payload (SnakeKeylogger)", "value": "da065437f430daf82a661dbecf89c78035a7cc99", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665483040, "uuid": "b41eb94d-aebd-41e2-9b4f-5aa97b2904dd", "comment": "Malware payload (SnakeKeylogger)", "value": "8217783ad7e1c94a0734dd715c1d62239a205a549b1100b31baf6802c4fc1a4f0e4d713ab07f18556c2cfd8b01984eaf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483040, "uuid": "338a14f8-5e72-4047-b427-33e50c731d60", "value": "T1C6255B7E26964907D8153231C497D1F32AFBAD606062D2CB6AD72F5FBC413BF950238A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483040, "uuid": "fe1bdca7-eb35-40ef-87b2-ed498b91a133", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483040, "uuid": "2b8a29c6-dc9b-41d5-af4e-4ac8b502dadb", "value": "12288:eHnHV9zY1Us1CplAs9rpsJdo8iioCPk8+JCMpT4R00EPk+anhnPbZuqyRAQSQy4W:u9zY8pOsFUovZB4Ec+EhnPIjAtQy4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665483040, "uuid": "30add880-6999-4b41-8c5a-c844ef1165af", "value": 1006592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665483040, "uuid": "70b26a02-29b3-4289-9c32-3938036c81d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665483040, "uuid": "6b9ed4a4-fcb2-4e9c-af0d-0e87ccef3317", "value": "37382b656335a02a3a497b1bcb053df1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7496a0e8-4948-11ed-9266-42010a9c0072", "comment": "Malware payload (ManusCrypt)", "timestamp": 1665481106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665481106, "uuid": "e4d57880-257c-46af-96ed-790977cc8620", "comment": "Malware payload (ManusCrypt)", "value": "769df9e877f419beb20a34515a4b211f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665481106, "uuid": "86bdca5b-f36a-4786-9d9b-f51da7bad081", "comment": "Malware payload (ManusCrypt)", "value": "d72aa8fe30b132afe13a9be90142550b530d9687aff41954bbd3503115f37489", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665481106, "uuid": "32dd1895-f273-45cb-9623-dd90221fe110", "comment": "Malware payload (ManusCrypt)", "value": "8de6ec68b339a3f8761703b20a3cfe1c4370f532", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665481106, "uuid": "f51d620d-c99a-4991-8621-a61ec857f4ba", "comment": "Malware payload (ManusCrypt)", "value": "ab19b4da76ce2419606fb31eae1da51f8fe3f1860d983c1bb416e55680cd204b10e35515e6c29978f399350f7268d258", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665481106, "uuid": "1fe20ebd-b6e1-4030-91ab-b13a62df118f", "value": "T1F6937C21B5D2C471F17319352975DAA15A3EFA204F658EAB239C022E0F341E16A36EF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665481106, "uuid": "822356a7-df7a-4fb2-9c51-18882c1e3ce7", "value": "bf52931198d3e5b9c8012529ed70ad5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665481106, "uuid": "07cb8ce6-ee3f-441c-9873-7bb3cd3f1926", "value": "1536:VpQKRk5UqXbkb2bM5XiE6cuR0Zng71jahYQeEmus8jcd3WWn7q:r6rkb2b6S3cuREn0ahZeEmr3WWn7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665481106, "uuid": "d2961e84-6bb4-45ab-895f-699a8ae986a0", "value": 89600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665481106, "uuid": "6831b6e6-47ae-4068-85c7-4679838de7be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665481106, "uuid": "c539a9bd-7082-42fd-a887-f9f1af195b66", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b849c5-492e-11ed-9266-42010a9c0072", "comment": "Malware payload (Xorist)", "timestamp": 1665469917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469917, "uuid": "0df13c23-1ff1-4027-b5bb-2ed0a90d6591", "comment": "Malware payload (Xorist)", "value": "069170f61d9638c87dab750877065a4a", "object_relation": "md5", "Tag": [ { "name": "Xorist", "colour": "#EB0FB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469917, "uuid": "fec2dbf2-2702-4197-a5f8-2fe8999f3516", "comment": "Malware payload (Xorist)", "value": "d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5", "object_relation": "sha256", "Tag": [ { "name": "Xorist", "colour": "#EB0FB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469917, "uuid": "376edb20-d9a4-40d1-acc6-0d9a80cb478e", "comment": "Malware payload (Xorist)", "value": "21b592ca0ce2e353640893b039eb84dfc7d55d14", "object_relation": "sha1", "Tag": [ { "name": "Xorist", "colour": "#EB0FB2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469917, "uuid": "17a6339b-5ed0-4c66-a9eb-3d7cc8d91ad4", "comment": "Malware payload (Xorist)", "value": "ece7899cb3687134cf58b3759f308312ea753b7bf47e8ba2b2c745c5e258394ef3c5a40e2808eac86bf121cc1f10d697", "object_relation": "sha3-384", "Tag": [ { "name": "Xorist", "colour": "#EB0FB2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469917, "uuid": "a73b35da-de5e-482b-ac95-18ffef66fed4", "value": "T17A85CD82D332BB61D2A79C7883152AD2C78B39B29FC3D1B5F4BD75947DA41800D96E32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469917, "uuid": "3f53dace-7439-4e84-ab60-3b20dd2f96c2", "value": "d9d5609df8f39c7ce06f045defa2e1ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469917, "uuid": "cfc921b0-bd48-48a4-9ab9-08103bc4d80c", "value": "24576:EnA1KgRYWHEvtd8LHhFJpxjMnA1KgRYWHEvtd8LHhFJpxjJ:D1K5ve1K5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665469917, "uuid": "7e9d8640-4495-4bd1-93ec-4634cf88c655", "value": 1854976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665469917, "uuid": "1753248a-1867-436e-a784-c2ea20241fc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469917, "uuid": "e5d5f58b-1215-4f65-bbfc-9eb5b4761293", "value": "d742fc3fe56d39a8245264e3b17480de278b720fd8024c8401886331fbdbcad5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f617845-4920-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1665463917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665463917, "uuid": "5aa416cf-fcdf-4c97-9d59-b932e8c99819", "comment": "Malware payload (Formbook)", "value": "9d9d44a47c0a8e26b887e773f9098ab0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665463917, "uuid": "0d834490-9f57-4b47-bf66-045ad2616d45", "comment": "Malware payload (Formbook)", "value": "d7c9050d81903010ff6843bceea4331e45f15914ba721f20e01b1eedf33dff13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665463917, "uuid": "c8696ba2-41d7-4b56-88fa-95e6acb32a5f", "comment": "Malware payload (Formbook)", "value": "9e984e41ea44792c26cf8f701b42773f2cf9c06c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665463917, "uuid": "4fbaf2f2-3ab2-49ba-b8dd-1aeadb46ea6f", "comment": "Malware payload (Formbook)", "value": "ca2d447760bcca4d318c4411df9d00012bcaf7a38f621e855c7c134ea48b87d2b4ff3b01696fdac3bea1ca7daee0ff32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665463917, "uuid": "f88fcd07-56a7-4478-a479-c163ad46e21d", "value": "T190738C41E145DCA9E81729F2A86FC930206A7E8D917DC50D368BBB2A45F334710ABE5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665463917, "uuid": "073e3e50-294e-4a82-aef5-2a53158f378d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665463917, "uuid": "b0bd668c-c9a8-4b16-bc60-12e989275f62", "value": "1536:acgD9hW4Fi7O8xcIhd9y8x09ubvO67yG47uAzPqurdthad63MRKDMCfYf8u:dgpEsQTxcIhd9y8x09ubvO67yG4SAzP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665463917, "uuid": "b03fcf74-7d84-4be2-a3f7-2dc89eb303af", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665463917, "uuid": "20df9f9c-9911-4bf9-ada4-d405dbfb7b8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665463917, "uuid": "0e183661-ab9c-49e1-800f-1c4b2bbd1831", "value": "Payment_Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc3300ab-4934-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1665472689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472689, "uuid": "42333512-0d94-432a-b2e5-29325d91569e", "comment": "Malware payload (AgentTesla)", "value": "7fc0a0c7653430b2de231df7ad68baf2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472689, "uuid": "cf51f110-71aa-40df-9bfe-26f8925bed5e", "comment": "Malware payload (AgentTesla)", "value": "d7e7c5ca4f32779994ddd7d0d04bb6d0617caf51b59b33ec2e8f373b6a92afb7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472689, "uuid": "e4b45948-250f-4cd4-987d-d1c18f195619", "comment": "Malware payload (AgentTesla)", "value": "2e09b61373b4d0018b9e7a31f486582a18cf1e9a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472689, "uuid": "5e2fe60e-112b-48aa-8ed0-98f1ed9c11f1", "comment": "Malware payload (AgentTesla)", "value": "ae2a1d9ac79039869a7e7e28aef0e0a30b2fb79b2ea39692ad49922969784a7d3cb50591e8fcbc503dba8947d02de060", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472689, "uuid": "2e8871d5-80cd-4c43-ae61-e400a44bf6cb", "value": "T111E48DAD762075DFC857D0769EA81C74FAA274BB931B5213D12721ADAE1C887CF240F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472689, "uuid": "328a46e3-ac21-4547-999d-28b0982bb36b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472689, "uuid": "bf2a893f-ec2e-4c8c-afd5-df9f335cace6", "value": "12288:Ksauu2iNaLqVZEq+pdtx6bQia8IDsyHqUnB9wlZADqjJ5nScScb5oC64w2roQi09:Yuu1QTpdCbQiaPqUnMTjrS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665472689, "uuid": "6ab3b67b-c563-4e31-bcd4-3b795f40aadd", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665472689, "uuid": "49b42ec1-d466-4a47-808e-43446563ade8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472689, "uuid": "a06b2aa1-ccab-4ba6-846b-c2dddb2939b1", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b381f35-493d-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665476446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476446, "uuid": "146f27dc-2e94-4603-a70e-ba129715979e", "comment": "Malware payload (SnakeKeylogger)", "value": "cd7ce99ae192956ad20d84cdf465b3ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476446, "uuid": "b3e3efd4-a040-4b8b-9d2e-d63aa675e544", "comment": "Malware payload (SnakeKeylogger)", "value": "d906b74da6af6047b7d0079d32c7dcdf66f48fa17142da89896c6211f14d3175", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476446, "uuid": "ac943819-05d7-4cc4-a34f-5570942191fa", "comment": "Malware payload (SnakeKeylogger)", "value": "a02cb5b7b0a57cfdcc44bb5543e51fe8f84f224c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476446, "uuid": "8da1d74f-1f52-4686-bb25-d942022b571e", "comment": "Malware payload (SnakeKeylogger)", "value": "6349648fa5cc598e78b6bcb368df0a3a52e19cee94b0595af6d18a5654e357dd6cb8382c3063a87ebf64a7bfcbff3ff8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476446, "uuid": "5c116020-c9b7-4fd0-9e4c-cdd9bece7ab3", "value": "T1E5157B7E16994607E8283274C893D2F32AFB6D606061D1CB5AD72F6FBC552BF910334A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476446, "uuid": "b207ad84-4179-4864-8a3e-7577d29ff621", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476446, "uuid": "2c173405-ba56-46a7-ad5f-612668458cd8", "value": "12288:AjwVhUb/anK576ZBBpNgAt2RC5NN8D+tMACAk/bcXVWAQSQy4Ao:o6AGnt2R28WMAClY0AtQy4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665476446, "uuid": "609fd617-a029-4617-9126-700f165bd40a", "value": 948224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665476446, "uuid": "44d9c621-1d5f-4a60-97cc-1ef289563c3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476446, "uuid": "10d8202a-a247-4e48-9d95-73d11ffb842f", "value": "PO345677.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0823cd8-493b-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1665475596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475596, "uuid": "a40c001d-917d-419a-a6b3-dbce2c300016", "comment": "Malware payload (Loki)", "value": "0e2597ad321b15cbe22e23c3a2dcde73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475596, "uuid": "a91c5b8d-42c2-46de-a9a8-ac55a44e006f", "comment": "Malware payload (Loki)", "value": "d91eccffb34a2941169cef141b29405e86b8fc16f91dcfef6fe4ba80666fedb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475596, "uuid": "796bc259-3542-4b2e-8493-2d056633265b", "comment": "Malware payload (Loki)", "value": "855ac1d9ffbc31d97d6d30c763ee55c54aabece6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475596, "uuid": "4a242bd2-c9be-4e7e-82e3-02af0712e749", "comment": "Malware payload (Loki)", "value": "e27ecf20dbd8cc2c851851f662f97156fea9c1022e18013b68dee35c4a19abac2b84032ff8290323d4fa5ced86d68aee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475596, "uuid": "ea78987a-c1d3-486a-a6fe-e2ac4344b9f7", "value": "T168A32A42B2A5C030F7B74DB2BB73A5B7857E7C332D22C44E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475596, "uuid": "3c58bdcd-9596-45cc-bcd0-fc68e5cd82fa", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475596, "uuid": "664465d3-a538-4559-abf0-97a83cd879ab", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665475596, "uuid": "0045eeb1-3027-47c5-ad40-48a2f1344cd0", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665475596, "uuid": "eb44111d-d0d1-4027-8d84-c7e0a88ef8e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475596, "uuid": "f3f1fe83-0056-4627-90bd-86ec659e63cb", "value": "0e2597ad321b15cbe22e23c3a2dcde73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85636453-49a3-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665520218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665520218, "uuid": "b3ea3c77-47b7-458d-a818-88c7ae61ada5", "comment": "Malware payload", "value": "1b6beeb0f5d82158bdb273eb0b46b7bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665520218, "uuid": "ef4f4463-d032-44db-88a5-2fee0faa2a98", "comment": "Malware payload", "value": "d931fe804797a09bcaa82748fc12b23a8825186f4cbb28dc7662337c1a3a397f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665520218, "uuid": "ccfd6c40-0c27-47a0-aa2a-e979ad6d6d96", "comment": "Malware payload", "value": "5405b9173846ee172c84dc9fa23d4ca48fcb5dbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665520218, "uuid": "d385fd8b-748c-4426-a7ad-22063c9fb038", "comment": "Malware payload", "value": "677eba0973a108a50e56a9123907370bfebc7072aef21abac0d64e89cddfd57f380f8eb6fc48dcb7ecc0dd424b588c4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665520218, "uuid": "4a01f1d9-eeb2-4d0d-90fb-d2904b95a862", "value": "T13424DF1232D0C472D2522A748C69C6B06BBBFCB55A75538B7BC8276D8F322D29E35707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665520218, "uuid": "a8d9d46f-9e6b-404c-a202-70ea6ad174ed", "value": "e680a2b40b54e6ebf1523763588728dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665520218, "uuid": "a96af853-4a8e-4e11-91a3-e96da43c70fb", "value": "3072:WYmL2rA7gDhWxLVPybq8vGsCPPjegg3NCWq+0G2X9YavyvRIa7yBO:vkAHh4LVKbqF63NCG0xXzURIa7yB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665520218, "uuid": "0eda692a-4480-4f83-a920-074daed13faa", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665520218, "uuid": "51492fbd-0ec3-4dff-a0fe-c2b937e217e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665520218, "uuid": "b3c299f5-ce53-4167-88f4-dd7b9ad43a0e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c797eb63-4918-11ed-9266-42010a9c0072", "comment": "Malware payload (WannaCry)", "timestamp": 1665460629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460629, "uuid": "69d0a21c-6acc-40d5-9f03-396a8c31a364", "comment": "Malware payload (WannaCry)", "value": "9c4e95e52779c6a899d5d658aa80010d", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460629, "uuid": "81e47dd7-3679-42eb-86ce-c6fdfcc43ae9", "comment": "Malware payload (WannaCry)", "value": "d9dde94ae45299dd873ef579e0f69e7050eacd927f526bec858f505a776dbd46", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460629, "uuid": "1103e011-f3ea-44db-800e-989964c40ac5", "comment": "Malware payload (WannaCry)", "value": "f0d1c4435128026a53fcaf74ed9416bb1e5736f8", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460629, "uuid": "2d383de2-faa3-4d5b-bd10-33945b28f36c", "comment": "Malware payload (WannaCry)", "value": "45db5c2ff51c5d7d4fb4f3591c3df2c1bd5e6cea7dd3d7bd8cce9041aa9f3be6c5ea63cceadc742ee00d65f0acd664c1", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460629, "uuid": "4d79439e-f78b-4f84-b28a-5017ce89d9fc", "value": "T1ACA36D096E9CC4F0C84D66B19857527AE7F27C1D427CCA4F8F64EE520EA33A1B529E13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460629, "uuid": "8cd22c97-a425-4f44-85aa-384a808c0dad", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460629, "uuid": "a13710b8-ad9e-4b74-88f0-f405c2b1abe7", "value": "1536:Qq7kJOty1IYyvlVaThD9WhuG2uK7qlr3vRgYfl6LEVTCA3:xV+LydVaND9yum3hILEVTCg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665460629, "uuid": "45c02579-a815-4906-9380-0014b1289629", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665460629, "uuid": "ecb37648-8be7-4438-9fd4-3b52c69d6dbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460629, "uuid": "f8119ba9-78f0-44ac-bf91-fd608be10d1d", "value": "d9dde94ae45299dd873ef579e0f69e7050eacd927f526bec858f505a776dbd46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a59af24-4920-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1665463909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665463909, "uuid": "96b430c5-2f13-40af-8181-1d05004115c6", "comment": "Malware payload (Formbook)", "value": "f98a49903e2df604ee375f509e16eab6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665463909, "uuid": "23580512-c8ba-4f55-8f93-becffe15530f", "comment": "Malware payload (Formbook)", "value": "da076f177fc154511501307a7dc5f2a0910f72f282e31173787e4b73e6b2f5df", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665463909, "uuid": "87580806-391f-4a1c-9c02-51c7f3487ccb", "comment": "Malware payload (Formbook)", "value": "2c220b0a2dc3bad1dadaf12dd7f0266f25987c52", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665463909, "uuid": "da0cc3ff-75f9-4102-a531-3a8adf760135", "comment": "Malware payload (Formbook)", "value": "0d575bcb26171208d5319615327c7f07389f54ce18280a8542702cbc9019b5025cbbebac7db024bcda9eff22f28d190e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665463909, "uuid": "9aad4a60-f075-46da-a8b6-25bc23a7ea55", "value": "T1F552CF26B48112E624FCEB376D437E5B068191FAC211BD9809F1BF79083EC9B627856C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665463909, "uuid": "5fc676bc-9b1f-4673-ab71-23d519033c46", "value": "192:TClTPqUI8YRfmKvzwuhfa9/OwmfOYRsjTd2cjxliaFDYamhNAiK13PTKrkjJQIsj:GlT4zTwmGZjTgYDbiK1fDJQ3+rsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665463909, "uuid": "cf362dba-debd-4933-8558-114e84a6711d", "value": 14072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665463909, "uuid": "1dcb0d55-a205-429f-8063-8b744f44cc40", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665463909, "uuid": "faa47bc7-36d9-49ff-9dde-4a8d457ba92f", "value": "Payment_Advice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83167d7c-492e-11ed-9266-42010a9c0072", "comment": "Malware payload (Phobos)", "timestamp": 1665469963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469963, "uuid": "225a074a-4f36-40e4-8cd2-f5e239ca71bb", "comment": "Malware payload (Phobos)", "value": "2bc3c9bdeb39b4586b128fbb596994fc", "object_relation": "md5", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469963, "uuid": "e8432c06-88d1-4be1-af76-7bcc179c1abd", "comment": "Malware payload (Phobos)", "value": "da24e2d56eb8bf572abc67c2ba3ef64d0bac9fdda0f9a11132b10fac12343aaf", "object_relation": "sha256", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469963, "uuid": "c5d2684d-b896-41fd-b22e-6424cf1628a7", "comment": "Malware payload (Phobos)", "value": "04ae20aebd7eebaac3f83f4246aecf427ddb50c0", "object_relation": "sha1", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469963, "uuid": "71ef68cf-670f-460e-acc5-b59d3748e088", "comment": "Malware payload (Phobos)", "value": "fa6528d2ec1d39030805c8e31731cfd45ce24428523df84c1628e11a4c989df2f8efb23b4a2948615bad7e0fe3fcd558", "object_relation": "sha3-384", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469963, "uuid": "14ea6909-a11b-49b8-9a92-84f3c39d5cdf", "value": "T17E43BF06706990B1CF7285702A3E2F5F8EFB651444B494978F384E8A3EC5532DB2E37A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469963, "uuid": "61bb94ef-2e2d-496c-b1c7-dbfca0bac3a1", "value": "851a0ba8fbb71710075bdfe6dcef92eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469963, "uuid": "9e07a9ff-db98-40d3-8aee-b47b65c70ec7", "value": "1536:TNeRBl5PT/rx1mzwRMSTdLpJYgL+THbh:TQRrmzwR5JAT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665469963, "uuid": "d0fedc36-be7e-4d14-8edb-7bd3fa8ee521", "value": 58368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665469963, "uuid": "b72f6a4e-70d4-4e10-bd22-2c5542473a2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469963, "uuid": "7e4c877f-0180-40d0-83bb-3f4bb613cf71", "value": "da24e2d56eb8bf572abc67c2ba3ef64d0bac9fdda0f9a11132b10fac12343aaf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45f9f525-49b0-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665525695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665525695, "uuid": "9205ff73-9abc-4238-ba6c-821815726c03", "comment": "Malware payload", "value": "0a67e5994e4ba1e3bc213cd3d9e036d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665525695, "uuid": "419561ac-8eb5-47ea-9fdf-644037900148", "comment": "Malware payload", "value": "da2f00084624a3a86c88bdaa856548709baa5843916d8c9781d3f68a0070ba19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665525695, "uuid": "3ae99de6-ee6b-489e-889f-a7e7806fe93f", "comment": "Malware payload", "value": "8c9d757d853136824faac683d6aafdbd67b03dc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665525695, "uuid": "546bc6d6-ab5c-46b2-a5cc-c0225e44fc7a", "comment": "Malware payload", "value": "c1ef23c6acdd26b05191c97e35ae2bdb1dd8337cac8029b71ad4fe9ad9681b23855bfbf6e9e68ace2c9555a68c5d83ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665525695, "uuid": "f01b9e59-b63b-475e-81ee-859ea13ea488", "value": "T1EA7633027BB48871D0E0887159965BA7A3F7DED99F3048B3EF604B59CB7C682663321D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665525695, "uuid": "e457e456-653e-4dff-8585-4ac51f5c8e53", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665525695, "uuid": "f38b87c5-e501-4680-9b08-6f3be564db18", "value": "196608:91O+zXFS3RnVAAMNMK+KoNdbb8HAd2PGg:3O+woAMNmP8Htz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665525695, "uuid": "736ced35-26b3-4afa-892f-8c58e56bf7f9", "value": 7640448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665525695, "uuid": "95b213c2-4a02-4fec-ac87-d6842e16c005", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665525695, "uuid": "39a5e371-4a12-4674-a16b-2291b9bab3ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b6fa2c-493d-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665476192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476192, "uuid": "921a4664-fe43-4c90-9a9d-2669d9e0dd25", "comment": "Malware payload", "value": "719089f79446e8f6d7e2ba960a2ed96c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476192, "uuid": "94659afb-4b4d-4534-8af7-ca5b6993a876", "comment": "Malware payload", "value": "da89b4df2398584728d41b68fb4f36a6631309e6cadf78b477ebc56ca09089de", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476192, "uuid": "70f10937-d96c-4dad-8faa-7fca9f00c929", "comment": "Malware payload", "value": "5047fdd972be0de532409dee8ea72ae2dda2ede8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476192, "uuid": "fcab5af7-d6fb-4e8b-b9d8-748e3fea169d", "comment": "Malware payload", "value": "db998a9d61f158475ac926866701f42d18ad93a500d6028a47f2679c69788aa480ebbdbffec2d9973ef21174ea492420", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476192, "uuid": "16d9648c-85e9-4370-95c8-cbca918d56d9", "value": "T18105599667F85B26E1AE1735B8300A2846F3FD03E5B6D78F6509F4A80D777908E00B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476192, "uuid": "14775101-64e7-4e6f-8d4d-5da99d02f60d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476192, "uuid": "50161307-f90f-4bce-b66c-beb8da89d3af", "value": "12288:Pb9BzaPm657wqehcZBLX+HK+kPJUQEKx07N0TCBGiBCjC0PDgM5j9FKjc3Q5GP:Pb8m657w6ZBLmkitKqBCjC0PDgM5AM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665476192, "uuid": "e1fa1d7d-315a-4f8d-a41a-548725734882", "value": 836608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665476192, "uuid": "d60138f8-9b2a-4dbe-833f-4a31e31692f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476192, "uuid": "c9c4d889-cab5-4ea1-bc4b-7db7f2b82144", "value": "da89b4df2398584728d41b68fb4f36a6631309e6cadf78b477ebc56ca09089de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53c53a9-4913-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1665458558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665458558, "uuid": "d3c3c6b1-238b-4a3f-ab36-79e72b2588e7", "comment": "Malware payload (Formbook)", "value": "50dccfe8f8c993a5dba4d99d0a95ad31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665458558, "uuid": "424c635e-bcb6-41a7-b22b-5af46c3d3d5c", "comment": "Malware payload (Formbook)", "value": "dc6132f9c63cd966c76790f0761299f92c31684197e40a949c4e1eb9a539bfc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665458558, "uuid": "8a5aa0bd-a036-48fd-93c6-9093184d6d1f", "comment": "Malware payload (Formbook)", "value": "3e67dddf10808aa61f10726acc6b9d1d713440d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665458558, "uuid": "b1b8052b-cad6-451a-b167-8a7d066e9b4b", "comment": "Malware payload (Formbook)", "value": "9a5cbd0abbae266afc62524ac20aa2bff9ef465ffee4ba7d1afe3c2a303f788dc4800da0c375bca80f6eb2b2606d66a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665458558, "uuid": "17624639-17bc-4d86-94ba-f14dbf50115b", "value": "T184D423643750D463EEB78B365E33825ADFF48C7200E0E1278712BE9D29366938E5E785", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665458558, "uuid": "430c26ac-5417-4dd2-b467-ce1c536af694", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665458558, "uuid": "309ac306-4c52-4709-9edf-a7fcc3af4901", "value": "12288:JNkGsVDEC5opq5O6D7zkoT+lqp/7Iu/O2ybZx9Y9rl7jjGH1:JNk9VouhZlT+lQTD/O3BArRCH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665458558, "uuid": "d30bda87-ff01-4163-bbac-b300781c1cf4", "value": 634930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665458558, "uuid": "bfaeb226-62dd-4ff3-b46a-f4a6ce9f68de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665458558, "uuid": "47cc3847-bd64-4b5c-9c2c-67fed884a6e1", "value": "12-03-303-930290292.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "809f12d2-495e-11ed-9266-42010a9c0072", "comment": "Malware payload (Quakbot)", "timestamp": 1665490575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665490575, "uuid": "50ae90e3-002a-4d72-95ce-51cec0251441", "comment": "Malware payload (Quakbot)", "value": "5ca9d3d993711c94a525cbd6fa922d94", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665490575, "uuid": "c794e623-d677-4709-b204-77b06253bd1e", "comment": "Malware payload (Quakbot)", "value": "dc9e2c2742567c6d8e71e4f3747e00837b5d6feaaa0ceb00cd94899e9a3be740", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665490575, "uuid": "08c0c018-4d83-45cc-a1c1-669c5c2a140f", "comment": "Malware payload (Quakbot)", "value": "686800a8e02eaf8535b58ce54ee010b5e87d3337", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665490575, "uuid": "09cc0f97-380f-46e8-a605-b0920b99ecd8", "comment": "Malware payload (Quakbot)", "value": "240d9432a6360520963ba6f6afaa3a3cc57bb5c2c1107e3649c1bc90d414a54374462ce4227f4fc1045258c1ee84bd55", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665490575, "uuid": "77bdb28c-b8c8-46c8-ab69-dd171686f85b", "value": "T14C656D22AE9E8872C57B1A38AC3B5258543A7D203B34585B7BF90D0CCF36B817D5539B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665490575, "uuid": "05d13db3-d5e0-46f8-96f3-893cad0a1032", "value": "12288:OYKepSeIUqeXPwyITtxGvvVeHTe7ezGNTTYmRs867u0iROkDQSpu8ahK+UfxEeEK:PLo2ftMzeaKYKu7u0i9wofxEaz32w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665490575, "uuid": "f2a4d37e-0f61-4a2b-a44f-de4127d65710", "value": 1525760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665490575, "uuid": "ee498592-21f6-4da6-ad23-2f032432bac1", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665490575, "uuid": "a2a72bb7-35df-41b5-beae-0a0a93be87a9", "value": "New_documents#2479.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f09ba59-49a4-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665520449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665520449, "uuid": "757bcfca-c01d-4cba-902e-471555c28897", "comment": "Malware payload", "value": "544dddaf50ca3f238f5aba58f5c13f17", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665520449, "uuid": "4333c057-cafc-4737-8f3b-338d1296bb12", "comment": "Malware payload", "value": "dcafdeb1566d95f8c65289a1a3e80606825a160f8963f7f9aab22b6c7a733a6e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665520449, "uuid": "19e29475-c39e-4a3b-bf0d-e1e1a6938e17", "comment": "Malware payload", "value": "b82cba6a89fa17f6812466f73f91bcb194808e3f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665520449, "uuid": "da7d8c84-77b9-4b0a-9e56-4f379b4aa855", "comment": "Malware payload", "value": "3f11c41ee2c00b6f8fb781c2fc963693ccd40c1b60e33109b529e62156d3b953e3a553372304d8f277028e741d1c659f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665520449, "uuid": "5e5639ef-69c3-4d2d-99b5-41b311c18bcc", "value": "T1B2C56C563BD5C126C07F03354C72D3852272F8979E1342AB34E5B36E7D7A7C04AA2AB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665520449, "uuid": "f00388a4-1c1a-45ff-bdb9-67d40dc080c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665520449, "uuid": "fc8124f9-3856-4dd6-9dca-078a68735f99", "value": "24576:lKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKN7Chg:ejLuSh3i+FtvkMzT+1zgwpR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665520449, "uuid": "09040673-2ae8-4d0e-a96d-95e605d23ec8", "value": 2516344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665520449, "uuid": "a9dd4efe-518a-49f2-827a-03ede85b8b16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665520449, "uuid": "1a013fb3-cb71-48a9-899a-3edc5a6bf5a8", "value": "dcafdeb1566d95f8c65289a1a3e80606825a160f8963f7f9aab22b6c7a733a6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea2f47ba-4933-11ed-9266-42010a9c0072", "comment": "Malware payload (Neshta)", "timestamp": 1665472283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472283, "uuid": "4e668808-6b42-467a-9507-5920999ed9c3", "comment": "Malware payload (Neshta)", "value": "f5f77a580132a097ff8eca976b6fef9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake outbyte drive rupdater", "colour": "#AD1756", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472283, "uuid": "80860d7f-8d03-4401-a509-a9b58ae43d36", "comment": "Malware payload (Neshta)", "value": "dd45c5e92d3081678d9afcb8690c30dbe45d9e9de6eff1b2744cfb31a025f373", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake outbyte drive rupdater", "colour": "#AD1756", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472283, "uuid": "83d86a5f-86fc-4990-a937-9ddb6fef6198", "comment": "Malware payload (Neshta)", "value": "16d4a28dc2d5a1be0d617027b7bfcd3ea9f206d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake outbyte drive rupdater", "colour": "#AD1756", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472283, "uuid": "bf95dce7-0678-42c9-a09a-59719ff953b6", "comment": "Malware payload (Neshta)", "value": "5eb7abf953ba22cb91746f726b0802cf28f46f92b8ef419a0f95f3fed5ceba778ce6d8521e0e225188323e6b0824d821", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake outbyte drive rupdater", "colour": "#AD1756", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472283, "uuid": "596ae92e-7ddb-49cd-b19b-7363295ee4be", "value": "T1EB96AE167748713CC65E5E36597B94508D7F2EB1DA2398267FEC3A8C4F752803A3A223", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472283, "uuid": "9a116df1-5150-463c-ae18-5adfa488a67e", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472283, "uuid": "c697bc6a-44fc-4243-81ef-c310fed0cc65", "value": "98304:Co3v4SoDHgbYTbCPqGAB1Mxrkuzlr7lLTcwuMc:V38gwC0Kw+Np2Mc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665472283, "uuid": "de29916e-04cd-434b-a69a-b704d6b47f60", "value": 8915336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665472283, "uuid": "cbb54323-3994-49b1-a627-b10eeceb26fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472283, "uuid": "08234014-cee6-4c35-a8b8-b310949a491d", "value": "dd45c5e92d3081678d9afcb8690c30dbe45d9e9de6eff1b2744cfb31a025f373", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48cb218c-4930-11ed-9266-42010a9c0072", "comment": "Malware payload (WannaCry)", "timestamp": 1665470724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470724, "uuid": "266fb8dc-9f12-455c-bc6f-fa3dea7950cc", "comment": "Malware payload (WannaCry)", "value": "9a0529ca32f9d746fae4d694fdb70e02", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470724, "uuid": "b980e4d3-e86a-4dc7-86dc-18fb719aeaa8", "comment": "Malware payload (WannaCry)", "value": "dd9e91e348f5b6df686649d36863922e50208e2e6a2c8dde5fead47ac1778602", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470724, "uuid": "03cf99ab-3f33-47ca-8726-4ae712ce49e2", "comment": "Malware payload (WannaCry)", "value": "93085ae0b273556d6fc86593d25657475ef216c3", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470724, "uuid": "87344927-aad3-4260-98a5-de82c01c1d6f", "comment": "Malware payload (WannaCry)", "value": "19d24c6b31f74040e6e4c603876ab1bcd331b38ccb4ed51bde7b1653328279a066aa682776844ed8ad51ff280f4f9273", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470724, "uuid": "4f24e36c-ba36-4732-96ee-64ecf94dfe14", "value": "T18E06D041BB98C0B6C28F11398467E72BA677B5621B30D6C7B3541EAE5E313D2BD39306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470724, "uuid": "690891e2-c818-46f5-8d16-029f6f5d93cd", "value": "9ecee117164e0b870a53dd187cdd7174", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470724, "uuid": "45132ca1-3f3e-40a3-a2bd-ffa47f7979d8", "value": "49152:2nAQbKUacBVQej/1IN076eFaHHfgYDTOcF+mtAhZLhQvub6ENHtZqgvuo:yDZfBhz1aqFanf5DTO1ZLhQv5ENHtZqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665470724, "uuid": "c057076b-fb63-4e53-ba4d-2cc060750bb2", "value": 3723264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665470724, "uuid": "d166eff4-ca4a-4202-a90a-fc4687e746ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470724, "uuid": "ba84cb56-0845-450f-92af-31eb71ab201b", "value": "dd9e91e348f5b6df686649d36863922e50208e2e6a2c8dde5fead47ac1778602", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a2c2342-49bf-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665532279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665532279, "uuid": "4593ec2e-47f0-4ce8-a445-891bbb2571e4", "comment": "Malware payload", "value": "2a8e9fa9b49a5ddb24f40465fd73bf72", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665532279, "uuid": "c3e90f1a-14d7-4f4a-84de-745ce23f5a04", "comment": "Malware payload", "value": "de3580084817a35660df0cb9780ababcdd6d2f06a8ac817a0b8564cf4649b7bd", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665532279, "uuid": "3c4ac6ec-8b48-4f04-b657-6a0393d20426", "comment": "Malware payload", "value": "df334e23e5f31aec6364e2804496d25fbe7be1b4", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665532279, "uuid": "d6202e65-3aa0-4b06-a5ef-db9edbb4dbd6", "comment": "Malware payload", "value": "9becf8c4e54f52219fb0811ca2e692890b9f96563c765c22a3941f26bf2fa5bc9cc5f0b5491f76ba6efa76108fea5d03", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665532279, "uuid": "1d96a990-f489-4799-8de3-672c8ce46690", "value": "T113259F23F3D00373D1261A357C3FA2E89A167D303B749A1A29ED0D0D1B359916E7A2E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665532279, "uuid": "9ea99b8f-9ac0-480e-99b6-f7ec6343696d", "value": "24576:FDXjmtjVD3cygICZwSJp6q6yZXJM5T//7YbLQIpMlzMh:FDjMBsLb55M6bLQIpMlzMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665532279, "uuid": "6b6aa123-b133-4871-a78b-240051885f90", "value": 1030144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665532279, "uuid": "bcc81d51-2418-4195-8bf2-804141c0aed1", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665532279, "uuid": "4e181daa-bb30-4a1b-8441-931c7ba1a172", "value": "RFSL#6337.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea8bed7-497d-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665504101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665504101, "uuid": "6c2adff5-987d-4468-ba7d-b46afc2bc760", "comment": "Malware payload", "value": "366b7cb5526423087753b071fcdcc477", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665504101, "uuid": "ba478746-f6f7-456f-9c30-8428eb32e4fa", "comment": "Malware payload", "value": "de3a04a16f44b3f46190d4b8d89f4363d448556ebc7480e04000f4a38ca6a4d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665504101, "uuid": "5c436a1f-230b-47dd-9601-ff2f31d07748", "comment": "Malware payload", "value": "f5c53d835c190b59d9557f8a8278d1c8d48ac2c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665504101, "uuid": "a8e26213-b386-4d87-b41b-e39dea91f495", "comment": "Malware payload", "value": "31aac98b3cd6014a614925ba3ec535698c3d1c37c032cedb9b24d779963cecb9af4ca989d59fc215078443c9e7e2bff1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665504101, "uuid": "693f878c-fac7-4286-9ee4-0aa6fa4a0dbc", "value": "T17376332131F185F6F6AA00B7EE1C7E9AE964C3540C7688B7238C5D4C5DBCD89C16AA4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665504101, "uuid": "4e61cf43-075f-4335-a606-a3f1fdb8a892", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665504101, "uuid": "2e1c044b-6099-400e-925d-97402d4f486e", "value": "196608:91OHsaMrvgGJjvcgWfKMGSErrmdPaSD95QjQi:3OHsaMrIGJjDWfCS0adySbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665504101, "uuid": "c2310ffd-c0a6-4250-8780-105f0072ca2c", "value": 7598583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665504101, "uuid": "27629d21-50ac-49c9-a28b-cc979f5e02dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665504101, "uuid": "fdee0645-ab3b-4dc1-a521-02e7f95e8d8c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ca205e-491f-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1665463305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665463305, "uuid": "1bbe9b0d-6ed7-4deb-a998-3490612b75c1", "comment": "Malware payload (Amadey)", "value": "dcddf08c936346f5e19352806799e2c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665463305, "uuid": "ba02d843-28f8-47ff-9c35-706182de8556", "comment": "Malware payload (Amadey)", "value": "de58635edea0c31b96643d040464f29605f501b6f35c000d3e3f6f74a60c1900", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665463305, "uuid": "2f8c6bd6-4c8b-44ff-9c96-24f2dbd183a1", "comment": "Malware payload (Amadey)", "value": "bf095d1789159d0e392f3e8f02a90ea6d6b8222d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665463305, "uuid": "94765179-4d39-4c72-96a2-6c83a8703cfb", "comment": "Malware payload (Amadey)", "value": "47bb4094564e121791f6264f3912a71e51141daf0dc82127a878002211a490ab07b03ac9cf4d316a4aa928f7335d6690", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665463305, "uuid": "ad470528-388f-4447-9167-df0e24731361", "value": "T11144E0123690E032D66715398D29C3B5BFBAB8751A358A8B7FD80A6D4F342D2DE31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665463305, "uuid": "64694097-d892-4a5d-85ed-0ea7141a95ec", "value": "78ee95c35be8f9cbb7d14afcce7e80bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665463305, "uuid": "83186a9a-241f-4713-a99c-16cb9eee6d7e", "value": "6144:uYqbCLIZZDTkPMqI9F+woKZL+hNElT4/a9:uYqbCsPTpq+XZmEZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665463305, "uuid": "08ddbd05-9437-4072-9bde-0b129e4605b8", "value": 264704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665463305, "uuid": "71d81438-45c1-4f92-b50b-8eb5fb753fa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665463305, "uuid": "60f299f8-b4c8-41c8-b907-36381baa65c3", "value": "dcddf08c936346f5e19352806799e2c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b2969be-491f-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1665463400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665463400, "uuid": "221ee9a5-b6a2-4a53-a99a-568e3bce884a", "comment": "Malware payload (GCleaner)", "value": "0ca383c4fe96fcecee318c24d6208c90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665463400, "uuid": "029fe5f9-5977-4161-b95f-92668a8c0ca3", "comment": "Malware payload (GCleaner)", "value": "de84d2092f008362d2f36f8f31fc28fb506c2f0ebe53d41ea30efbd4f4f218c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665463400, "uuid": "169ba7b6-74bf-4bef-9fb1-955dc83e14d5", "comment": "Malware payload (GCleaner)", "value": "a676d62a1d793e8ff72460e90487b60bff10db6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665463400, "uuid": "2b85ec00-5267-4834-ba60-a126558420eb", "comment": "Malware payload (GCleaner)", "value": "e57b0acfeed07b172b664d09ce462ecda6ffaf255f339e521ed4d6a16f5a1a064b1948e398ec2a6bdf5a88ee7be02b55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665463400, "uuid": "85fbd961-6ff2-4415-8bfe-22e97d1d554b", "value": "T1F074E12238C0C432D9AA6075CD76D7B12ABBF8705A318B477BE853985F267C19E243C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665463400, "uuid": "d6375da3-eb18-4615-9df8-114ea8c5ccb9", "value": "f07757163332cdbf737bafdb4614222c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665463400, "uuid": "ca3b8ec9-8330-49b0-b064-dffebb387981", "value": "6144:7/2QhLZjoZ/KmIxy+/KgE0fVzFcfpozsrWDh51lsWV:7/2QhxoVKxy+/20RFMplUlsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665463400, "uuid": "52561827-c96e-4cf1-8977-5fa4e8ee3821", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665463400, "uuid": "e9f06544-5148-4adc-8248-2791984bb477", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665463400, "uuid": "ac899b5b-8059-4371-8480-71632fc76cfb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9909c443-493d-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665476442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476442, "uuid": "a8200dcd-5ede-430a-901a-3c51892df6ee", "comment": "Malware payload (SnakeKeylogger)", "value": "5d57cbfd68a82bbb62364a77919a6fb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476442, "uuid": "e848b046-ba99-4b57-b1c8-d107d5bd1872", "comment": "Malware payload (SnakeKeylogger)", "value": "df757778956e59dda13ed21877d89a7b55902f285c5958d248300e2e9cfffb83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476442, "uuid": "d6194136-1d6c-4469-8177-a6eaf038c87e", "comment": "Malware payload (SnakeKeylogger)", "value": "69b00db4927791c0c19e038fa8d0d520ca475e6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476442, "uuid": "891d5326-4921-4f2b-a86a-e34de2edcac3", "comment": "Malware payload (SnakeKeylogger)", "value": "c8f04ba010f3cd38efd3a4f7cad9d58b2a93cd64f212d85d3ef5135e6dbaf9e6e6b1ab2edccf194dfc1611bdbcf2ba12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476442, "uuid": "63f82f3b-21c3-45a8-8409-d4274268cf18", "value": "T1C4056BBA21D58107E8253175C897D1F32AFBAE602121D5CB6AD72F6FBC411BF911338A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476442, "uuid": "cf680302-47ea-40b9-b42a-a7b895b77855", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476442, "uuid": "d74443e4-1c26-4a1f-afb9-7984a63968b1", "value": "12288:kR+J2umzmcvSuYoZljMocNsfB6M3ePdH8KfNT2aoxzB:4n7zmxOoS6MqdH8cT2aoBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665476442, "uuid": "544e97c4-6949-4c44-bc62-367c541d0976", "value": 871936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665476442, "uuid": "08a31b76-0f7e-4bea-bcb1-2d64dcc5a67e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476442, "uuid": "93975c32-c17b-4e2f-9a30-48ceeee45cb6", "value": "5d57cbfd68a82bbb62364a77919a6fb9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c43eb7-4918-11ed-9266-42010a9c0072", "comment": "Malware payload (WannaCry)", "timestamp": 1665460656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460656, "uuid": "ca9b0b93-0c2c-4a6b-86ae-2d6e2df6cdc0", "comment": "Malware payload (WannaCry)", "value": "cb5e2cdf03ff2c2603bd01d661a993fe", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460656, "uuid": "dee38673-4f80-4e74-92f1-b02664f14e52", "comment": "Malware payload (WannaCry)", "value": "e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460656, "uuid": "21da29c7-2ade-4508-9344-24a6775df050", "comment": "Malware payload (WannaCry)", "value": "0b82f726736b02320c94a9f662f5333b73223b3c", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460656, "uuid": "579349dc-6340-4d84-9ddc-195e01fe33f5", "comment": "Malware payload (WannaCry)", "value": "4455eaba0821012af29fc93990363433de047133f0e2feb7f7d73be59e3b1bc2593eb5a3dde78bfb528bba077e026528", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460656, "uuid": "b07cb3f4-e96b-46c0-a760-ec88575a2918", "value": "T1B2063355657CA2FCE0440EB440A78D6B77B33C596BFB5E0F8BC086AA0C53F9AABD0541", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460656, "uuid": "60f400ef-26d8-4a6b-83e8-960e8d25110d", "value": "9ecee117164e0b870a53dd187cdd7174", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460656, "uuid": "df033743-54f2-40ef-91e2-0a8dfa53747a", "value": "98304:yDqPoBhz1aRxcSUDk36SAEdhvX593R8yAVp2HI:yDqPe1Cxcxk3ZAErzR8yc4HI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665460656, "uuid": "8accfe59-f67a-4346-9d29-d762deb76243", "value": 3723264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665460656, "uuid": "574e3322-5e4d-488f-b09a-a07f6db7701b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460656, "uuid": "a6910c25-33b5-4344-97a4-0d9d7e9df151", "value": "e097ebca7eac1ea885504f038ad768a1fa440557ae45d3f23b8e92673b9688bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ebf4e4f-498a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665509389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665509389, "uuid": "43779e2f-50b4-4e59-8d9f-be4992167aee", "comment": "Malware payload", "value": "b46e8041a530518a6e2dd495d3540e41", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665509389, "uuid": "e33481e0-4bb9-4ae0-b337-f9fb1b6230e4", "comment": "Malware payload", "value": "e09986862b9932a18a96d09488179185487d087a7625675df41b5f0f6461e811", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665509389, "uuid": "179d5613-6513-4cb4-bdc4-e3698929174d", "comment": "Malware payload", "value": "33299247e20629b51e7fbce2e923e8a546ff8d49", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665509389, "uuid": "67565139-105e-4a8c-b537-4a3a11e303f1", "comment": "Malware payload", "value": "95a77065a1c5056a2c54e16787387bf4d4a6b0c8b041f3f3e1c38f53077da6f2f468b6d559c9d38b7faff8000771224c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665509389, "uuid": "512eeb1f-b266-40cd-80d4-b014ee3c7d1c", "value": "T1C84533C165BFF0F211B5B2B014930E565283CC7C7EB62795E7FC69D63AB132EA849088", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665509389, "uuid": "7364e9ec-8d47-4c8d-876b-cea565dec7aa", "value": "24576:g8tcK0o+ifNweLXZZJTLl5LRohJfYG7AfFa7o4qZUGTBq3otox7ZoS:gfKDzeiLJHlYhxH7I8o4qZUs8otohZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665509389, "uuid": "38d4610e-d980-4d6a-b3bd-4fe65e8df8c7", "value": 1212452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665509389, "uuid": "c3cb4f40-b07b-4b62-ae6b-20d2b8e992b2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665509389, "uuid": "c28785dc-b6a4-4ef3-b691-63c612b777db", "value": "mal.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f333b2e-4989-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665508987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665508987, "uuid": "0ed8944e-b5a6-4946-862a-204800914dcb", "comment": "Malware payload", "value": "9c1483ffdddb6e6cd3132984cb6aa900", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665508987, "uuid": "6e5df70d-4f26-4ad7-ad9c-0008f1ed36d4", "comment": "Malware payload", "value": "e0b5db430f465421dd7bf6e65e1d7af8d93c738a61c08730b32550bdcea4b7ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665508987, "uuid": "c5946a05-ad4c-4746-85ac-1e9ee80a070b", "comment": "Malware payload", "value": "69c0d13133bc04e109a17c8a8bfc02fbdd4a5d7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665508987, "uuid": "676f0bde-4d44-49b6-80c4-8ebdd684d4a8", "comment": "Malware payload", "value": "e377e1147197a764b3e7090d699c60ddb38e50096cc499f7fcdee91d28f0ca5ea69381cff735bba5f7da30232bd7fbd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665508987, "uuid": "56c6c1a1-c1da-4b33-a4cb-ae69c7d1f31e", "value": "T163C533915287C139F4A066369D26C424C463FD7EF83A140CA4EACB1F3F66E41E516BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665508987, "uuid": "47cc42e5-b2cf-426b-9ea4-48d5839c3b05", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665508987, "uuid": "725efb81-01fb-4c72-9319-fb716c2ebb86", "value": "49152:AG4u7r6zOfFfvjGOJlVqsD3JUezsREVR5ttQLJF34/FvuXHm8mOOKX:d4im+Xx/RJ9zQStCj34/FvuXH7mOOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665508987, "uuid": "364e8f35-5b42-417b-8bde-0e9eadc3d8b9", "value": 2635068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665508987, "uuid": "f745f0cc-9abc-42cf-897b-2e4ab9f8d532", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665508987, "uuid": "52f9a88b-f237-4612-83e5-beb89b4b413e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a7b9812-4967-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665494349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665494349, "uuid": "352aec85-8900-4405-9e99-b4c2f944c8aa", "comment": "Malware payload (SnakeKeylogger)", "value": "e36fa014d799dc13e3bf5bc38893d040", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665494349, "uuid": "0cb44cf8-6415-4a79-a5e0-9e2d402723ad", "comment": "Malware payload (SnakeKeylogger)", "value": "e15b4c36878dd4b68d7875fd502d4259a53ab0e0d7b800df5fcbcdee3d9e9db4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665494349, "uuid": "d66e8f39-10c4-44c7-8d23-093da99dc19c", "comment": "Malware payload (SnakeKeylogger)", "value": "fb5c32e3b3b4c93a9022897808dff96365c9af56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665494349, "uuid": "61d43d2b-ca59-401a-91e7-41228dd60188", "comment": "Malware payload (SnakeKeylogger)", "value": "d64cdf3cf49f125ff832a67d1fc8ae1a76d93750ebbbea5bb24c54f5062e11f58701916f444336e0b0b72cc82d6ade4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665494349, "uuid": "64957705-2bf9-4ca9-bfc1-25f92a9fbc04", "value": "T145255B7E269A8907D8153135C487D1F32AFBAD50A061D1CB6AD72F2FBC453BF9502386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665494349, "uuid": "d94eb184-93ca-4698-b7fa-59809a1e3809", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665494349, "uuid": "45500ff6-7e61-4e8e-8fd7-419ea3e93e97", "value": "12288:ZOf8Us3m3iC2bGHg8PozHXTF+bOqdhvLQ6pbWTjAxAQSQy4Ae:ZE3F254ozHDVQvSExAtQy4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665494349, "uuid": "ff0ee377-a3a0-4327-80af-db860bb9e17b", "value": 1004544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665494349, "uuid": "48650812-f9f3-4a6c-b3bd-3edc06bf2335", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665494349, "uuid": "168a0808-c7e9-457c-91d4-b8b92bc09b54", "value": "AKU PO # 331028.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "953f3f16-4918-11ed-9266-42010a9c0072", "comment": "Malware payload (NominatusStorm)", "timestamp": 1665460545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460545, "uuid": "44635753-e4e0-483f-8503-914e2d8bbb51", "comment": "Malware payload (NominatusStorm)", "value": "c39dd306f787efb539fa948a709d0135", "object_relation": "md5", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460545, "uuid": "4d0801ae-24df-4d1f-99f1-63dddf211899", "comment": "Malware payload (NominatusStorm)", "value": "e23a69db0a7e48a38e153072fec59f605036361c284600aeab7644e3ffabf525", "object_relation": "sha256", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460545, "uuid": "87a0b623-33e7-47fe-afa2-f5ed498f4dfc", "comment": "Malware payload (NominatusStorm)", "value": "02fa4a52ac5e88f055b68e7ebefbf85a338e7ae1", "object_relation": "sha1", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460545, "uuid": "cd422199-25a4-4402-9c9c-e36a55a74e5f", "comment": "Malware payload (NominatusStorm)", "value": "c63c896c0e821ef531fc1d6867ba2ae456b7e066711b1e1e7235b8a1acf5844609b79f541c16f794ed4c3d35ffde4f5c", "object_relation": "sha3-384", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460545, "uuid": "d0afdbf3-5fa1-4585-800a-220df20f5c4c", "value": "T1B1957E963B92C12AC06E03350CA2D3872172F86A9F1342D734D9B37E7DBEAC44A755B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460545, "uuid": "3ac0ae16-612e-48fc-936c-b873a69e7ac8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460545, "uuid": "713626a3-73e4-4198-a7ea-86e481ea8e6d", "value": "24576:lKKKKKKKKKKN7ChBWMQ+uSJJd3Dkd9+ZDd3vNSM0y9T+m5WNDV:+jLuSh3i+FtvkMzT+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665460545, "uuid": "dad55ed7-027c-4cd5-912d-39cb17608eba", "value": 1910656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665460545, "uuid": "8f4f3f07-67f9-4019-be8f-5691af3626ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460545, "uuid": "6226f85d-78b6-43fc-b6af-ce4a592308bd", "value": "e23a69db0a7e48a38e153072fec59f605036361c284600aeab7644e3ffabf525", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a9dafbe-499a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665516308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665516308, "uuid": "0f77e789-eb85-42cc-b7ce-4c8ae6e6fc55", "comment": "Malware payload", "value": "e2c5ca204aad2a761c424d3ea9899406", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665516308, "uuid": "94865170-41c2-40c3-9a40-33be88c6dbc0", "comment": "Malware payload", "value": "e407cb2e194ad729ad8ec27244478a318f5725d827528a4ea031b2817344e06b", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665516308, "uuid": "59f7a755-c342-40a7-877f-cd8f08fd7306", "comment": "Malware payload", "value": "e0aaa30563b893287cc11474e8620fd74472d136", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665516308, "uuid": "1d73d3b6-42c5-41f5-bf7e-d34a8f770ee6", "comment": "Malware payload", "value": "baa08c531119b988d6e0d031f5085757dfe5e416923e065b1cff3f8a456e5a31e031ae51598d93b59dc4c83a41f885ef", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665516308, "uuid": "642e3436-3e01-4352-8f7f-6f04942460a5", "value": "T14F22B040230BA7DA46EEAE6F13812DD156C21FCE399FEC2C3585886CF611AEBC4DD512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665516308, "uuid": "bbad6dc2-decd-43f2-87eb-f942e58b1eea", "value": "192:njvTDNX6cEcw8LbOt9mMwSr7WhYdtSO9KP1E5NRrkEFFwSI9ivI5Djtw3XeEH5X:nj7DNX6rnt9MSrahYbt9JbZky6mXe+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665516308, "uuid": "82dabd2a-a996-450d-a8a1-18979b9ccf6d", "value": 10479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665516308, "uuid": "96e5a37e-8381-44fc-838c-cee18e76d39c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665516308, "uuid": "d493f463-4667-475a-9fc7-494c04798df2", "value": "What is an open book agreement (23599).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76380d59-4952-11ed-9266-42010a9c0072", "comment": "Malware payload (Vjw0rm)", "timestamp": 1665485403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665485403, "uuid": "7a37e5cc-cdc4-4d96-aa22-6c5ecf095ffd", "comment": "Malware payload (Vjw0rm)", "value": "697c83a1e33899e8491df9c04a57f95c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665485403, "uuid": "c4a276e5-66bc-4b9c-b027-53d96ef73038", "comment": "Malware payload (Vjw0rm)", "value": "e48f0f7c465c0394b1891bd3a0f86f0d5e162dfe287a8bd24822f4500de49dea", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665485403, "uuid": "c6afd1ff-3903-41bd-a499-dd309355f883", "comment": "Malware payload (Vjw0rm)", "value": "76245f61352908f19d28f4d677dcf98ab67840d8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665485403, "uuid": "d544493e-70f5-43fa-aac1-e454d21e6c92", "comment": "Malware payload (Vjw0rm)", "value": "58acad25549401fe08cf06f3760910bdc87add6526b52bf8e982dbd11d29b5704087fb55db72328b25a7e53d143e2bc2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665485403, "uuid": "0c32f8e8-755d-4841-a6d5-2ac571489c26", "value": "T1A6035CA9C8771B51CE142F038AFCED487FB9B84D95E099AF2615854C52A503DF0AD2AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665485403, "uuid": "296da67f-c944-4f68-8bae-7a63b257d3c9", "value": "768:2buVp24R6SMfM4gF8wsZ1va/a9zcHEdYHzePC:2w2g6RMPCwsZ14a9zcH+IzePC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665485403, "uuid": "0b729ec4-dd34-4109-ba7d-bc57019fda6d", "value": 38518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665485403, "uuid": "d40e122b-49f9-4573-b8fe-b82add01809c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665485403, "uuid": "4c7228d9-87a7-4f87-9639-dcb9b0617cf3", "value": "Invoices Supporting documents.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b703fae8-4935-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1665473057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473057, "uuid": "6bcd678f-3757-426b-9358-212c9f876397", "comment": "Malware payload (AgentTesla)", "value": "160905ab73c952d0d572a4930029e626", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473057, "uuid": "2e8bf350-05bf-403e-a3aa-fd0e5805fea5", "comment": "Malware payload (AgentTesla)", "value": "e4b0697ace5769f9d0a07062e421524bed413348685ec86ddcdfb8ffe828a75a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473057, "uuid": "8132dd12-d0bc-4972-992a-dddb840d144d", "comment": "Malware payload (AgentTesla)", "value": "23fd14631b71e8072cb0f635380f46da076a0981", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473057, "uuid": "d7af2af5-dadd-4dfd-b4b0-781f1ff62922", "comment": "Malware payload (AgentTesla)", "value": "de0bdd37b24bd9be4081c9e1b6f2c07a78b391ffcf08182042098fa2281bbf00ece1cf791b9d7637020fb372efc88300", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473057, "uuid": "725e339e-8c89-48fb-ab5f-ff01ff5a5d8e", "value": "T1FAF4392429EB522CF4B68BF95FC8F8FA8C5BFA612529B1F624A153468733E05CCD1135", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473057, "uuid": "aa0055c8-bb24-4d99-8bbc-b17d58df80ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473057, "uuid": "58eec4af-9c60-4e4c-97d1-f5930868450c", "value": "12288:XxQI2iNa8TJDJctZ+maYxykFOFLtxh99luXdADqjJ5n2:l1oCDUSkfgdt99oXNjr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665473057, "uuid": "5da4a698-6ed4-43de-ab43-76746347b5da", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665473057, "uuid": "cb254c8a-ceb1-4e0a-ae4f-6dd0be951f4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473057, "uuid": "7d467247-555a-4641-93f3-9aa45ae8fda0", "value": "e4b0697ace5769f9d0a07062e421524bed413348685ec86ddcdfb8ffe828a75a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59def927-4989-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1665508978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665508978, "uuid": "6ee3b76a-80dd-49fc-9faa-d4e83eb3c492", "comment": "Malware payload (Smoke Loader)", "value": "512f1687b938e673c3b8b05e73e9905f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665508978, "uuid": "9dd859df-04f7-4790-80b3-80dc82c2a2be", "comment": "Malware payload (Smoke Loader)", "value": "e4d9db2c0a37eb4a6d9e16a1d149d2a3de304bf2058f5a75ddf9027b187761e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665508978, "uuid": "d89a295f-7cb0-440a-af47-98a636330d9a", "comment": "Malware payload (Smoke Loader)", "value": "07ec16b0df79c000a7f65eafc2861c9f25369a62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665508978, "uuid": "f7278e6c-b197-4b1d-89ae-2b642267b610", "comment": "Malware payload (Smoke Loader)", "value": "120e42cf2b1db45beff78520b6370e99dd223995897151c0bfdb0845f6b5126657a267836104905b745d3da2803ccfc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665508978, "uuid": "24e5619a-8281-4233-9cde-336f93415742", "value": "T13724CF1236C1C472E26616744C64C6B52BBBFCB95A3556CB7BC82BAE4F312D29E21307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665508978, "uuid": "67c20b48-6168-4ef0-9d37-f800ed459191", "value": "47f3841b8380a704a9ff258e0444ec1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665508978, "uuid": "476d8556-84ec-4df9-a3d9-652761e2c99a", "value": "3072:YoSPImZE0KVCLS/Inxt8dk6n8JdVXN2rVNW4pr5SMVORWdhxBUFxO:Y6OtLSgnk8TVXgrVjp5ScOYTUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665508978, "uuid": "09125eef-cbb9-4f2a-849f-9efc6b96370b", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665508978, "uuid": "7d60e44b-eb44-402b-a2d5-64b764865610", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665508978, "uuid": "7e7d0fa1-6e55-4d06-b376-07654131c27e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa79180c-496d-11ed-9266-42010a9c0072", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1665497222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665497222, "uuid": "04211e43-9fe2-4d27-b580-66693592795e", "comment": "Malware payload (AveMariaRAT)", "value": "3ae8a915191e154e1d390f011d1403b0", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665497222, "uuid": "073e0e03-9636-44ab-a87b-51862fb31670", "comment": "Malware payload (AveMariaRAT)", "value": "e57273b7f448b8713bd164d86bfd24a01570a4f5902e09fd07d6df7088458cd1", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665497222, "uuid": "672822e4-b70d-4ad1-91b0-3de6e286f790", "comment": "Malware payload (AveMariaRAT)", "value": "e36e2d035f0f4cfae0b43cde8bc276d9ea9ccb13", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665497222, "uuid": "ff66883e-e9b2-4719-9053-2d818076d0ca", "comment": "Malware payload (AveMariaRAT)", "value": "fe623a9f072c6a4e5171b8cd482a8b3abe49b176cfdd5b43e08c352e0f0996a5cfb700c93d883b92baa0fe00ab01acde", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665497222, "uuid": "6bf7f554-d05f-45bc-b522-fe2bf70ceda6", "value": "T139F49E21F2E085F3CD721A7D4C5A935DDCEA7D202E2C268757E438C8DB39982791B267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665497222, "uuid": "5243b55b-f366-49c8-9f59-eae0d9b10a0f", "value": "60ed1e095e254a993d83e426e0a00efc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665497222, "uuid": "3b39f6c1-ef3f-432f-bba7-a11b39f15ede", "value": "12288:ARGCFg0BOWvJ4sFJzZDM94u2itVSX3x7FRS8H8VML2kjO9:AMiBOWvpPlLHitVSn52rmKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665497222, "uuid": "1e95baf6-60aa-4d92-88db-389d2c4a2b92", "value": 752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665497222, "uuid": "8bdd0c54-ad5d-4416-92ee-2bd28498e1e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665497222, "uuid": "eaeab1bf-4a20-4454-8c91-d5072b293fba", "value": "Etahlplefwxouf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2708080-497c-11ed-9266-42010a9c0072", "comment": "Malware payload (WannaCry)", "timestamp": 1665503543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665503543, "uuid": "beedb943-e9c6-409b-857f-3f8e86075972", "comment": "Malware payload (WannaCry)", "value": "b583e353ce412edcb4128c251901db5e", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665503543, "uuid": "66187ceb-b238-4d42-9e61-3e52704d90dc", "comment": "Malware payload (WannaCry)", "value": "e58439a478f75ecb09bfcd633f738483e5e269129669288d8bde0f4cffbaa7ec", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665503543, "uuid": "dd81fcb7-a863-49f9-84a4-b8cf08adc0b8", "comment": "Malware payload (WannaCry)", "value": "482a398c3e8cd2e58f56a5830573b7022456c4d6", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665503543, "uuid": "1c1040ab-07f0-47e2-bbf3-8622bb94f3cd", "comment": "Malware payload (WannaCry)", "value": "1c40ecd2ff731cb1c9d5fcd4251f996b02e1e4affce4d2fc45c5946e59cd736c5ecf853796067d1a7e47a7f4dc2e1de2", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665503543, "uuid": "0df0e8ea-6d8a-4b11-8348-f67a82969a3b", "value": "T1E8363394622CA2FCF1440EB44463891BB7B73C6567BE5E1F9BC086A70D43B5BAFD0A41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665503543, "uuid": "cc195f6c-bca6-4523-a2f5-fdb2b5a190b6", "value": "9ecee117164e0b870a53dd187cdd7174", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665503543, "uuid": "9f328b2d-60f5-4750-9f17-4e9121e41d07", "value": "98304:yDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:yDqPe1Cxcxk3ZAEUadzR8yc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665503543, "uuid": "c2998874-a8ca-4ab8-a122-a4a0b35b2f14", "value": 5242876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665503543, "uuid": "ae7bd35b-1b5c-4d9a-8772-88792a7845a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665503543, "uuid": "3d954677-437f-4265-a1fa-9192f05f0f7d", "value": "e58439a478f75ecb09bfcd633f738483e5e269129669288d8bde0f4cffbaa7ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c48469c-4966-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1665493896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665493896, "uuid": "9eee5073-1ff6-4c65-acf8-cf97e33f487d", "comment": "Malware payload (Formbook)", "value": "a7b6106a0481e055df30cc10bfd7acbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665493896, "uuid": "10d1ed7a-82c3-45ea-baac-3bb381eff51a", "comment": "Malware payload (Formbook)", "value": "e838d341d05fb719bcecd3cd2d7e252829392600f2fcb0e6b20bec5415531d8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665493896, "uuid": "3534a94d-3ed0-4e24-87ab-bae3a37ff4a1", "comment": "Malware payload (Formbook)", "value": "b5a27318984cd9b4fc84a45dced6d3ec634b1b80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665493896, "uuid": "1de99933-0aaf-4174-a315-fbd43c469f95", "comment": "Malware payload (Formbook)", "value": "d2e231cffd8017e117df35978302ff55a03f820c4041e465e00536c348cf6869b097e93da7b7d3b8803c850e11cff222", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665493896, "uuid": "0808a99b-9d89-4e63-8552-59a490c3c433", "value": "T165A4DF017900979DDFD20A31C81E87AC0E566E5EB1A09257A7BC3F1E7EBC3539829B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665493896, "uuid": "481e3db1-206d-4563-ace7-87779d906c6f", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665493896, "uuid": "469abd0c-13c1-47de-933a-cff70423c504", "value": "6144:oNeZZy5phzEbNikyUntN23OFNBwgYRdoyEIAO1zHl1:oNAy5MbNiObqOFPFhS5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665493896, "uuid": "3f65f491-1a4a-44ed-8c52-0b5a1661ba95", "value": 455817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665493896, "uuid": "76683cc0-dd74-417a-ab6f-8e54a47c9cde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665493896, "uuid": "dbf764d3-792c-4dc8-a838-6c653123e894", "value": "shdybron2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e674c37-498f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665511616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665511616, "uuid": "0fc4330f-fba3-4c67-995e-a652bd03e2da", "comment": "Malware payload", "value": "e512414d3c5d164f4a28875223b2bccb", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665511616, "uuid": "8244978d-aa4e-46d3-b926-addafeee7c1c", "comment": "Malware payload", "value": "e91bfe70067328c9a591c2d5af2edd9c35b8266b6478f9b66332080df1de5c8e", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665511616, "uuid": "d24c772b-35f1-47d2-81f9-4cd6eef9bbe7", "comment": "Malware payload", "value": "53fe92cb93020dae7f94752fe0939e51f89ebd73", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665511616, "uuid": "7929806e-ddde-4e30-b4ca-3d7e2b8a549f", "comment": "Malware payload", "value": "8d4a3a7e32dcdd35d766ac024e5df34e9d870ed89edeb96bf93670b5b87050ddccaa0a416750d7e2c12e0f43a2071c39", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665511616, "uuid": "c92136ac-58df-4fc8-ac8a-820d3eb21ecd", "value": "T1884423A45CFDF8C81B6076A08D73763C0D200919C525F54893FCAB62AB4EE54DAC99FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665511616, "uuid": "7ff45d84-16f3-4dd6-a210-9b3179301ad6", "value": "6144:PeiTSNwVctEn2ka8C0ndv4mUn1BzMwGAlxYn:PeiTSNwOE2eC0d1spGxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665511616, "uuid": "6f1552e5-d7cc-4b52-b551-d24290af10d2", "value": 261491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665511616, "uuid": "41ab981b-473b-4075-a95d-a69e6073e064", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665511616, "uuid": "cdd19487-b78a-4307-91d2-e105f31da9a6", "value": "quote.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b456e4ca-4973-11ed-9266-42010a9c0072", "comment": "Malware payload (WannaCry)", "timestamp": 1665499681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665499681, "uuid": "e7fd6b70-c83f-4c80-9ed2-aaaadf1bcf93", "comment": "Malware payload (WannaCry)", "value": "9f75c295e2503a82fd1478aa72cbd221", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665499681, "uuid": "325b9910-064a-4b20-8934-a704da45607e", "comment": "Malware payload (WannaCry)", "value": "e9ff498068bd03b19a9567d9478e1bf045c9cd9794f7ba0012d6ffbf01643d60", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665499681, "uuid": "3624943f-ec9f-4a08-b37a-f438a492c17e", "comment": "Malware payload (WannaCry)", "value": "09fb701ddd78884d39a1669a0441a51976cd10ca", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665499681, "uuid": "219efcfa-193d-4eda-89d3-18b12132c4e6", "comment": "Malware payload (WannaCry)", "value": "fa50f11a2b64c4007bcd9174017679c665eeef08a54d1f134f1ad739b087b158964ab2a69562ce693e645f8ac9763227", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665499681, "uuid": "56a500eb-b32d-43c9-a43f-aaa02bb659e6", "value": "T1950633E4A56C60F8F10419B4897B4E16B7B73C3D26B71E1FEBC08A651DA3F97A780241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665499681, "uuid": "c25e373b-4526-458a-a05e-d432a7552fb4", "value": "9ecee117164e0b870a53dd187cdd7174", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665499681, "uuid": "c6c6566b-9ffd-4436-8e8d-70d54998cc0d", "value": "98304:oaPoBhz1aRxcSUDk36SAEdhPP593R8yAVp2HI:oaPe1Cxcxk3ZAEjzR8yc4HI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665499681, "uuid": "773f1e14-2ce6-4eaa-9da7-20a0939825f0", "value": 3723264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665499681, "uuid": "b4b03397-f806-4015-b5a3-979551ec648f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665499681, "uuid": "b8d21aa4-f7b7-4ba9-9661-f799184000b0", "value": "e9ff498068bd03b19a9567d9478e1bf045c9cd9794f7ba0012d6ffbf01643d60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e1d283-49bb-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665530666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665530666, "uuid": "0cc0722e-b39a-4aba-a69a-43db9433b3e1", "comment": "Malware payload", "value": "b8e99f04e5a459e6f4963811d66b56ca", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665530666, "uuid": "28ff7206-95e6-4c64-ba64-5ff371fe5d5c", "comment": "Malware payload", "value": "ea5c4107afa695a55a489d4c6ffc6edaa06690a6d196a62c0ae8388f0cdd87b9", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665530666, "uuid": "ecc56f6c-1921-435c-8702-86e86b2eea99", "comment": "Malware payload", "value": "a2c79f4e15732406addeb9c1965d7d8c000b49db", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665530666, "uuid": "2cbd462d-c705-4640-aea0-396b413a4dd3", "comment": "Malware payload", "value": "47d0db7b578c5a64af18da054648b9dc7a541971bb6f2736ea8040ffcd75b6065657ae47c20c4abaca35d0f265506a1f", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama212", "colour": "#35EF15", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665530666, "uuid": "bc78a706-d48c-4de9-ba21-0e9e9471d4f7", "value": "T13025025F4D53E8A80FB897B97D7B0964361751E8D1EC21DE9F84B0E2768283E814E4DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665530666, "uuid": "917ee670-8618-42f8-bc73-f83a7527aa43", "value": "24576:x4loHd6SM5sH0ZnieQYDVD2aYRsTITFMf:fH8TZNQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665530666, "uuid": "0a8d9cc4-6b38-4685-a330-6a6d0c60e262", "value": 974077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665530666, "uuid": "b50c1eaf-1313-4f5f-bdd0-4e9cc203f2f5", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665530666, "uuid": "a8a55101-d389-4b0b-a5fd-601d34a65891", "value": "RFSL_6379.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f88e5f6b-4971-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1665498936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498936, "uuid": "deb59e9f-7860-4919-8b57-36a6e53aeca7", "comment": "Malware payload (RedLineStealer)", "value": "17ebdf23b6e531bd51e021a441b934b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498936, "uuid": "73bfcafd-fb79-44f9-a681-9dcc7fcdb3ae", "comment": "Malware payload (RedLineStealer)", "value": "eaa6e23bcca1050ddcc915b2f1a3bfd5fbf5e3471e67a3e5549098b2cd23c8e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498936, "uuid": "2b605a26-bd82-4447-b22d-b3815763c30b", "comment": "Malware payload (RedLineStealer)", "value": "8261834977e8c89b2620cd96c43fad8f1682736b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498936, "uuid": "ed37cdd3-5895-43ba-bb68-6fa9c47524b9", "comment": "Malware payload (RedLineStealer)", "value": "677d3883f632fcc43368e8ae543d714a23f5de0c1b6d04ae455319ecc25ac7d6743ede5ecdece2e625ec511e245f1b2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498936, "uuid": "2d8b9f08-53f1-497c-9460-6a1999189afb", "value": "T14593392463ED8A34EAFD4A756CB700594BB0A58F6401DB8F4EC4F4D91EA6BC027136E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498936, "uuid": "3f3549ad-40be-45f8-a8a8-fb8c1c636841", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498936, "uuid": "5a967c94-1091-4806-aaee-1ebf80d6dfe6", "value": "1536:EQJw9MxWK4hgZ5ZXEnYb60HfHyYd9uOVTcwMbr++dAaWO+5aJVYbsa4eGZE:5JUgXZAYLyxAaWO+5sVYbsJeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665498936, "uuid": "d1cc1bdd-5ce7-4fa8-ac76-938df98fea79", "value": 91648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665498936, "uuid": "267e20c6-6ec7-4cc1-b8a3-8654c75cd9b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498936, "uuid": "3b326963-9709-4a07-ad22-6ba8076e2eb9", "value": "17ebdf23b6e531bd51e021a441b934b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7b34c1a-49ad-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665524705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524705, "uuid": "48d5ac13-0383-48c3-8ec9-7b04de7ec60c", "comment": "Malware payload", "value": "97d1dbb45354e83a8cb79d5900f77c8e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524705, "uuid": "3f5e88a2-c7aa-4c5a-9505-fe706331d2b8", "comment": "Malware payload", "value": "eabd3b0475633fdea096e71f126a8e96c8b1b97a060288be8c65e30e56e2c587", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524705, "uuid": "8ef164bb-0921-429b-aeed-790fccd4f38c", "comment": "Malware payload", "value": "211c6d2ea6e2e38229d902811110b0f09b3cb214", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524705, "uuid": "ba682e14-e988-4cd5-bbc7-56410364e351", "comment": "Malware payload", "value": "6a5d8f299bdd4d946886d83128ca95bfdb3508a123ecc79ae735e56c97834f3d4f048d6a43b1991394943928d5651d3d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524705, "uuid": "7a55a9c3-6efd-4ab6-9291-61b566acb638", "value": "T1F996AD52B7D1C075C0AE0234CC7AA3DE1276FC618F2282E772987B9E6D76BC04971766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524705, "uuid": "be716540-fdfe-49b8-81c8-b904aa15c9c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524705, "uuid": "6752f2c0-1da1-4f53-8890-90d30f8e9cc1", "value": "98304:OLu1g9ZGlWrfTZmHqXE9ssD/QjI+1ozfLu1TIRtUOV5Z93psErUtgKpjF:Od9JTZksaJ+1orTRtp3psErUtjp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665524705, "uuid": "d7a20904-560a-4fb9-8224-089a5d3a19ab", "value": 9166336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665524705, "uuid": "605c5bf8-b80a-4406-be9e-d39ecbbbb28e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524705, "uuid": "e3318f60-d64b-479d-9bc1-2057a761cf2d", "value": "eabd3b0475633fdea096e71f126a8e96c8b1b97a060288be8c65e30e56e2c587", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d49e9b1-497b-11ed-9266-42010a9c0072", "comment": "Malware payload (GootLoader)", "timestamp": 1665502917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665502917, "uuid": "ed38a4ad-eb5d-4344-8b2d-feafa45ccfc0", "comment": "Malware payload (GootLoader)", "value": "025db81713ec9f3eef9d469545e2ee1e", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665502917, "uuid": "62f66f71-742c-4cfc-9ef1-dde2855e322c", "comment": "Malware payload (GootLoader)", "value": "eac227a18a41c2721b4300fd767c39899d7215410cd2cabc7793bad392384549", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665502917, "uuid": "c260f04a-b5cc-4cba-b53a-725864314b11", "comment": "Malware payload (GootLoader)", "value": "80f4944a621cc8f899c0cbfbd3a9c46b1241d0ec", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665502917, "uuid": "f0e242dd-0e96-4182-8999-103998483adc", "comment": "Malware payload (GootLoader)", "value": "87b9ae4ea01511075295b480411389c19f0540057b78c251de9ad4704cd52daa6d5c7b72cfa0d2175c3c1cf883abcc07", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665502917, "uuid": "76450809-dbc8-4f7e-8961-96cdf1e2c135", "value": "T1F1033D4E17B60631C163712D6FAF6A14663BC10B180DDA1E3CADA3D49FD152C4ABAFB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665502917, "uuid": "9cc52d0f-8844-49c9-833a-2ca8788985d7", "value": "768:E9bEGiI5rs7BbRwXf8QZbvzvrPE5ctjH+z34jE:E9ACrCP2X4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665502917, "uuid": "aad2e7eb-868b-459a-acc1-a7421a37b6a9", "value": 40807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665502917, "uuid": "2d3d1646-bf93-41be-b1bd-909278f4b7c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665502917, "uuid": "b6bf1f4f-af00-44f3-98f1-b7c1be4a53d7", "value": "State_farm_staff_agreement_assessment_answers (qa).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a4ee533-4925-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1665466029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665466029, "uuid": "8d05921a-c74d-49ee-b0d1-b5a45d050607", "comment": "Malware payload (GCleaner)", "value": "5467934eb31dc7a24c37350fb86c53f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665466029, "uuid": "6e7c6a8d-9357-45ea-928c-2de559669a42", "comment": "Malware payload (GCleaner)", "value": "eace9d6f2be6f377e9a834aed0f2c7b31252e911a65c482366b7a9cb9828d42a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665466029, "uuid": "a61a54c8-fac2-4665-b746-bc24cce3a1f7", "comment": "Malware payload (GCleaner)", "value": "9b918a71a3c09ff5337ef6fca03e0bd57215785b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665466029, "uuid": "fdf845c2-4f79-491a-94ef-9ae48fb42292", "comment": "Malware payload (GCleaner)", "value": "f650b380323c47ff20b0e48d2453eed3b454be42a2b1fdcb0dc74e1cead83ce4da6e71c9f1f66cd7ce480afc361de870", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665466029, "uuid": "e88fbb90-2d91-4ead-b698-c90de0495748", "value": "T17774F10339C0C871EA6A61358D75D6746BFBBC7506368A877BE812AC4F657D29E30383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665466029, "uuid": "8ffac75d-78c5-4c15-b37a-3d913a51582f", "value": "f07757163332cdbf737bafdb4614222c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665466029, "uuid": "b77d182c-1c74-4969-a649-d7a74aacb12c", "value": "6144:1hw3RLBDbjUwXZJhyogJX8M12aQlMSYPppsuMXnh4:1hw3RNbjU4iogJX8naOMrkZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665466029, "uuid": "e1215901-7e1c-40f2-bc22-422691480170", "value": 348672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665466029, "uuid": "5825c6bc-9568-4fcb-8df3-615ed67d876d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665466029, "uuid": "a13b511b-aa45-44e1-b89f-0415040f4a53", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d29443-4918-11ed-9266-42010a9c0072", "comment": "Malware payload (WannaCry)", "timestamp": 1665460646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460646, "uuid": "f0e47a4e-0ac2-4f9f-b17c-63d023637e38", "comment": "Malware payload (WannaCry)", "value": "52b9761a0fb6f9bf4d62d60e512d63cc", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460646, "uuid": "80f2ad49-dd6f-44b1-af59-bf0a06c043bc", "comment": "Malware payload (WannaCry)", "value": "eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460646, "uuid": "1b0378f4-9018-4bb8-bddc-277d51057882", "comment": "Malware payload (WannaCry)", "value": "08d125e7c0d547654de44956bdb9d006348069e8", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665460646, "uuid": "c0f3cc40-76d6-4e83-b892-ce2e31c155d0", "comment": "Malware payload (WannaCry)", "value": "13b282dc91a08da29c6f4edb489af88fae424f8adbd6c8ae47773cf6609e92023102cfe289df08f5d19e15668f3d86cb", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460646, "uuid": "051fcc0f-8374-4fff-87ca-bc7458d73cda", "value": "T1AF363399717C92FCD205297444BBCA23B2B23C6E26FE6E0B9F4049751D43B5AB790B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460646, "uuid": "43661aa7-0fae-4c31-9680-e0af2936b0ff", "value": "9ecee117164e0b870a53dd187cdd7174", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460646, "uuid": "9cd1f02b-defa-4a83-bd14-cc841c934d78", "value": "49152:3nwMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvw:3wPoBhz1aRxcSUDk36SAEdhvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665460646, "uuid": "87e90249-b1d6-4048-9da8-556a8b8705f8", "value": 5275648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665460646, "uuid": "7d0c507b-34d0-4e46-8ec1-28949428a4cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665460646, "uuid": "2bba5ac1-d341-4c3a-a5c5-1e2adc5338a5", "value": "eafa317c34a868cb700a943c6abc04025bc8e5589afab1ab457372c51eb971d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fae46b9-4937-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1665473662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473662, "uuid": "d3592cf1-edaf-43d6-8f5c-8acf510ef023", "comment": "Malware payload (AgentTesla)", "value": "ff44f2bc1cdb839d0164f15d4e8b5187", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473662, "uuid": "7f9f92bb-8ec4-4d6b-b830-a40a48f108d8", "comment": "Malware payload (AgentTesla)", "value": "eb94b3a9d0c4cd649911af985e6d82a66c36c1436723eccd3dc7b8fc66dfe8bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473662, "uuid": "97a61087-3576-4dee-8faa-8faae1e4e94a", "comment": "Malware payload (AgentTesla)", "value": "b10c2840d81545b0056d4977788ca6c8b6c1d47d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665473662, "uuid": "2699cda4-075a-44ee-bed2-60b897ae1352", "comment": "Malware payload (AgentTesla)", "value": "c17eaa3e823bf07027056df23a1f32f79868c3a9a4046cfa6b8634f91ce732a13e85c5ff377a0df2e977b76c45d9b126", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473662, "uuid": "1c00a495-62f4-4e34-99ce-b9a9d111e9a2", "value": "T1B1258C7E1A894607E8293274C493D2F32AFBAD606061D1CB5AD72F6FBC512BF9503346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473662, "uuid": "50ceb1bc-2f70-4e27-85f4-a094b835532e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473662, "uuid": "8358df0b-3503-4b5b-a776-4dc3d055bbb4", "value": "12288:tswJ7logcsnGRaQPUKV7xIvVT/uZd6VxCG3LvpgGf4z9nu4Y6G4AQSQy4A:3lrxu7KRuwR9gs4zRdTAtQy4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665473662, "uuid": "97e8a58d-caf8-4608-a2b1-bda728412f50", "value": 1031168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665473662, "uuid": "ad12c425-ac4e-4a97-b014-252f8194618e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665473662, "uuid": "9ffd7ebb-a029-47b5-8af0-dbe8a13f8ab7", "value": "2022539611 DMO 1.S\u0130PAR\u0130\u015e OZAKYEL MEDIKAL AS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0fa5163-496e-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665497501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665497501, "uuid": "cbf0a4c2-49cf-416c-8ef7-d265037b698d", "comment": "Malware payload (SnakeKeylogger)", "value": "09e30d9d85203b6773aa09d5282ff04d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665497501, "uuid": "928f8468-3dcf-40f1-8d82-6a2f0f9a14dc", "comment": "Malware payload (SnakeKeylogger)", "value": "ed31c7e7fc9f786ba9afc2d2885da4db73c4cef7c4514ce69089f57732f5b1ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665497501, "uuid": "59ca3db4-d83a-4245-9d64-0db346e33bc6", "comment": "Malware payload (SnakeKeylogger)", "value": "edd27ac576c4a6bf6785b8f9cdfdac1907a053eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665497501, "uuid": "14d62290-0599-44a9-8bc6-0add018795a9", "comment": "Malware payload (SnakeKeylogger)", "value": "896121e184a886281dc83cd92f5c878357b1beeea4cc3f3f1fc7dd6ea060208e1358d4a34e616b8a589c34519070c66f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665497501, "uuid": "13316ec5-9676-48db-9843-95208884c05e", "value": "T165254A7E2A9A4907D8153135C887D1F32AFB6D50A061D2CB6AD72F5FBC413BF950238A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665497501, "uuid": "538f8f47-b498-4213-b710-becd5c96c77a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665497501, "uuid": "e8b76a34-c104-44c8-8ef0-495bc89f7f91", "value": "12288:mUIM+lZUszzimeJfHgpa4aLDeh0kGTMF2nv/ZJfpHe1zRAQSQy4A1:h+lrzi5gpBa+jkesv/ZDefAtQy4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665497501, "uuid": "8e188123-5b60-4704-8771-a6cea1df23fa", "value": 1006592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665497501, "uuid": "13ef3223-ee5d-430a-8ec8-53dc265fd203", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665497501, "uuid": "12105abf-5476-45df-817f-2bde02442079", "value": "g8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe9d2d3-4940-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1665477877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477877, "uuid": "264ba885-697f-4cd7-b658-a98d6b59fa59", "comment": "Malware payload (Formbook)", "value": "6fc3d6b9c992f9f7db2d5f8357ac3e3e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477877, "uuid": "7b16bf88-4769-4ab9-bdcc-2ca780822771", "comment": "Malware payload (Formbook)", "value": "edeacf21985057187ce954a769e1fc303cc213147527bee1342f8589b8643eb3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477877, "uuid": "69b06b78-fa2e-4eb8-aa2e-7bf784e99da7", "comment": "Malware payload (Formbook)", "value": "baec76671b099cdc18a099e0d370e928178b5ae1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477877, "uuid": "76da23a8-26ef-46ed-88e5-20868fd8b38e", "comment": "Malware payload (Formbook)", "value": "3e314600f49baf1f934d63dcae6729336d8831c4157cc1e4fe87699d1f38c6b886db77698c4d112837c59c07a85a3ccd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477877, "uuid": "11e7f933-4556-45a0-9e4e-7935a028f001", "value": "T124950257F7D7FAF0E6BE827A85B1851D52B734620260E78F660072896E23392443DB1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477877, "uuid": "5a202938-134f-490e-8880-b6733379e3c6", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477877, "uuid": "879574dc-ad9d-4d60-9f36-c0377ea7a12c", "value": "49152:QzCHIkFxnqgUS0nG3T/LWdXmUlKft432PmHA:kCHIaBqFzna/L+Xl3Smg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665477877, "uuid": "e2f97a58-1fbc-48c7-80a6-53b814181df0", "value": 1878528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665477877, "uuid": "21e21ba8-241c-4c6a-a662-c414418307d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477877, "uuid": "bdd1e309-d77b-49c6-b3eb-59ddd7940ed2", "value": "Documents.xlsx.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00bb12c5-495b-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665489072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665489072, "uuid": "36e6b2d4-b63c-48ef-8d6d-3a5b76456f78", "comment": "Malware payload", "value": "45299d77edb17dc48eccec70e928d9ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665489072, "uuid": "7521a203-b479-4798-89c7-585ea12ede12", "comment": "Malware payload", "value": "eee0f2f6b2524498f8287f95dd184828a044677700d61e2c0a109866f3dd504d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665489072, "uuid": "1296bb04-8898-4e2e-b85b-b12258c094fd", "comment": "Malware payload", "value": "b8499d3cb5d906b6e3c3e381a348298fc28225c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665489072, "uuid": "31346b15-9956-40be-8033-b3c31c7a506f", "comment": "Malware payload", "value": "5aa3a82bff5308c357e1f57b711bd9f8b0942b7e5bfd4cd40656677e36aaf28b1aca6c90d8f26ca5e54564ce79067e77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665489072, "uuid": "8188f440-1de8-4e7c-b3e0-91d6f39f9a5b", "value": "T18B15DF8AA3A407F8E0BBC03889524646E772BC0547719BDF23E4566A5F331E25E3F761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665489072, "uuid": "51774ea7-f877-46a9-bcfc-28dd694ee71e", "value": "f602d8bfef6549a83e5cdb863ea92452", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665489072, "uuid": "eed53764-4bf6-4e76-8b1b-0051eba59238", "value": "12288:VLwIQ6PoWYgeWYg955/155/ZEAm5wUMJlizoJBmvDx6cVKBmhkyfxGJH5q/Z1bLI:hwIQ6PEAmSUcGp7xtnxGw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665489072, "uuid": "fbded4e0-4305-4d16-b603-cae985afbadb", "value": 905728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665489072, "uuid": "71cef10a-aeca-4d9e-9d00-cdb52c27590b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665489072, "uuid": "bd85626b-834e-4b5f-9ade-d317ee49bd8d", "value": "win.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a778784-4994-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665513784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665513784, "uuid": "a1587cff-7453-4172-a9be-f99c0247a36e", "comment": "Malware payload", "value": "69915ce48f0fe497dadf17029b30cff4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665513784, "uuid": "acc9f376-6bac-4bc5-ae66-ef3500bba08d", "comment": "Malware payload", "value": "ef3212d415f79fdc069b605fb6dc615528115bcd0ce86f6e8ce60e0807d9d33b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665513784, "uuid": "1fb1e30d-25cf-4d65-acb1-3921af604ab3", "comment": "Malware payload", "value": "fdff238c75541b81e281948c33abd974987ae776", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665513784, "uuid": "c6c8e50f-0b64-4c89-9508-9e7323036ac1", "comment": "Malware payload", "value": "7f9249040c6ba3eda15ef0f8fa39ce7fdd95296dae684967fe90544feacc71220e13252fe38b4604070bd8c3c2ab6b76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665513784, "uuid": "dbbb318d-5b35-406d-9ea4-026f890fdd2e", "value": "T11A24BE113680C472E2122A308C69D6B46BBBFCB5993557CB7BC86B6D4F362D29E34743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665513784, "uuid": "c5354e05-f45a-4b3d-956b-2aef22a245f9", "value": "47f3841b8380a704a9ff258e0444ec1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665513784, "uuid": "a6c2b114-cf78-4c56-a83f-ddbd3fee29d9", "value": "3072:zVW/p+5D5zopLjgJ1A6t81XofZgOAFyMw12J3XqrywjRuSWO:zM8iLjg1Aa+RyMw129pwsSW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665513784, "uuid": "74076acd-006c-49f6-b109-bddade394d27", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665513784, "uuid": "d0aaec7f-7d12-4bb2-8ee5-9944670915a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665513784, "uuid": "138a7d0b-bad0-42a4-b142-ae5e23afbff3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cc3f46f-4935-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1665472932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472932, "uuid": "f7908c7f-e352-47c0-86da-5342db396cf5", "comment": "Malware payload (Smoke Loader)", "value": "70ef48d51fc14a13aa936aed8380b538", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472932, "uuid": "0af30f9d-213e-4bec-bd34-8c91ee73cfb4", "comment": "Malware payload (Smoke Loader)", "value": "ef6742b5752cb115be1e6cdacdb3f6d58224f81de4cac7aa886c096be47b3e4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472932, "uuid": "76f6e0af-4dbd-4c56-8a43-800bf74a0358", "comment": "Malware payload (Smoke Loader)", "value": "06d2f06d4b8c5cd84cdfe117bc0c4e5b7d15a237", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472932, "uuid": "6d37eb06-f9d0-4221-80f6-35a02174f9b2", "comment": "Malware payload (Smoke Loader)", "value": "c0c45c97fd129d7d8a1b222b454054112446faf8a9958c63ca953bc6dbf007c7d94faaa423cfe47b404f796589bc8d5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472932, "uuid": "b63b830b-2ad2-4601-891f-0ce1ca763121", "value": "T14524CF2236D1C072E2A646398D64DAB46BBBBC75193547CB3FC81A6D8F356D29E30343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472932, "uuid": "2165638f-50f2-4590-904f-13d95329600d", "value": "f07757163332cdbf737bafdb4614222c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472932, "uuid": "5fbfb16d-683b-45bb-9608-adff68da79a9", "value": "3072:zsdMOtFjpf/2LeQN1XRFb8T9wgoVLX7WdWQ9j6hl0Kqu0O00000003wZi1rv1FO:zMPmLeQN1Tu9wgarNJhl0Kqu09Oi1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665472932, "uuid": "3273b06b-7123-4b08-905a-23e7b580403a", "value": 216576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665472932, "uuid": "58c6b825-b826-41d8-ba02-af6a7304b68c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472932, "uuid": "33d6a0f2-f0f4-4525-9fda-b741a349a5e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bac111b-498e-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665511102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665511102, "uuid": "88fe6b4c-6d60-4939-baf3-fae8974f5981", "comment": "Malware payload", "value": "4b339eb118816e733caf47a6befcf140", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665511102, "uuid": "e717838c-f303-430a-8198-39b38d79aa51", "comment": "Malware payload", "value": "ef8045c907bcc370d65ce8aebf95c234c584d9250b881a99a3a4060872ef25ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665511102, "uuid": "c33a9c6e-2bec-4d04-90f8-28293c67f5a8", "comment": "Malware payload", "value": "2636f96f76c774343ee3246e1dca1c11153a210d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665511102, "uuid": "e85b54f8-396e-4581-bb0a-c9d42187e1e2", "comment": "Malware payload", "value": "e0c01e9582628cf387f95c591910f1addf79c974e964558b9f496c92adf31adb9483d3ad1cf4b67d20faffaba3fdd434", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665511102, "uuid": "20b42a9f-4567-496d-9c15-a410da6bf6ae", "value": "T17B02091563D4D337C9AB4BBB1CB253800338B346AE97D75E2C88480F9EE37E44E52A65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665511102, "uuid": "91b83b0a-005b-4d87-a4fd-579da043e868", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665511102, "uuid": "5e6eab77-a0c2-4af6-ad99-ac5c704cd816", "value": "96:mdG+uXMMgmYbgG/h8D7VnDr+mAtTX55k/44+gw/KZCLWKhuF6sdPM0q904zNt:D+PN2PVDNAJU+x/K8WsIz5M0qaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665511102, "uuid": "95618765-04e9-4b3c-b776-1b1621b555a2", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665511102, "uuid": "ea3d7289-9c12-492d-97b4-d02502e231c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665511102, "uuid": "d132b563-acb0-476e-bd45-9d74f3b6fa7e", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.23367.1173.21311", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b53ac0b-496b-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1665496015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665496015, "uuid": "af98b23a-d2f9-44d1-902a-d4353fa8b105", "comment": "Malware payload (AgentTesla)", "value": "b8a2c007fc250a5d9e896a8989c492cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665496015, "uuid": "89834f50-6232-427a-be47-a20323b588c0", "comment": "Malware payload (AgentTesla)", "value": "f0103cba208d065102351c9bd754e0b0a90dee3a9e99bdf5a35f940326f9eb56", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665496015, "uuid": "ae67dde9-c286-487c-82bf-9203ef9c63cd", "comment": "Malware payload (AgentTesla)", "value": "28934a712c07373f9951abe385cc457ab9ae264a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665496015, "uuid": "179e90c2-751e-4886-92e7-9ca1b816db6f", "comment": "Malware payload (AgentTesla)", "value": "c788a578d1b56cbf4d10f2e2b2a5383661ad7b6a287358172bab45897877bf964b36e922a3659b8bd22b60ad784c2462", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665496015, "uuid": "52b81460-ba5c-4e79-a763-b88294886964", "value": "T13B75A0343EFA501AF1B3EFBA9AE47596DA6FF6633703945E109003860A23A41DDD153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665496015, "uuid": "29d983ba-baec-4518-9e35-73f8aae5dbe5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665496015, "uuid": "e88c898d-0a83-4344-8c6e-84f3bfa90efa", "value": "24576:qca20pBXoxOP/J3MHLJS/8PWGC5IAxO6dR4DZxC0K:opBXoxOP/OOKAYDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665496015, "uuid": "633cd159-5937-4656-a5c5-53729161dc3d", "value": 1593344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665496015, "uuid": "107d9278-fa7c-4b2d-92b6-f64c735f9dbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665496015, "uuid": "11bbe72b-d611-4292-9f92-6359b43ff7c0", "value": "SecuriteInfo.com.MSIL.Agent.BEU.tr.dldr.7374.3830", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4651bdaa-4971-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665498637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498637, "uuid": "07462583-2757-4f2c-82ef-39dc969443eb", "comment": "Malware payload", "value": "7afe74cd0cc570a86ce6aa53b3065c35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498637, "uuid": "cba0cafb-d789-47dc-acc8-0e9e73d7d653", "comment": "Malware payload", "value": "f0686d5e9190e9e4acba9b7a4960e91162d397c928cbf8d936797fa709bccb51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498637, "uuid": "26edfe06-8d54-4c67-af5c-3f2f08882a99", "comment": "Malware payload", "value": "1b53b70e0a6331c0c731cf0e66dd85d42f897468", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498637, "uuid": "b6d349a9-b7d2-4470-b0d5-7900875b1737", "comment": "Malware payload", "value": "0b8345d1539ba105cdfec603e70508d193c7d8698986f73189c108730b8b397ab6f20a98b32391d55856003212c69645", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498637, "uuid": "fa321adc-4c96-4315-899e-f6ff4423ffe0", "value": "T1A2943954E6489ED6E302B23CE1F8FB2D16048FB6712EAB08D571B94578327CF2466D8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498637, "uuid": "bdf2c678-90d8-479d-9080-64d40dad2c44", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498637, "uuid": "56460d9d-b344-403b-b26f-262f2a4400d6", "value": "6144:hNeZcTKu1gRtv6cWGdZ3eya1NmmUC/gK0Rdu:hNqv6cxdZuyQmmxoK0Rdu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665498637, "uuid": "b4d42f8f-2d14-41a8-97cc-3f8f3db8296f", "value": 420498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665498637, "uuid": "5490518b-f37d-4215-8bea-73c5ec0c96c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498637, "uuid": "eadaa537-b078-4b4c-80d3-d3d0508c2abd", "value": "tt copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef6598ff-4933-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665472292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472292, "uuid": "5d76262e-e714-48d9-bf53-dad29f3f5f8a", "comment": "Malware payload", "value": "b9e3932cb7863fee5a3e3cd42a7ea235", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake outbyte drive rupdater", "colour": "#AD1756", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472292, "uuid": "8e0d3741-b181-4957-a938-9918420ea0d8", "comment": "Malware payload", "value": "f08f4ef5a25eb5b4cda69a00e368c26177fef73e69f3ae34e291b61784a16f82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake outbyte drive rupdater", "colour": "#AD1756", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472292, "uuid": "6f8c7d87-075f-44b7-94f6-9ae093cb7d85", "comment": "Malware payload", "value": "a786afa1ae97fbfc1249a5993c5bbcb4922a745a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake outbyte drive rupdater", "colour": "#AD1756", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665472292, "uuid": "d75dac1e-d88c-4218-bcb7-96c7da946e2b", "comment": "Malware payload", "value": "68dcd045b303826bf6cc0e3a2430baf84ae78e0bc0a3c213ba01df4dff25b0f874c8bc9cfbcbfc8cc397b292febfa516", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake outbyte drive rupdater", "colour": "#AD1756", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472292, "uuid": "a27a21b5-b0b7-4a93-96e9-352ac2285be9", "value": "T18E37331275EF503BC725C5348CA4FAA4592E7E2DCF3B640A2DD13F8D893AB4136A416B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472292, "uuid": "df974a81-27b6-4609-8ee5-bfce2828fd09", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472292, "uuid": "6fc9fecf-6278-4039-a079-cf4d71ff464b", "value": "393216:7ziKogZOl2yE+3Umjnl6WfcER2bXZ0GB/0DNsKWSUHdktemK3EW+svFkon:vpZf+hjMEM2GZ0BgSIkcdU1YkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665472292, "uuid": "2ff0e1ae-5827-43cb-8026-941143b7ac82", "value": 23476736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665472292, "uuid": "ed97c18d-31ca-4ca0-9d6d-32ec8aaa919d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665472292, "uuid": "cbb33bc0-31da-4bc1-810d-f9460a845436", "value": "f08f4ef5a25eb5b4cda69a00e368c26177fef73e69f3ae34e291b61784a16f82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9664a0f-498e-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665511313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665511313, "uuid": "5d36e564-a941-42fb-a82e-1b8583f73fc3", "comment": "Malware payload", "value": "97d58537589e3a7dc3acf4122eb5da32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665511313, "uuid": "f856e013-80d4-42fe-b711-36c796187356", "comment": "Malware payload", "value": "f11571cfbdb3a9e3bec31b8d95c61345a9f5db1e01b176db6b5acf01bd2bf7f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665511313, "uuid": "304cf1a8-b30a-4093-90bf-981286950f8e", "comment": "Malware payload", "value": "a9cf2f95373f375c93fda6efd6be4e7a9f51f5bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665511313, "uuid": "f4db0283-94e9-4742-ae8d-810ddba2fa35", "comment": "Malware payload", "value": "0347cdac762c73983e2141527ff97d6d36cff5e7cc967c84134308506d52a7b9501e9a9d64cc38ae5be1c1e72e1c9e23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665511313, "uuid": "b14942b7-bc88-4908-aa48-20a6273826c8", "value": "T12924CF1231C0C4B2F16216388C29C6B56B7BFCB55A35968B7BD41B2D9F312D3AE28747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665511313, "uuid": "50b31777-52aa-4c0b-b77b-aa39b6a60cd7", "value": "47f3841b8380a704a9ff258e0444ec1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665511313, "uuid": "b8a00c0f-0b7f-4383-b200-3404132be22d", "value": "3072:QPIPq2ZEwvyeeL/i5nkFBt8WGzS5z8EnKH1b6bCXk373fO:QrmYL/iZCH8EEObCXk3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665511313, "uuid": "46c58cad-33f8-4b04-a4b9-66cf0be20784", "value": 220672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665511313, "uuid": "c123c33a-b430-4b1f-8e5b-e0a5d0324cf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665511313, "uuid": "76c1b6af-7c6b-4954-b1ba-90446588ae0e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822116a1-4940-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1665477692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477692, "uuid": "4100f4a3-b3b9-4c3c-9395-71b642d13404", "comment": "Malware payload (Loki)", "value": "f06a3b45a1878bbe457a48d80e1f0817", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477692, "uuid": "23d58f30-ab59-46c7-95f9-59c199b9b856", "comment": "Malware payload (Loki)", "value": "f12603844201a1752e06e544afb2987fd6b70c73cca5bf71a9b44326fe095c5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477692, "uuid": "9528034c-06ae-4354-adbd-0c2d20f9b741", "comment": "Malware payload (Loki)", "value": "a7bfe4a19303e662376675d28d88126e1e761c14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477692, "uuid": "965e12c3-1d35-47ee-be8d-8b10ad6ddeb3", "comment": "Malware payload (Loki)", "value": "7330f6825a241952e065a0185de86d0139851c77f8dc7cd2c39faeb6186635d165e281a1a307c60217c4a627486b25dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477692, "uuid": "e5ee64db-5796-4ca9-aae7-223759f039da", "value": "T12D157A7E16994607E8253274C883D2F32AFBAD606061D1CB5AD72F6FBC512BF950334A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477692, "uuid": "e84734f9-f478-4af1-8fe8-54366f19a59b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477692, "uuid": "8f1f4f1e-3874-4851-baf4-8fec5a32ca2a", "value": "12288:ROwO00wPGU3dJB4gklt84PtJFjxOm7Xq+na8PNpuAQSQy4AI:DlPGU3dJB4Jlt7PFNOm7p9PNQAtQy4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665477692, "uuid": "59342a5a-99a9-499a-8072-fe5b95778b54", "value": 923648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665477692, "uuid": "d9ea38e7-1f3d-4372-abb4-8f6b4678f079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477692, "uuid": "d3ae7dae-4cd2-4f51-ba17-5f9c02924c20", "value": "Maersk Line Shipment documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb377227-4992-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665513114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665513114, "uuid": "3e9c7406-cf83-47fb-9d80-a5ab11ee8529", "comment": "Malware payload", "value": "76fa3773e54388154a9d68a74d7dd707", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665513114, "uuid": "5bcb0b07-3773-41df-a15f-f320df841931", "comment": "Malware payload", "value": "f18ef26186bd312dde294f1ee2bd54ca349a679b22a4c1f1847f700d45c000a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665513114, "uuid": "d0acad0a-857f-4479-8695-c5f5f0881ae1", "comment": "Malware payload", "value": "99b3d72a040422069ee3812bbacdf31b926d3132", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665513114, "uuid": "bf8e9eb7-e355-46f0-a4bf-8cad65258129", "comment": "Malware payload", "value": "cfc10ccd717d96c4a4faa254c46af7118db5c2038f6ae6e5c11c5758c81012dd1fde4b18986f39bf70ee7ed896c88561", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665513114, "uuid": "d1116014-09bc-4fa9-9f09-eb15cf852ae8", "value": "T12A24DF1235C0C0B2E26216798C65F6B46BBBFC755934C6CBBB98576D8F312D29E21383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665513114, "uuid": "c185e67a-e2cc-4d13-9db9-c3ef56894d8e", "value": "47f3841b8380a704a9ff258e0444ec1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665513114, "uuid": "ca49d564-682a-45c0-a108-8197983acf20", "value": "3072:mgQP0+ZEaZ1LgBrDZt8HxOacknwXsAD6AXFd1g0i1OXGlDjO:moYbLg9DaQknUsYF/g3cXOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665513114, "uuid": "9e835101-b2d2-4d2d-95f2-f6aa1543672c", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665513114, "uuid": "879dcfef-1980-459a-8c13-ce3c7828ef98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665513114, "uuid": "7c0ab68e-6c9f-425a-99be-ffcbaf8c8f8f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6c1254-4983-11ed-9266-42010a9c0072", "comment": "Malware payload (njrat)", "timestamp": 1665506483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665506483, "uuid": "bb11301d-1d04-42cf-9af7-0e99457a5e78", "comment": "Malware payload (njrat)", "value": "eb980f00dcdda6aed043c60fd27dde3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665506483, "uuid": "b6dac298-b2d1-4c13-9669-a0413af3c2ef", "comment": "Malware payload (njrat)", "value": "f2a6022fd000a32e9574ae290687cdcf78812ed7209cdd64fff0f822b21d364f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665506483, "uuid": "02f8109e-0b86-4f69-8ee7-d677177c92d1", "comment": "Malware payload (njrat)", "value": "d37b6899d20ac11c4e1bf0f20313634099aa824b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665506483, "uuid": "e592f2cb-19ea-4236-989c-9e0dbc82dbde", "comment": "Malware payload (njrat)", "value": "49991be51e0555ed7cbf967dd5b0bede0972da3293d3a80e096b89ff044899a1962f0c02cbe2cfe881879d85e79c3f16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665506483, "uuid": "13b35378-414a-4d40-b3a9-07d575231d90", "value": "T1E313E74DB684E175D5FF8BF1F4A2B2850B71A02BA902930F99F114D94BB3EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665506483, "uuid": "fdd7776d-95c2-4083-b7d7-a6637f456d86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665506483, "uuid": "607d67f1-b065-4d3f-91ae-8526af1ed897", "value": "384:fZyo1Cj8syWbbfWqWzeEvMspEAflz8Iij+ZsNO3PlpJKkkjh/TzF7pWnDMgreT0I:hz04pW/fWBhMsD/uXQ/oa4+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665506483, "uuid": "59821a73-2f2e-4c34-a216-84c73bbed7f1", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665506483, "uuid": "45849ca8-10f6-44ac-86bd-83aad01c46b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665506483, "uuid": "fb370964-69fb-4822-b55b-e179098591c1", "value": "hacktool.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c6b863-4989-11ed-9266-42010a9c0072", "comment": "Malware payload (njrat)", "timestamp": 1665509159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665509159, "uuid": "8cd9d569-af7c-4f2e-8ac1-027840c3e9dd", "comment": "Malware payload (njrat)", "value": "1fff6eb8902f280727f55a21d0147414", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665509159, "uuid": "8b5e7f9c-c935-45b2-8f8b-8a7778586e2e", "comment": "Malware payload (njrat)", "value": "f40cd285034851b218acbd3301c43cb32b595d03205a65246315e4bf12aac94d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665509159, "uuid": "eea24517-97bd-4b50-bb74-7600a89e4b4b", "comment": "Malware payload (njrat)", "value": "9df4cd13bb26f811c34ebf05f328832432fe9979", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665509159, "uuid": "9df241c1-df74-4c27-9db5-f2b3703d968a", "comment": "Malware payload (njrat)", "value": "ed3c6f4159484f59b04a43f8bbb3c7ce631720ee3e069f3e2f558bbfca81ce696e4ea3fd6aa4d216832c51b4f494937d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665509159, "uuid": "eacb2b75-ed03-4002-8896-bbafd0091e29", "value": "T154235D4037D88136F2FD4BB4ACF2E64586B5D2676903C6596CC814EA2F23BC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665509159, "uuid": "2e727c6f-137f-4682-be4b-24dcdde015da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665509159, "uuid": "489dc872-e807-4329-856c-d06e6b3f7e43", "value": "768:jq+s3pUtDILNCCa+DiptelDSN+iV08Ybyge//BOdgFvEgK/JvZVc6KN:jq+AGtQOptKDs4zb1OJpFnkJvZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665509159, "uuid": "7bef8a4b-d925-4701-a6f0-b4d50c4b123c", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665509159, "uuid": "0a8e1fc5-1a78-4fad-8bba-3a327067144c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665509159, "uuid": "e2be61d9-7b6f-42da-815c-724771735ff5", "value": "1fff6eb8902f280727f55a21d0147414.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1688ad0a-4906-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665452601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665452601, "uuid": "f9bd210c-9ce8-49b5-a67b-7ab8e20084d4", "comment": "Malware payload", "value": "68bf6cbe5fb38c6192f601ace5586ae2", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665452601, "uuid": "11b2c1cf-c627-4cc8-b1b3-036a98d8b01c", "comment": "Malware payload", "value": "f45febc7acc35903202001eb1f66aee859c05dc983ef1aebd1ff510070d827e9", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665452601, "uuid": "36fcfea5-5786-44c9-b7ba-945141ee0b94", "comment": "Malware payload", "value": "cabc59d7f166ec38310eb96cd59329dc2f41848a", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665452601, "uuid": "c3deb96d-d26e-48e4-ad95-49af0d2429f0", "comment": "Malware payload", "value": "a48335216488aa6990d97933fa27be585df9b083ec1a15deb489f08a361d1605c9252c6aae697ad36ebbd4455dc451ed", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665452601, "uuid": "48a29d5d-7a7b-441d-a265-538f7c207133", "value": "T151915BB5235D2ED1D97E537C4A17BF0C1862B09396CB69C83ACEA347070B1AA2C16881", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665452601, "uuid": "807573e3-cf22-4a7e-a46f-ba30341df3bf", "value": "96:5kuzD0uBzzOPgXWezaDDfem//boRjuQ5U1+7Gx5tQCQvAfEmYLc1CkO:57vJWaMDmC/HCUwsNQvAsGCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665452601, "uuid": "ff353d26-530c-4742-abdf-3157358f4f5b", "value": 4527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665452601, "uuid": "718a1f5c-05eb-4ca5-8d01-7bc4ef100bcf", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665452601, "uuid": "6bb143aa-9769-4df9-9e82-e85f7c089b66", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.9605.26435", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "257bca29-4930-11ed-9266-42010a9c0072", "comment": "Malware payload (Babuk)", "timestamp": 1665470665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470665, "uuid": "fe05710d-3315-41ef-8df8-9f3ca8e10613", "comment": "Malware payload (Babuk)", "value": "79c0727cc8543dd4836fbadf0618cd03", "object_relation": "md5", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470665, "uuid": "11189443-a0a8-43f0-b73e-0331cd443018", "comment": "Malware payload (Babuk)", "value": "f4c2169dab08ca0aa12fe0e35a0424b6de1396b719a3eb34c3f7ce205a99dd46", "object_relation": "sha256", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470665, "uuid": "0bde9c08-cd18-462c-b0fb-8960d8ba02fc", "comment": "Malware payload (Babuk)", "value": "57e323815ef817cc4cdffe71a3a21788b1d5fa86", "object_relation": "sha1", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470665, "uuid": "9305879a-b8e8-4545-8d3d-97220957f9e4", "comment": "Malware payload (Babuk)", "value": "af1830ecd5a3ffebf750e1743c68213e4afc6b54e3f6b7f3cfb9d2d9c72dccd163acf0b27e6c0ff44d6f4f6ef22adfe9", "object_relation": "sha3-384", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470665, "uuid": "66d1b596-c2e1-4b06-8201-588b9c67dd2e", "value": "T1F2835B5872EA02F8D6B7C974997A1539EFB5F86887218BEF0581C0450EB3ED09E34B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470665, "uuid": "04e7bfc5-5e7f-4829-a1f5-e1f7afea9c34", "value": "2591142eb8050813fbeabfe0e77efe15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470665, "uuid": "19dc8c2a-70e4-4da7-a6c3-0de39c41f594", "value": "768:ldz3uDFgRp5xBZBgkKzEdtP4FlVtmtODLbJ0aELt8x3bnr77pN/7EZbdWLK0PHMq:HuDS9l5D4bvm8J0Ft8R3/4RdWW0PM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665470665, "uuid": "9d5bbbd5-3b1d-4f81-98f5-e33808c0e00b", "value": 87040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665470665, "uuid": "d346a923-4d47-4095-aaa0-32d1d00945fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470665, "uuid": "2f656e7f-6eed-4a2e-a8d1-05bdae46d28c", "value": "f4c2169dab08ca0aa12fe0e35a0424b6de1396b719a3eb34c3f7ce205a99dd46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94cc8cbd-4960-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1665491468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491468, "uuid": "d519f5dd-519c-42f9-bf95-0e2d18772c0f", "comment": "Malware payload (Smoke Loader)", "value": "f7f9dd5b620241c710163b391142e4b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491468, "uuid": "a5490b0e-7a1e-47ce-b4f1-3290514d12fe", "comment": "Malware payload (Smoke Loader)", "value": "f4fbc06c3470e09decdd7aaaf248188cab8400f70065c5d55becd8c804a57d82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491468, "uuid": "56a3b452-4f92-44f5-88c1-bcc6fe6d5b3b", "comment": "Malware payload (Smoke Loader)", "value": "c23be512e0d867de7b23236dff36eccfa961dd83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491468, "uuid": "d99e884c-16ad-40ff-8fe4-b9c87c5bad69", "comment": "Malware payload (Smoke Loader)", "value": "c4af3bafe6ccf7edb7e4f91b49e5f7d0ccfd9181f3c61a2c1731ffd05b8738f274d2d936221557b7b314f1651d25b4c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491468, "uuid": "79f3f9e2-ae38-488d-b5b9-e8f8ac7162cb", "value": "T10D24DF2237C0C472E26216748D69D7B49BBBBC710A355B4BBBC8476D4F352D2AE34346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491468, "uuid": "5f0e0b35-2fa3-4d14-b699-340b3810bc92", "value": "4db5fa00d6d53e828ab0bf90238303f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491468, "uuid": "1ecb75ac-4be9-443a-aca6-4df39233b567", "value": "3072:b5jk8fKbwV7tVLYORDt8QSv59h2AdoODFkF4bd7ii/2O:bm3gjLYORy5ddoODFkF4b7/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665491468, "uuid": "965885e9-d3f8-4081-ad3c-0eb1a5a3d244", "value": 215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665491468, "uuid": "d28b7376-af4f-4006-9a58-3709cfa69fc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491468, "uuid": "f4424b28-6abc-4798-83eb-9ab030051f40", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7f04a07-491c-11ed-9266-42010a9c0072", "comment": "Malware payload (Dharma)", "timestamp": 1665462401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665462401, "uuid": "7ed0bc78-806a-47c5-be22-9985e176210e", "comment": "Malware payload (Dharma)", "value": "c8436825a0549e82d500d7b5751c271f", "object_relation": "md5", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665462401, "uuid": "09917619-b088-49a8-a049-e211e327f4e5", "comment": "Malware payload (Dharma)", "value": "f608858af270c6b6956146e6c3ce0bc737916646e442784d5fb9c543c7ed09bc", "object_relation": "sha256", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665462401, "uuid": "0ee580e8-ea59-43cd-82c4-771f0ef87935", "comment": "Malware payload (Dharma)", "value": "5eee3cc7bba61c9ecf2bfc4c88a5f7370d378ea0", "object_relation": "sha1", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665462401, "uuid": "5c19e04c-dd8b-4d32-ad15-f8696ab6f95f", "comment": "Malware payload (Dharma)", "value": "7c60b06ff73e2a56a3bc48aae80cf9d30688453950529c11a903f456f5b21fd5128c269988c95aee8158d7facb91788e", "object_relation": "sha3-384", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665462401, "uuid": "e33ed6a6-c357-4bf8-8f85-fef80a774fc8", "value": "T1B4938D2AD921D035F8A250FFCBF756FD6D684B10130794DB93C01E89AB868E6F932527", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665462401, "uuid": "cb5a9823-f6bd-4842-99eb-7e75cf1fde00", "value": "f86dec4a80961955a89e7ed62046cc0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665462401, "uuid": "97185d9c-c730-4acc-9d6f-22576a09b53f", "value": "1536:mBwl+KXpsqN5vlwWYyhY9S4A/aFTOGpHaiGmGVeHuMBZR4JVY/Op5zC07K/:Qw+asqN5aW/hLrGp6iG76uMduwO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665462401, "uuid": "7664a8a0-80e9-4fad-805b-64f67173ef32", "value": 94720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665462401, "uuid": "78bfa43b-4b9d-4712-9c9a-7d3356967ac8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665462401, "uuid": "b376bdda-2029-4e31-8f99-bc6e651767fc", "value": "f608858af270c6b6956146e6c3ce0bc737916646e442784d5fb9c543c7ed09bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e425c2-493f-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665477189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477189, "uuid": "bc975845-4e67-478e-b26a-fe568a1f26a6", "comment": "Malware payload (SnakeKeylogger)", "value": "8839a77c95f197e49fe597ec2c7a9a1a", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477189, "uuid": "32ce2c74-61e8-4f07-a67f-93c4225b3ad2", "comment": "Malware payload (SnakeKeylogger)", "value": "f651178320d69e016c1eb02a2eb0fdb52dda982699c36294f579fe64d2858f85", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477189, "uuid": "396bb93a-837d-4c90-b0b9-c84ea8ddef7e", "comment": "Malware payload (SnakeKeylogger)", "value": "9d348badf8dc224383c6c7201c0be4925192cfd3", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477189, "uuid": "1caac153-5f95-40ae-9198-d66d6f73f74d", "comment": "Malware payload (SnakeKeylogger)", "value": "b57690b6ca4f42d8c038cb138d7dae6f2e0cb7188630a85af741b85d5198a83583b8f16234982fb904c2c99f202f6030", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477189, "uuid": "25901e03-5726-44a0-8cf3-83a0bb63298d", "value": "T199C3F10C314AAA49E1F3CF751C5BC2E1252BECE0174B0186D01EB69E1F76ABD34BAB55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477189, "uuid": "53c0bc70-b481-488f-bbd5-9c88c2da37bd", "value": "3072:Djd5bsKSHyRDyK/Vc0bME/BmWGJYpB7suU31/MaAG:uyRDyQfT/MDgB7kt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665477189, "uuid": "71325ed0-9784-4f27-8c06-da648b7eae8d", "value": 119432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665477189, "uuid": "ebb6f666-8804-4faf-a38d-2074efc880f5", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477189, "uuid": "744decac-66de-487d-b76b-a1a6864b016a", "value": "New products enquiry MAC3162.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d6e0ad-4953-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1665485854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665485854, "uuid": "58187a31-b332-4f04-86cb-191838005dc2", "comment": "Malware payload (RedLineStealer)", "value": "7e765645533ea28e5d8303313c62c587", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665485854, "uuid": "39f9e8b2-70f3-4750-b87f-fd1e964595e5", "comment": "Malware payload (RedLineStealer)", "value": "f6d0c72f077437277cc213f1ddb5ceb3c38d66bc66f0b698c455f27a578fb225", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665485854, "uuid": "56b0a635-df37-4a4b-ba46-c5a23ce93d13", "comment": "Malware payload (RedLineStealer)", "value": "40c718ea61afc51287e90f080e7e182723e32046", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665485854, "uuid": "c3c8f6ab-18d0-4cb8-8559-43587e0fd859", "comment": "Malware payload (RedLineStealer)", "value": "efab8b06cfb69ce92b0ab473c296470d4c918c2c0f8e8034095ed27d5307076bb215d37db6fa7c62a1b4f3f311317618", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665485854, "uuid": "bdc4fdbb-3153-4b9e-bc71-9d4b9e9ce446", "value": "T15124CF2239C1C472E26216788C25DAB5ABBFBC75093956CB7FC8466C8F312D29E35347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665485854, "uuid": "62d0cf8b-9e2c-4f29-b1f3-d5e74e3fc516", "value": "59de72f24710a4ab3ca7e4fa2f0a3bf4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665485854, "uuid": "c55e4dd0-40fc-4600-8359-06a6e9064f68", "value": "3072:/Xz8n2eBWAg/oEJLcfEGwMOfu4ALOUz5sF87mEqPQxjwXO:/gnWK6LcfEDQOUlb7mjujwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665485854, "uuid": "a52b89f8-d104-4351-97ef-f5171a9c32ef", "value": 215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665485854, "uuid": "aa24f5fb-3cd7-4dd0-ab84-d0863f72b6b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665485854, "uuid": "029d0651-8f3d-45d6-9698-a455605917f7", "value": "7e765645533ea28e5d8303313c62c587.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "116de29a-492f-11ed-9266-42010a9c0072", "comment": "Malware payload (Vjw0rm)", "timestamp": 1665470202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470202, "uuid": "a31d1269-cf22-4cd9-9fea-a171361bd928", "comment": "Malware payload (Vjw0rm)", "value": "7d3f2b3f96d0665cfd4877cc0ee04241", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470202, "uuid": "8c65cfb2-88cf-4b6b-9f3e-65d0655db60e", "comment": "Malware payload (Vjw0rm)", "value": "f8204298f646a3d0bb80c2af4031b9c1248011f9de7a1ec6753e6baedc031ce3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470202, "uuid": "69b3a255-f244-4f09-9a4c-4ebdb1fd8aec", "comment": "Malware payload (Vjw0rm)", "value": "ce3c86bb1c3fb217efe5affec9cb2b77c771d29e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470202, "uuid": "ce1b8255-de49-4ad1-9a92-e905febef037", "comment": "Malware payload (Vjw0rm)", "value": "1c90ae0c2206980561945cdbcdb10cbd78168e09c4107544ce0ee63177d20f74a06e88d222c9e327be2a96b09e3480bb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470202, "uuid": "173e2108-78ef-4810-bdf4-0e5f4aa94ca8", "value": "T1C7037D95EA375F21AF482B4616F8ED186FFD3C4E59F25DEE3704424C91A10AEA0DC1AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470202, "uuid": "dfe67ebe-1b81-4710-840a-12d30f7be730", "value": "768:16RAyXZRVfMfF7clqduqcjxiEjCaERqjW0SaU1X:1cXHVuul+EjxiEjCCW0Sac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665470202, "uuid": "b654bfef-c81c-485e-a77a-92221fb7ce30", "value": 38563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665470202, "uuid": "f14af349-aad5-4560-8ff6-a19f3d08d689", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470202, "uuid": "6bb0ed03-5cee-4a96-baed-217b4caa282d", "value": "RFQ 10926-10-11.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed4f871e-493d-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1665476584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476584, "uuid": "cd0e2f82-9c6e-41ce-9242-0511b357d3ad", "comment": "Malware payload (Formbook)", "value": "bd80accc4a1535d881c3b33d187f1eb5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476584, "uuid": "949397c6-a8c4-4231-9d14-44687365602a", "comment": "Malware payload (Formbook)", "value": "f94a50338954420bb77446d6962361193e5cfde7264e4554a64fc38444fc029c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476584, "uuid": "27da6aa1-22e8-48dc-8474-3cb5d30bb656", "comment": "Malware payload (Formbook)", "value": "e68efac7e694a36e6effa9d4ff5450a9c4b23c90", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665476584, "uuid": "f9308873-a6a0-443c-9a9e-58d41324b7fa", "comment": "Malware payload (Formbook)", "value": "397f4acd79708a34734deb2d36d1f2fa57b67e078c3e411c9fddf5ac3e36771d4f005e487bd3862e46a99357e680db59", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476584, "uuid": "0bddfd1a-1aa1-49cb-9daa-e8e67e494f3e", "value": "T112353021B2777DC7532602B1828F9D46A3287E47B35A1E94E01EEEF82DE4475A341F4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476584, "uuid": "35925aeb-d52b-4f52-a62e-cb702ae1ce10", "value": "1536:bJ/pGEch6dtRGWbCtpl5kmrJ//RFxXxBpzB9TBtiBqK8Qf6YXkY0kY0kY92i3e+z:FHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665476584, "uuid": "9766e85d-4d08-450b-8fba-95a6f77890b5", "value": 1112544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665476584, "uuid": "c96f58ca-2a7c-4dd2-8d80-db3c64d67af0", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665476584, "uuid": "d8298242-2121-4ff0-8e18-c977cbc32fc8", "value": "Stocklist.doc__.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a64e0a3-4983-11ed-9266-42010a9c0072", "comment": "Malware payload (njrat)", "timestamp": 1665506509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665506509, "uuid": "9be467d4-89e2-486e-ac9c-d0164562083e", "comment": "Malware payload (njrat)", "value": "fe96410454e44a2d067ef10244671c4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665506509, "uuid": "26be4611-0abd-413a-bff3-a521d08d16ce", "comment": "Malware payload (njrat)", "value": "f9b69a9c45499a4d0d27653b60023b93e95d9d3163844193091c98a2fe4076ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665506509, "uuid": "738a6734-bade-4d48-a6bf-75c2f933955d", "comment": "Malware payload (njrat)", "value": "5ab9c2149edd09789ea9e2e95405e718e6558950", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665506509, "uuid": "2d1e4c5f-7077-4a25-bede-0765c26a2a04", "comment": "Malware payload (njrat)", "value": "d9798e4220b0cb212de23f53213fb4629ea06fc61f07ada6217ffe9b322ec1fde0df77dfbe3d993132d230be6f0ddcf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665506509, "uuid": "0286926a-2615-4368-ac94-39359bb3b8a2", "value": "T1BF033A4D7FE18168C5FD057B06B2D41207BBE04B6E23DA1E8FE564AA37636C18B50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665506509, "uuid": "0931638c-4971-4004-a5bf-1e69c1a352d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665506509, "uuid": "8715a6a5-3715-40b7-ba32-69bae230b2b0", "value": "384:aAM6ik1RxdDsyNyysz16ZP5082+b8rAF+rMRTyN/0L+EcoinblneHQM3epzXhlND:RFeyNBsz16ZSF+4rM+rMRa8NupLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665506509, "uuid": "440be2de-f58c-46cf-ac22-adeb91d7f992", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665506509, "uuid": "08f5d6c6-2f16-4c22-8641-8d066e6b5bc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665506509, "uuid": "32042e3e-cd93-4a83-8297-537435ecae5e", "value": "Server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f709cbb4-492e-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665470158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470158, "uuid": "44a1671e-c225-43db-a26d-c4a5e81ba790", "comment": "Malware payload (SnakeKeylogger)", "value": "60814d825b6d33f8dae28530ed66dd4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470158, "uuid": "3368f787-674d-4cc3-b6b2-2ca20f5edb38", "comment": "Malware payload (SnakeKeylogger)", "value": "f9c997cdd5a607373967acf37e275d11081b7c9b95cd2b0b7def35b015433a8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470158, "uuid": "3db790e9-c66c-4cd4-a7d7-efc27e1bb9d9", "comment": "Malware payload (SnakeKeylogger)", "value": "acb2ebe2000140106504a14fdcdde9d6b57e9bc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470158, "uuid": "87fe207d-cac8-4230-8a49-ae060379e7b9", "comment": "Malware payload (SnakeKeylogger)", "value": "689a96d8b339ce24b89658efa4735bef2e84dd12a1baa27d9b06a250340c3401c82d639d2a2256ea92afb65a015e3775", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470158, "uuid": "43428216-ca5b-4d42-83cd-abecd5d7d219", "value": "T1F91526B622858907EA553171CC93D1F32BFB6E686272D1DB7AD72F1FBC410BB9102246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470158, "uuid": "9466d087-2b02-437a-81be-b81c7db9df83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470158, "uuid": "083a56aa-89af-4802-87ed-1ab34179a94e", "value": "12288:ORuJ2u/PiJljhE/MX7Su5uBN44nHIdf2h/dWIfKAzu:i3kqJlVEkX7444HIdf2h1WIfKAy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665470158, "uuid": "97f02bd4-fcfd-4e36-92cf-b1fd7633d951", "value": 892928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665470158, "uuid": "469f7073-87d3-4740-a7a0-3f370aae2b7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470158, "uuid": "22298683-7e09-474b-b7c6-349c8163717d", "value": "60814d825b6d33f8dae28530ed66dd4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "265ec558-496a-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1665495577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665495577, "uuid": "470b4dde-3d76-4ab5-b0e5-69b815e2854d", "comment": "Malware payload (RedLineStealer)", "value": "49d1a9e7af044c5160d0f1ebf1e45e59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665495577, "uuid": "003cc659-aa60-48e1-98bb-21b53972ac83", "comment": "Malware payload (RedLineStealer)", "value": "fa52c4181d1b448cbe897b282fad093c7d51434843c5291148032c4509e9cb6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665495577, "uuid": "15d323a9-e5b5-4d9f-a8a4-4ab8ea14446b", "comment": "Malware payload (RedLineStealer)", "value": "ae5cc8d49ec35a920478e547ef3cd184fe75335d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665495577, "uuid": "fab1eb5f-6b33-4360-a6f7-2a67d55e4b0d", "comment": "Malware payload (RedLineStealer)", "value": "9d6f1c5c9fb7592f6dbd92a03b9c18760399ee1fa6ff33402a142a3b4f08f03a2b286877d367565079818aa64da1383d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665495577, "uuid": "11a8d79c-20a6-49b0-9f30-49a72fa90b21", "value": "T14E2612C2B64199A3F49D0936C97BD6134A7154643A46A20B7F88736D5F72B83F2338B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665495577, "uuid": "2c7c69e8-cc81-4518-96a6-7e33a67ce103", "value": "a5b8e93122432e666455249c6633c54f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665495577, "uuid": "cb3ddae1-e932-4cc1-aa96-52456be41b43", "value": "98304:FBNexh1qyvDcNILejJ1P64TgEj625gR5BdYLTKd55A:Fbg1ZbkRLPTgEj63vu3Kd5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665495577, "uuid": "a144b7a7-5f04-4313-a9db-755ec8043a08", "value": 4700672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665495577, "uuid": "6d70b27f-4b4f-41a5-a00f-34e8fe1b73da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665495577, "uuid": "286c8c94-ff42-4102-92b9-7e0c9bbc7a90", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9660140-4940-11ed-9266-42010a9c0072", "comment": "Malware payload (GuLoader)", "timestamp": 1665477812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477812, "uuid": "5322aad4-d0e9-4fcd-a3da-3303438ecea5", "comment": "Malware payload (GuLoader)", "value": "192b1493ac081fc10e4a3e1521580a7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477812, "uuid": "4ac2530c-f42e-48eb-a32e-a3b922b46ea4", "comment": "Malware payload (GuLoader)", "value": "fa94e96f93f687fd041837790e07adc70c65881c79b343d2be6ee759a8d4c835", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477812, "uuid": "1ae58590-eb3c-441b-bcb4-d2454c367963", "comment": "Malware payload (GuLoader)", "value": "4fde0a261f7f21bedfee1d82ae4e0036b57fd6d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665477812, "uuid": "27bb1797-ffce-4bbf-b89f-8eab934c8241", "comment": "Malware payload (GuLoader)", "value": "1abd3dfe1cf29d13339a2cbdac3f18bc20984d85a823661e92f294b0d84ad871d058682fb848fe1e63d2b93702bb7ab0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477812, "uuid": "58626411-4ac1-44cf-9944-0ae60b233772", "value": "T1E2E301021170C9B7E67513700C76667AF7AA9661146A1B877FF01F2A3E23FC2462F25B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477812, "uuid": "7f1bad8c-fd1d-4519-9ed8-9e052be67386", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477812, "uuid": "2fba929e-4419-4cd7-9274-91d40eb645ab", "value": "3072:nkBGWOsTIJgIDU5A/cmubjjdMlxvXc0BAhjHYl2yZv/FAL/a/d/GYcH9d:n1ssjQfdMjQHqJ/FG/uwD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665477812, "uuid": "28aca665-5bbc-4342-90d6-4c301aaf210c", "value": 143248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665477812, "uuid": "31f90b0b-0b4e-4e35-a058-49bfc7fc2ec8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665477812, "uuid": "96bbc559-b092-4583-90bd-0186d74e2986", "value": "Dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5403ba98-492e-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1665469884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469884, "uuid": "02543870-ac29-40e5-a0db-ea6ec5f259b8", "comment": "Malware payload (Smoke Loader)", "value": "97705bc48c02ea1e0a664ad47d4b049f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469884, "uuid": "51e3f459-c168-48ae-a1d1-4d9754bb5337", "comment": "Malware payload (Smoke Loader)", "value": "fb3c76d86e446ba0495977ad2b7cca7d4f42f13443bc46cc06c667223538704b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469884, "uuid": "24af8ea9-9b58-4d66-9347-1b4da0ae7f63", "comment": "Malware payload (Smoke Loader)", "value": "fdd70d4f201ee32bcea815dda4986027245e7722", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665469884, "uuid": "5db861fa-3e41-4259-888b-0a26f5a4cf0b", "comment": "Malware payload (Smoke Loader)", "value": "02292e3bb7e2d194ab41e9c6bab7c0a3df86f2a25087776a8ca4a40ebf26c59e7dab61444f5bd750ed98446dd4aaa195", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469884, "uuid": "d482b825-183e-4577-8134-2dbd8ec3eafc", "value": "T1B124CF2232C0C072E26256788C64CAB56FBBBA7419764B8B7BC8466D4F353D3DE30746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469884, "uuid": "421ea56a-4e71-4d74-8f84-54e6cf5be723", "value": "f07757163332cdbf737bafdb4614222c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469884, "uuid": "24149df3-d480-4f36-b97b-b288212f6015", "value": "3072:LZmK3OzzjXOuLZCDMRFNixEyAbfVJ50G/cVK4r1m2u5pkmk1O:L2PTLZCDQinAc3r1k5aV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665469884, "uuid": "189f6461-bd0f-497e-bae6-2adf24f4a69e", "value": 215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665469884, "uuid": "87d9ea03-0d7c-411b-8231-2fd77ac34531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665469884, "uuid": "6e8d862f-6d0a-4b2b-94d8-5c475b45665a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f62038e1-49ad-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665524702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524702, "uuid": "4b238a61-c004-4e84-9765-97c233e22a80", "comment": "Malware payload", "value": "f8b0674f5e9ef59e432a9805b703d54c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524702, "uuid": "b631e6db-75ca-494e-abb5-05f68bd9b44f", "comment": "Malware payload", "value": "fbeaee5decb51afa0e75f95c413d4bc7350475a795162035b6338f7ea6cf1bd3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524702, "uuid": "e538f615-658b-49da-926e-2f3795d1fbe4", "comment": "Malware payload", "value": "6230d481ab71bb8624502569e4403c4cb90d34fe", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665524702, "uuid": "905b41d1-625c-4a18-aa86-3a888cebe6db", "comment": "Malware payload", "value": "42debed2994313c071688a569d708e50732dc1eb3932d4016ad145e749d2672796d5d30f8531f266151a7888908aebfe", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524702, "uuid": "a85afe40-6e8e-4e40-ab58-799e56aa4c53", "value": "T1C686C04277D1C076C0AF03350876E34A6272F9668F2283E77690AB6E6D76BC04D72776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524702, "uuid": "1ec54a88-26eb-4ea3-8029-a70834bde544", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524702, "uuid": "db131587-a1b5-41f5-b49a-e28f537dff06", "value": "98304:CLu1g9ZGlWrfTZmHqXE9ssD/QjI+1ozfLu1TIRtUOV5ZHZ:Cd9JTZksaJ+1orTRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665524702, "uuid": "bdb02723-6b83-40e5-af92-f2467023430f", "value": 8345408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665524702, "uuid": "5d1187bd-b7fc-47b3-b4f0-7fb657d4e8ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665524702, "uuid": "044f84f0-6c9b-4ce8-bb17-8dffe4f38522", "value": "fbeaee5decb51afa0e75f95c413d4bc7350475a795162035b6338f7ea6cf1bd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b532613-493c-11ed-9266-42010a9c0072", "comment": "Malware payload (NominatusStorm)", "timestamp": 1665475802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475802, "uuid": "ff0af552-d9cc-41cd-9d87-8a1163699187", "comment": "Malware payload (NominatusStorm)", "value": "5b390e8e7fbfbc9450b75fe51918364b", "object_relation": "md5", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475802, "uuid": "921ebe8a-1213-4874-a011-d88bd9822087", "comment": "Malware payload (NominatusStorm)", "value": "fc4d5763acf79900b63d359479337704e51c6f374dadc846754628a297053eff", "object_relation": "sha256", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475802, "uuid": "b1ef659f-97d2-42f0-901f-ac325eee2da7", "comment": "Malware payload (NominatusStorm)", "value": "25a154c4da3d1fbb045812708a49e4696663f6dd", "object_relation": "sha1", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665475802, "uuid": "cf1a1469-2b3e-4c20-8f66-1e57dd6cb2b6", "comment": "Malware payload (NominatusStorm)", "value": "8fc02a91bb7bb008c6136d795444e3c338bbf9c95656bfd74c09372f8e4332ab0068c046d34c8bd4408cce8f99ad1d4a", "object_relation": "sha3-384", "Tag": [ { "name": "NominatusStorm", "colour": "#69B657", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475802, "uuid": "e680e7bc-8197-4bb8-94f3-6e36c83647f8", "value": "T1837607B9C3ABCD29F0BF4274542662153A61F6A5BC33C32E330EB19DA81DD046D91B76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475802, "uuid": "7e3da258-8bbe-4236-87da-09bcebcfe6c6", "value": "196608:V5P5a/ibI83Vh4RKE44cgzpq7l5P5a/ibI83Vh4RKE44cgz:V5P5a/O3Vh4RKE44vpq7l5P5a/O3Vh4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665475802, "uuid": "4ea6c1c5-1ae0-46b1-bce9-a0c1bc308368", "value": 7381252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665475802, "uuid": "308d9394-c87e-4845-8292-40d98b1fdd70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665475802, "uuid": "e4190d32-6435-4c30-9872-1d095fe5b45f", "value": "fc4d5763acf79900b63d359479337704e51c6f374dadc846754628a297053eff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d543651-498e-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665511104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665511104, "uuid": "ea07d12a-c86e-42ed-9134-5ac9ccaea34a", "comment": "Malware payload", "value": "8ed99ef35ae3ed866938ff23441aab63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665511104, "uuid": "2e4cf99e-a108-4487-9bb5-cc7fcab50856", "comment": "Malware payload", "value": "fd41e3ff64a825e47231b96bd360937ae94bb7cfdb5843f85c3ec3d7e54a5478", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665511104, "uuid": "8e72c51e-616f-4a40-a5b5-dc1a0f8ef9f1", "comment": "Malware payload", "value": "b06c2020f6adaa680646440b3a912e234c08714f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665511104, "uuid": "041ba5fc-cefe-4f78-a4a0-9dbac79ca917", "comment": "Malware payload", "value": "18e0bbffa21672596212eb59344a46945b20afe4683b9a7d7e45940505f032e2660d5e76ebff0f6fa5e6d75eab46a12f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665511104, "uuid": "13d28f2c-107d-4a74-9b68-5da892c8d821", "value": "T1DBC39E5131C2813FD875A971986489A0DAAFFE202D598FEB734C213E8E386D15737D2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665511104, "uuid": "d4d82fa0-0b5a-467b-947f-9b5dff14c769", "value": "1d292d522a05378114ae10cb366a0b23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665511104, "uuid": "c17e0d2b-94b3-4d48-9cd5-207cba7fbf77", "value": "3072:EfWQ6ESTPnrf+KiNuno8hQ3ImmeIMVT1olKH9:CWhE5lNvr3IeWKH9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665511104, "uuid": "9d7753e9-00ec-43af-a36a-2c86318aca35", "value": 128000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665511104, "uuid": "10e732e8-5283-42ed-b4e0-66c4f5d72001", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665511104, "uuid": "746bdbda-077e-4eaa-a01d-d56fa8c61bf2", "value": "SecuriteInfo.com.Variant.Lazy.253573.8352.21605", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f07c5d3-4908-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665453689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665453689, "uuid": "e17a762e-2273-46a6-bc6f-f353790f4ef3", "comment": "Malware payload", "value": "d161950591b064c404d43e303bd8510c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665453689, "uuid": "0aa8a40e-f713-490b-8c1e-4a361be21992", "comment": "Malware payload", "value": "fdcf9c5c16d3849ef01ca31466bcff6ae38309cc61a3a56c7eec96d4d4773342", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665453689, "uuid": "ff850087-d6f4-4169-9da5-61c1dd81576b", "comment": "Malware payload", "value": "c63c12c8352e322045da77576110f83c70e549e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665453689, "uuid": "44bb6a49-fc20-4f39-850e-c6686e26e917", "comment": "Malware payload", "value": "efecca07684a80dcbc732ecc65de5fad05f82ef3967d8098d9ea5545387cff5011a712ff86e2ce8e9936cf7738c687b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665453689, "uuid": "c56d3ec7-78b1-43a4-ac51-4f6a6406b8b2", "value": "T16A7633223ED0C9B0D60044B4CAD80BFBA47DA1581E298E375B79E14E7DFC5AD982935F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665453689, "uuid": "3e4f557e-af2a-432b-bfb5-ae764deb0c58", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665453689, "uuid": "7d93f2a0-509f-4bf2-b29b-227280bd3e80", "value": "196608:91O5sC3iZZo1nFlQuslFR4/gxAxNDFguO4S1kptzWTbsZNf:3O5sCSZS1nFlBshPAx9FO4b3zWTb6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665453689, "uuid": "795ecefa-db87-4ef3-afb5-d4621e65732d", "value": 7636062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665453689, "uuid": "e587e082-b7ba-49e0-b63e-7829371f4d99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665453689, "uuid": "6885bded-99db-4679-9f0c-96f0ba327851", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd54dae8-495f-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1665491106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491106, "uuid": "8162cec4-88c6-4cb7-b736-2223075ab9cd", "comment": "Malware payload (RemcosRAT)", "value": "48b1bf14902e438d67745d75c4a04881", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491106, "uuid": "c4b39b4e-1b83-4789-bf63-c6e71cb2b26d", "comment": "Malware payload (RemcosRAT)", "value": "fe229b2214a40f85abb3eabf833097940574b26f5a8eb125bb2ec71946663938", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491106, "uuid": "826b0443-6b7b-4fa7-9cad-e3b05994912f", "comment": "Malware payload (RemcosRAT)", "value": "6f9bdb7f4c4efdc118c45e761f879bd751f959c1", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665491106, "uuid": "d22d3c35-840b-4b26-935c-578719e4e773", "comment": "Malware payload (RemcosRAT)", "value": "e6f8c276b06afb4157411abe283629ef7aa517cf3c38755b572f73245211aab9101856c9df5483bfb6d657f3893e44a4", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491106, "uuid": "adb2b5d2-6c20-455a-a8de-2d9b364bee6b", "value": "T1CDF3F11DB0109708D173A83C8D2750123FA59C4A98D5E68DA2E7B35F9274BBA1B1F7CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491106, "uuid": "675fb98b-e46b-4bd4-aaaf-224a525a6f0d", "value": "3072:/pIAtljTI80sIVmIfV9YqDCtqiwGdwrWV8yyJcsRxlMVeDtbU8dPF7Gx53wELH:mAtVTuP9YtZwMgIUcslMI+x53bL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665491106, "uuid": "e83436be-6117-4c44-adeb-da35a1aad135", "value": 172544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665491106, "uuid": "38597b54-d886-44c0-bd75-15360484986a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665491106, "uuid": "1d4b71f2-de11-4b3a-923f-2ca391ec1015", "value": "SecuriteInfo.com.Exploit.CVE-2018-0802.Gen.1657.29237", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f8e736-492e-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1665470126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470126, "uuid": "16244489-e2b6-4440-b562-bac67576b622", "comment": "Malware payload (SnakeKeylogger)", "value": "23f6e3cd891a4a67b82549cb993b4467", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470126, "uuid": "226a47ca-8c95-4c96-b3cc-8f01ec7c4f19", "comment": "Malware payload (SnakeKeylogger)", "value": "fe33c22faabafd696535976eb75d55862b2f32339536c87f32775f0152c53b06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470126, "uuid": "70219d93-fc5a-4783-9bb4-ccd48d7d1745", "comment": "Malware payload (SnakeKeylogger)", "value": "e6a9420a4a3f8187fe11486fe70b3943f55055b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665470126, "uuid": "fcf1d8c3-e858-4fe5-8f4a-3bc1f00481ec", "comment": "Malware payload (SnakeKeylogger)", "value": "ec49c59ca39adf4e1f1335ad740218ef10110a22b920ed4fc8026e2bb9e91c4d0e1636250b5f999a8cf622389e93e441", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470126, "uuid": "c4ef8be0-9a86-4d19-8936-4cc6720e9095", "value": "T11D157B7E16994607D8183274C883D2F32AFBAE606061D1CB5AD72FAFBC512BF9513346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470126, "uuid": "e1c9a29f-f777-4ca5-902e-106d228fa09a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470126, "uuid": "e19ac984-31eb-42d0-a6f6-75c06984827e", "value": "12288:cUwN+z+ZoEQd5HWc1XLDp9az6dpoMMAmmBaogj1CGRTsjAQSQy4A:xWolHJLl9rDoQabeAtQy4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665470126, "uuid": "1440ce68-44c4-4e94-a088-4776230ca6e7", "value": 950272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665470126, "uuid": "3bbbbf91-0bac-44f2-b4f3-c3d0f41989c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665470126, "uuid": "d6b27592-accf-4054-87f3-b19baa1a9cb2", "value": "Q178101_Quote_221007_1415.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d1f3a2a-4971-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1665498649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498649, "uuid": "7c159d02-267a-42f9-95c0-67f30f97c05d", "comment": "Malware payload (Mirai)", "value": "fe78548498e20313a87f544cb9b6b195", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498649, "uuid": "ab662766-1b23-4d5f-880d-cd867cd7e718", "comment": "Malware payload (Mirai)", "value": "fe33ce70090fefa415224bf2a4927ab5c0103b6c6983cc270f806c40e75cd056", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498649, "uuid": "34657867-cfc3-44ea-9422-407addf9ce32", "comment": "Malware payload (Mirai)", "value": "202de9883a905b0c63113496e272a95dcfae0634", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665498649, "uuid": "fa1ead32-64d8-48e7-b68d-e319ad021876", "comment": "Malware payload (Mirai)", "value": "9b587a097ab398789de63da4ff850ad45e32d8c76210500b9e1717b7d717149f2998f4daf35c00dfac936d3e548bed1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498649, "uuid": "e39e1140-ac91-4d36-b34d-3c82507c61b4", "value": "T1B5731935B5311A23C2D6A57E61F74332F2F466492CB8C66A7C621F5CBF611C02267FA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498649, "uuid": "408ac5e9-8ae9-4495-a3f7-5f03d9d741e2", "value": "768:RGTq6NqYLl1p/5yJyH1m70ZIHE/omhiZ+zNY8JO+s52XA1YmD+a1t6IITppsA:RGmyqYLt/40H1ja6rbs52MtrNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665498649, "uuid": "ffc80c2e-052c-4aec-8023-5e39831d9656", "value": 79928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665498649, "uuid": "605ee40d-dac0-4d74-8ba1-0688697b3cfb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665498649, "uuid": "9858f95c-4aa1-4632-81bc-2c439a67c00e", "value": "fe78548498e20313a87f544cb9b6b195", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68402a6-4919-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1665461003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1665461003, "uuid": "ea83edbb-793b-4766-ad63-4dce2fc08503", "comment": "Malware payload", "value": "048281c0731edf101f02abb1b69a2226", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1665461003, "uuid": "f2fc94b2-0356-470f-a3b7-778819403e6d", "comment": "Malware payload", "value": "ff5ff082f27b757b72d80e2c78a5937a3e57c48c57a0b7f566e1187cd4b371e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1665461003, "uuid": "6cbcac80-c7c9-4576-ac16-10eea08cce38", "comment": "Malware payload", "value": "a6ea5595847d3cbc13c3728c284357bf52a1b945", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1665461003, "uuid": "64e665aa-0ea1-4283-88d0-c555de468c99", "comment": "Malware payload", "value": "2091187bd1859c6604bd606802b86787b1bff1f834226dccde2923aed8ff1c442a75fc53532178494d742d668f95cfc6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1665461003, "uuid": "3c984d86-2903-40fa-8acf-1efb0e09f2c8", "value": "T1CDE3E1217690E432C8A7767988B4D6117FBBB82216684D8B3B5413FF4F302D19A7A35E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1665461003, "uuid": "a9d6080c-19bc-4624-b275-858144cd4f5f", "value": "54293b511061c1328b2f106c079d81bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1665461003, "uuid": "bf2e0a61-effe-4a02-9a6e-a56350a950a4", "value": "3072:VNRIUQ7gJGR4AVYZ0Ictpyt28+nqlBB01Qs3wsE:Cg7AVy0Imo8vwsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1665461003, "uuid": "d3c7009c-acab-4874-bde4-2c5ff887018f", "value": 144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1665461003, "uuid": "e07543d0-5c83-4e88-85c9-f216e5a4985b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1665461003, "uuid": "b2db2fc4-7f19-45ea-a44e-c90828cf18ba", "value": "048281c0731edf101f02abb1b69a2226", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }